Medium-severity CVEs (page 48)
Page 48 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-81428 | Medium | 6.5 | 2026-09-02 | The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing auth… |
CVE-2026-81427 | Medium | 4.3 | 2026-09-02 | The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order… |
CVE-2026-81426 | Medium | 4.3 | 2026-09-02 | The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attacke… |
CVE-2026-81199 | Medium | 5.3 | 2026-09-02 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning a student's learning statistics… |
CVE-2026-81197 | Medium | 5.3 | 2026-09-02 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filte… |
CVE-2026-81195 | Medium | 5.3 | 2026-09-02 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning per-student course enrollment and… |
CVE-2026-81194 | Medium | 4.3 | 2026-09-02 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retrieving order line-item data, allowing any… |
CVE-2026-79621 | Medium | 4.3 | 2026-09-02 | The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enqui… |
CVE-2026-78151 | Medium | 5.3 | 2026-09-02 | The FormLayer WordPress plugin before 1.0.9 does not perform any authorization check before returning a form's full stored configuration in the response to its… |
CVE-2026-77788 | Medium | 4.9 | 2026-09-02 | The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against, a… |
CVE-2026-77782 | Medium | 5.3 | 2026-09-02 | The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated S… |
CVE-2026-77764 | Medium | 4.3 | 2026-09-02 | The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its video watch-tracking functionality, allowing users with a role as low as Subscrib… |
CVE-2026-74927 | Medium | 5.3 | 2026-09-02 | The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated us… |
CVE-2026-19719 | Medium | 6.8 | 2026-09-02 | The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape the post title before outputting it in an inline JavaScript… |
CVE-2026-19704 | Medium | 5.3 | 2026-09-02 | The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inject SQL and read co… |
CVE-2026-19251 | Medium | 5.3 | 2026-09-02 | The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before… |
CVE-2026-16983 | Medium | 4.3 | 2026-09-02 | The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of pa… |
CVE-2026-16966 | Medium | 5.3 | 2026-09-02 | The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated vi… |
CVE-2026-15232 | Medium | 5.3 | 2026-09-02 | The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking iden… |
CVE-2026-14215 | Medium | 6.5 | 2026-09-02 | The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the pos… |
CVE-2025-15664 | Medium | 6.8 | 2026-09-02 | The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's before-label value before its bundled cl… |
CVE-2025-15663 | Medium | 6.8 | 2026-09-02 | The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled cli… |
CVE-2026-3851 | Medium | 6.4 | 2026-09-02 | The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON format in all versions up to, and inclu… |
CVE-2026-84442 | Medium | 4.4 | 2026-09-02 | A vulnerability was identified in MapQuest Get Directions App 10.16.1 on Android. This vulnerability affects the function getDataColumn of the file ExpoShareIn… |
CVE-2026-84431 | Medium | 4.4 | 2026-09-02 | A vulnerability was detected in AirAsia MOVE App up to 12.47.1 on Android. This issue affects the function com.airasia.core.utils.RealPathUtil.getRealPath of t… |
CVE-2026-82968 | Medium | 6.4 | 2026-09-02 | A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social identity provider account to their loca… |
CVE-2026-84701 | Medium | 5.4 | 2026-09-02 | NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Att… |
CVE-2026-84698 | Medium | 6.5 | 2026-09-02 | PX4 Autopilot contains a heap buffer overflow vulnerability in the sd_bench command that writes a four-byte block number into a user-supplied sized allocation… |
CVE-2026-84697 | Medium | 5.3 | 2026-09-02 | Mailpit's IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IPv6 prefix, allowing… |
CVE-2026-84430 | Medium | 6.3 | 2026-09-02 | A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update of the file app/home/controller/Index… |
CVE-2026-84427 | Medium | 4.3 | 2026-09-02 | A vulnerability was determined in zhayujie CowAgent up to 2.1.7. Affected is an unknown function of the file agent/tools/bash/bash.py of the component Bash Too… |
CVE-2026-84425 | Medium | 4.3 | 2026-09-02 | A vulnerability was found in zhayujie CowAgent up to 2.1.3. This impacts the function BrowserTool of the file agent/tools/browser/browser_tool.py of the compon… |
CVE-2026-84358 | Medium | 4.2 | 2026-09-02 | Improper privilege management in Downloads in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to spoof… |
CVE-2026-84357 | Medium | 6.5 | 2026-09-02 | Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass web origin polic… |
CVE-2026-84356 | Medium | 4.3 | 2026-09-02 | UI misrepresentation in FullScreen in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium se… |
CVE-2026-84348 | Medium | 6.5 | 2026-09-02 | Information leak in MediaCapture in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to potentially leak sensitive information via a crafted HTML… |
CVE-2026-84332 | Medium | 6.5 | 2026-09-02 | Incorrect authorization in SiteSettings in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to bypass system access restrictions via a crafted HT… |
CVE-2026-84330 | Medium | 5.4 | 2026-09-02 | UI misrepresentation in FullScreen in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML page… |
CVE-2026-84329 | Medium | 5.3 | 2026-09-02 | Confused deputy in CredentialProvider in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-84327 | Medium | 6.5 | 2026-09-02 | Incorrect authorization in Autofill in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to obtain sen… |
CVE-2026-84323 | Medium | 5.3 | 2026-09-02 | Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and leveraged so… |
CVE-2026-84483 | Medium | 5.3 | 2026-09-01 | WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows unauthenticated attackers to compute valid… |
CVE-2026-84477 | Medium | 5.4 | 2026-09-01 | AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streaming permission to inject malicious scrip… |
CVE-2026-84373 | Medium | 5.9 | 2026-09-01 | Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in pack… |
CVE-2026-84289 | Medium | 4.3 | 2026-09-01 | A vulnerability was found in NousResearch hermes-agent up to 0.18.2. This vulnerability affects the function list_tools of the file tools/mcp_tool.py of the co… |
CVE-2026-84288 | Medium | 4.3 | 2026-09-01 | A vulnerability has been found in NousResearch hermes-agent up to 0.18.2. This affects the function HermesACPAgent.prompt of the file acp_adapter/session.py of… |
CVE-2026-84470 | Medium | 6.4 | 2026-09-01 | A flaw was found in Ansible Automation Platform's automation-controller (AWX). The Bulk Job Launch API (POST /api/v2/bulk/job_launch/) authorizes the requested… |
CVE-2026-84371 | Medium | 5.4 | 2026-09-01 | ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 unti… |
CVE-2026-84369 | Medium | 6.1 | 2026-09-01 | SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and… |
CVE-2026-84365 | Medium | 6.5 | 2026-09-01 | Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not c… |
CVE-2026-84364 | Medium | 5.3 | 2026-09-01 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody() expands dot-separated form field names… |
CVE-2026-84363 | Medium | 5.9 | 2026-09-01 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a liter… |
CVE-2026-84287 | Medium | 4.3 | 2026-09-01 | A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is some unknown functionality of the file gateway/platforms/api_server.py of… |
CVE-2026-73783 | Medium | 4.9 | 2026-09-01 | Stack overflow vulnerabilities exist in an API endpoint of AOS-CX. Successful exploitation could allow an authenticated malicious actor to cause a denial-of-se… |
CVE-2026-73772 | Medium | 6.5 | 2026-09-01 | Buffer overflow vulnerabilities exist in an underlying service of AOS-CX that could lead to an unauthenticated denial-of-service condition by sending specially… |
CVE-2026-73762 | Medium | 6.6 | 2026-09-01 | A vulnerability has been identified in the API endpoint of AOS-CX that could allow a remote actor to circumvent existing access controls. In some cases this co… |
CVE-2026-73761 | Medium | 6.5 | 2026-09-01 | An out-of-bounds read vulnerability exists in the underlying operating system of AOS-CX that could lead to unauthenticated information disclosure by sending a… |
CVE-2026-73760 | Medium | 6.5 | 2026-09-01 | An authenticated Path Traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to read arbitrary files from t… |
CVE-2026-73759 | Medium | 6.5 | 2026-09-01 | Vulnerabilities in AOS-CX could allow an unauthenticated remote malicious actor to trigger a denial-of-service condition by sending specially crafted packets… |
CVE-2026-73758 | Medium | 6.5 | 2026-09-01 | A privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation could allow an authenticated low privilege operator user to… |
CVE-2026-73757 | Medium | 6.4 | 2026-09-01 | A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a server-side request forgery (SSRF) at… |
CVE-2026-73756 | Medium | 5.9 | 2026-09-01 | A vulnerability in an API endpoint of AOS-CX could allow a remote unauthenticated attacker to obtain sensitive information via a man-in-the-middle attack. Succ… |
CVE-2026-73755 | Medium | 5.7 | 2026-09-01 | A privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation could allow an authenticated low-privilege operator user, af… |
CVE-2026-73754 | Medium | 5.3 | 2026-09-01 | Denial-of-service vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation could allow an authenticated user to disrupt the norma… |
CVE-2026-73524 | Medium | 6.1 | 2026-09-01 | Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by em… |
CVE-2026-63435 | Medium | 5.3 | 2026-09-01 | Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.q_value_decode and Mail::Utilit… |
CVE-2026-84308 | Medium | 6.3 | 2026-09-01 | phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php per… |
CVE-2026-78608 | Medium | 6.5 | 2026-09-01 | Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an in… |
CVE-2026-78607 | Medium | 5.4 | 2026-09-01 | Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holdin… |
CVE-2026-78606 | Medium | 4.2 | 2026-09-01 | Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Co… |
CVE-2026-78605 | Medium | 5.9 | 2026-09-01 | Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smugglin… |
CVE-2026-78603 | Medium | 4.3 | 2026-09-01 | Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180)… |
CVE-2026-78597 | Medium | 4.3 | 2026-09-01 | Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constr… |
CVE-2026-73742 | Medium | 4.3 | 2026-09-01 | A vulnerability in an API endpoint of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to spoof the source address attri… |
CVE-2026-73741 | Medium | 4.3 | 2026-09-01 | A vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to view some system files. Successful exp… |
CVE-2026-73740 | Medium | 4.4 | 2026-09-01 | A local privilege escalation vulnerability in HPE Networking Fabric Composer could allow an authenticated privileged user on the underlying host to elevate the… |
CVE-2026-73739 | Medium | 4.4 | 2026-09-01 | A vulnerability exists in the API of HPE Networking Fabric Composer that allows for an attacker with administrative privileges to access sensitive information… |
CVE-2026-73738 | Medium | 4.7 | 2026-09-01 | A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low privilege operator user with local access… |
CVE-2026-73737 | Medium | 4.8 | 2026-09-01 | An unauthenticated path traversal vulnerability exists in the API endpoint of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenti… |
CVE-2026-73736 | Medium | 5.3 | 2026-09-01 | A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to view some system file… |
CVE-2026-73735 | Medium | 5.4 | 2026-09-01 | Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to access some information beyond their p… |
CVE-2026-73734 | Medium | 5.4 | 2026-09-01 | A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to redirect users to an… |
CVE-2026-73733 | Medium | 5.4 | 2026-09-01 | Authentication bypasses in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to circumvent existing authentica… |
CVE-2026-73732 | Medium | 5.6 | 2026-09-01 | A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low privilege operator user with local access… |
CVE-2026-73731 | Medium | 6.1 | 2026-09-01 | A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a reflected c… |
CVE-2026-73730 | Medium | 6.5 | 2026-09-01 | A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege op… |
CVE-2026-73729 | Medium | 6.5 | 2026-09-01 | A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low privilege operator user with local access… |
CVE-2026-73728 | Medium | 6.5 | 2026-09-01 | Denial-of-service vulnerabilities exist in the API of HPE Networking Fabric Composer that could allow an authenticated low privilege operator user to cause a d… |
CVE-2026-73727 | Medium | 6.5 | 2026-09-01 | Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to access sensitive information. A succes… |
CVE-2026-73726 | Medium | 6.8 | 2026-09-01 | A vulnerability has been identified in the underlying operating system of HPE Networking Fabric Composer that could potentially allow an unauthenticated adjace… |
CVE-2026-72682 | Medium | 6.5 | 2026-09-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated… |
CVE-2026-72654 | Medium | 6.5 | 2026-09-01 | Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An o… |
CVE-2026-72652 | Medium | 6.5 | 2026-09-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated… |
CVE-2026-72644 | Medium | 6.5 | 2026-09-01 | Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-priv… |
CVE-2026-72641 | Medium | 5.4 | 2026-09-01 | Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1… |
CVE-2026-72633 | Medium | 4.3 | 2026-09-01 | Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by… |
CVE-2026-72628 | Medium | 6.5 | 2026-09-01 | Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user hol… |
CVE-2026-63138 | Medium | 6.5 | 2026-09-01 | Improper Neutralization of Special Elements in Data Query Logic (CWE-943) in Kibana can lead to information disclosure via NoSQL Injection (CAPEC-676). An auth… |
CVE-2026-56143 | Medium | 4.9 | 2026-09-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user wi… |
CVE-2026-33465 | Medium | 6.5 | 2026-09-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated… |