Medium-severity CVEs (page 49)
Page 49 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-84306 | Medium | 6.5 | 2026-09-01 | Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.6 and 5.7.6, packages/panels/src/Auth/MultiFactor/… |
CVE-2026-84270 | Medium | 4.3 | 2026-09-01 | A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, do_read() in gvfsbackendmtp.c trusts the data length returned by th… |
CVE-2026-84269 | Medium | 6.5 | 2026-09-01 | A flaw was found in the AFP backend in gvfs. When mounting a share, a malicious AFP server can cause the DSI read path to process a length that exceeds the siz… |
CVE-2026-84267 | Medium | 4.3 | 2026-09-01 | A flaw was found in the SFTP backend in gvfs. When mounting a share, a malicious SFTP server can cause read_string() to allocate a buffer with a certain length… |
CVE-2026-84232 | Medium | 5.4 | 2026-09-01 | A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type (e.g., te… |
CVE-2026-84207 | Medium | 5.4 | 2026-09-01 | Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes, allowing authenticated users to connect to internal service… |
CVE-2026-84206 | Medium | 4.3 | 2026-09-01 | Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to res… |
CVE-2026-84205 | Medium | 6.5 | 2026-09-01 | GROWI contains an access control vulnerability in the GET /_api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revis… |
CVE-2026-84204 | Medium | 6.5 | 2026-09-01 | GROWI contains an access control vulnerability in the GET /_api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attack… |
CVE-2026-84153 | Medium | 6.3 | 2026-09-01 | A vulnerability was determined in Xinhu Rainrock RockOA up to 2.3.2. The impacted element is the function toaddval of the file /index.php?m=index&a=publicsavev… |
CVE-2026-84114 | Medium | 6.3 | 2026-09-01 | A vulnerability has been found in Cleo Harmony up to 5.8.1.10. Impacted is the function LocalUserUtil.getNativeUserByAssertions of the component SAML Authentic… |
CVE-2026-84110 | Medium | 5.3 | 2026-09-01 | A vulnerability was detected in Releasit Releasit COD Form & Upsells v1. This vulnerability affects unknown code of the component OTP Validation. The manipulat… |
CVE-2026-83557 | Medium | 5.6 | 2026-09-01 | DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom v… |
CVE-2026-79685 | Medium | 6.5 | 2026-09-01 | Dell PowerStore contains an Argument Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to gai… |
CVE-2026-84109 | Medium | 6.3 | 2026-09-01 | A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. Affected by this issue is the function getOrder of the file webmain/webmainAction.php. Exe… |
CVE-2026-51761 | Medium | 5.3 | 2026-09-01 | Incorrect access control in the updateLanIp function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to refresh the LAN address state via… |
CVE-2026-51756 | Medium | 5.9 | 2026-09-01 | Incorrect access control in the meshSlaveUpgfw function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to start firmware flashing using… |
CVE-2026-51752 | Medium | 5.3 | 2026-09-01 | Incorrect access control in the staticInfoSend function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger static information rep… |
CVE-2026-51748 | Medium | 5.9 | 2026-09-01 | Incorrect access control in the sendStaticInfoToMaster function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to update stored slave in… |
CVE-2026-84139 | Medium | 6.1 | 2026-09-01 | Clickjacking issue in the DOM: Events component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
CVE-2026-84138 | Medium | 6.5 | 2026-09-01 | Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 155 and Thunderbird 155. |
CVE-2026-84137 | Medium | 4.3 | 2026-09-01 | Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
CVE-2026-84136 | Medium | 6.1 | 2026-09-01 | Other issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
CVE-2026-84127 | Medium | 4.3 | 2026-09-01 | Information disclosure in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 155. |
CVE-2026-84126 | Medium | 4.3 | 2026-09-01 | Incorrect boundary conditions in the Layout: Grid component. This vulnerability was fixed in Firefox 155 and Thunderbird 155. |
CVE-2026-84125 | Medium | 5.4 | 2026-09-01 | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
CVE-2026-84124 | Medium | 5.4 | 2026-09-01 | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderb… |
CVE-2026-84122 | Medium | 5.4 | 2026-09-01 | Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 1… |
CVE-2026-84120 | Medium | 5.4 | 2026-09-01 | Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbir… |
CVE-2026-84118 | Medium | 5.4 | 2026-09-01 | Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
CVE-2026-84061 | Medium | 6.3 | 2026-09-01 | A security flaw has been discovered in zhongyu09 OpenChatBI up to 0.3.0. Affected by this vulnerability is the function _validate_sql_safety of the file opench… |
CVE-2026-7877 | Medium | 6.4 | 2026-09-01 | The WP Recipe Maker Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wprm-call-to-action' shortcode in all versions… |
CVE-2026-53682 | Medium | 5.3 | 2026-09-01 | An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating int… |
CVE-2026-51745 | Medium | 5.3 | 2026-09-01 | Incorrect access control in the updatePriStaList function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to refresh the primary station… |
CVE-2026-51742 | Medium | 5.9 | 2026-09-01 | Incorrect access control in the discoverWan function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger WAN discovery logic via s… |
CVE-2026-84191 | Medium | 6.1 | 2026-09-01 | LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescription, vrf_name, and mplsVpnVrfRouteDist… |
CVE-2026-84188 | Medium | 4.8 | 2026-09-01 | LibreNMS versions <= 26.4.0 contain a stored cross-site scripting vulnerability in the graph_descr.<graphtype> configuration settings, which are echoed verbati… |
CVE-2026-77194 | Medium | 5.3 | 2026-09-01 | The Simple Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in versions up to, and including, 4… |
CVE-2026-11873 | Medium | 6.5 | 2026-09-01 | An Apache-proxied Dogtag CA REST endpoint exposed by IdM (POST /ca/rest/certrequests) returns HTTP 500 with internal Java stack traces for unauthenticated malf… |
CVE-2026-10420 | Medium | 5.5 | 2026-09-01 | Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before 102d3dc75cf8e58e68e4b… |
CVE-2025-15613 | Medium | 6.5 | 2026-09-01 | Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality. An attacker with permission to create Kyverno (C… |
CVE-2026-82927 | Medium | 5.5 | 2026-09-01 | Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before 06994e303637512e39062… |
CVE-2026-82926 | Medium | 5.5 | 2026-09-01 | NULL pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before afef59aa6f55c5d5ebf9b14bc0… |
CVE-2026-16788 | Medium | 6.4 | 2026-09-01 | The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslc_module_projects_output Shortcode… |
CVE-2026-16786 | Medium | 6.4 | 2026-09-01 | The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslc_module_testimonials_output Shortc… |
CVE-2026-15101 | Medium | 6.4 | 2026-09-01 | The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 8.7… |
CVE-2026-78363 | Medium | 4.8 | 2026-09-01 | The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user-submitted values from being executed when it merges those values into a messag… |
CVE-2026-74916 | Medium | 6.5 | 2026-09-01 | The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages… |
CVE-2026-13611 | Medium | 5.3 | 2026-09-01 | The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose… |
CVE-2026-77189 | Medium | 6.5 | 2026-09-01 | The Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) plugin for WordPress is vulnerable to generic SQ… |
CVE-2026-75980 | Medium | 6.4 | 2026-09-01 | The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading… |
CVE-2026-75964 | Medium | 6.1 | 2026-09-01 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… |
CVE-2026-18488 | Medium | 6.4 | 2026-09-01 | The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data) in all versions up… |
CVE-2026-83744 | Medium | 4.3 | 2026-09-01 | A security vulnerability has been detected in invoiceninja Invoice Ninja up to 5.13.26. This vulnerability affects the function Purify::isHostSafe of the file… |
CVE-2026-83743 | Medium | 6.3 | 2026-09-01 | A weakness has been identified in invoiceninja Invoice Ninja up to 5.13.26. This affects an unknown part of the file /vedor/profile/ of the component Vendor Po… |
CVE-2026-77823 | Medium | 4.9 | 2026-09-01 | The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the export_order_csv AJAX action in versions up to, and inclu… |
CVE-2026-76006 | Medium | 4.9 | 2026-09-01 | The Photo Gallery by Ays – Responsive Image Gallery plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, an… |
CVE-2026-75965 | Medium | 6.4 | 2026-09-01 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… |
CVE-2026-19948 | Medium | 5.3 | 2026-09-01 | The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to authorization bypass… |
CVE-2026-18752 | Medium | 6.5 | 2026-09-01 | The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection via 'wppl_device_id' Cookie in all versions up to, and including, 3.1.0 due to… |
CVE-2026-17589 | Medium | 4.9 | 2026-09-01 | The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'product_order' parameter in all versions up to, and in… |
CVE-2026-16787 | Medium | 6.4 | 2026-09-01 | The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslc_custom_field' Shortcode in all v… |
CVE-2026-13203 | Medium | 6.4 | 2026-09-01 | The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_id' shortcode attribute of… |
CVE-2026-12747 | Medium | 6.4 | 2026-09-01 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tag' Shortcode Attribute in all versions up to, and inc… |
CVE-2026-19032 | Medium | 5.3 | 2026-09-01 | jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPa… |
CVE-2026-67395 | Medium | 5.9 | 2026-09-01 | A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality due to improper validation of file path parameters. By leveragi… |
CVE-2026-82396 | Medium | 5.4 | 2026-08-31 | Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, src/Sulu/Bundle/MediaBundle/Controller… |
CVE-2026-77353 | Medium | 4.6 | 2026-08-31 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos allows authenticated users to inject arbitrary iCalendar… |
CVE-2026-77352 | Medium | 4.3 | 2026-08-31 | Wallos is an open-source, self-hostable personal subscription tracker. From version 2.0.0 to before version 5.0.0, any authenticated Wallos user (no admin righ… |
CVE-2026-82909 | Medium | 4.3 | 2026-08-31 | A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of… |
CVE-2026-82852 | Medium | 5.4 | 2026-08-31 | Unauthenticated Server Side Request Forgery (SSRF) in MapSVG <= 8.15.0 versions. |
CVE-2026-81890 | Medium | 5.4 | 2026-08-31 | elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector… |
CVE-2026-81888 | Medium | 5.4 | 2026-08-31 | @hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the… |
CVE-2026-81778 | Medium | 6.5 | 2026-08-31 | Subscriber Cross Site Scripting (XSS) in Kalles Addons <= 1.0.6 versions. |
CVE-2026-81762 | Medium | 6.5 | 2026-08-31 | Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions. |
CVE-2026-81758 | Medium | 6.3 | 2026-08-31 | Subscriber Broken Access Control in OwnerRez API <= 1.2.6 versions. |
CVE-2026-81280 | Medium | 6.5 | 2026-08-31 | Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders <= 4.0.0 versions. |
CVE-2026-81278 | Medium | 5.4 | 2026-08-31 | Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SM… |
CVE-2026-79483 | Medium | 5.3 | 2026-08-31 | FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attack… |
CVE-2026-75460 | Medium | 6.5 | 2026-08-31 | XueZhiSi Open Source Exam System <= 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role para… |
CVE-2026-54179 | Medium | 4.4 | 2026-08-31 | backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administratio… |
CVE-2026-50199 | Medium | 4.3 | 2026-08-31 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, endpoints/currency/update_exchange.php loads the first Fixer/API… |
CVE-2026-50198 | Medium | 4.3 | 2026-08-31 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, an authenticated user can edit their own inactive subscription a… |
CVE-2025-63607 | Medium | 6.1 | 2026-08-31 | TechStore 1.0 is vulnerable to Cross Site Scripting (XSS). In contact_display, the application echoes the id parameter verbatim into the rendered page, permitt… |
CVE-2026-82905 | Medium | 6.3 | 2026-08-31 | A vulnerability was detected in sdcb chats up to 1.12.0. This affects the function McpController of the file src/BE/web/Controllers/Users/Mcps/McpController.cs… |
CVE-2026-82835 | Medium | 5.4 | 2026-08-31 | A weakness has been identified in caoqianming django-vue-admin 1.0. This vulnerability affects unknown code of the file /api/file/. Executing a manipulation of… |
CVE-2026-82834 | Medium | 5.4 | 2026-08-31 | A security flaw has been discovered in Doccano Open Source Annotation Tools for Machine Learning Practitioners and Auto Labeling Pipeline Module to Annotate a… |
CVE-2026-82833 | Medium | 6.3 | 2026-08-31 | A vulnerability was identified in Doccano Open Source Annotation Tools for Machine Learning Practitioners and Auto Labeling Pipeline Module to Annotate a Docum… |
CVE-2026-81267 | Medium | 5.4 | 2026-08-31 | A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to r… |
CVE-2026-52730 | Medium | 4.3 | 2026-08-31 | Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing Authorization… |
CVE-2026-51739 | Medium | 5.9 | 2026-08-31 | Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger cloud update che… |
CVE-2026-51737 | Medium | 5.3 | 2026-08-31 | Incorrect access control in the clearTracerouteLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase traceroute logs via… |
CVE-2026-51732 | Medium | 5.3 | 2026-08-31 | Incorrect access control in the delWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entr… |
CVE-2026-14697 | Medium | 6.5 | 2026-08-31 | net_ipv6_send_ns() in subsys/net/ip/ipv6_nbr.c allocates a transmit net_pkt for a Neighbor Solicitation. When it is called with a data packet pending on an unr… |
CVE-2026-82821 | Medium | 4.3 | 2026-08-31 | A vulnerability was determined in FLVMeta up to 1.2.2. Affected by this vulnerability is the function amf_object_get of the file src/amf.c of the component AMF… |
CVE-2026-82820 | Medium | 4.3 | 2026-08-31 | A vulnerability was found in FLVMeta up to 1.2.2. Affected is the function amf_string_new of the file src/amf.c of the component AMF String Processing. The man… |
CVE-2026-82818 | Medium | 6.3 | 2026-08-31 | A vulnerability was determined in dibo-software diboot 3.8.0. This affects an unknown part of the file /api/iam/tenant/resource of the component Tenant Resourc… |
CVE-2026-14696 | Medium | 6.5 | 2026-08-31 | When Ethernet bridging is enabled (CONFIG_NET_ETHERNET_BRIDGE), eth_bridge_input_process() in subsys/net/l2/ethernet/bridge/bridge_input.c decides how each fra… |
CVE-2026-14368 | Medium | 5.4 | 2026-08-31 | The LwM2M JSON content formatter's get_string() in subsys/net/lib/lwm2m/lwm2m_rw_json.c copies a parsed JSON string into a caller-supplied buffer and NUL-termi… |
CVE-2023-20511 | Medium | 6.4 | 2026-08-31 | Release of an invalid pointer in the AMD kernel mode driver (KMD) could allow a privileged attacker to create a double free condition potentially leading to ar… |