Medium-severity CVEs (page 5)
Page 5 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-93897 | Medium | 6.4 | 2026-09-25 | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text-ty… |
CVE-2026-92829 | Medium | 4.3 | 2026-09-25 | The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.1.0. Thi… |
CVE-2026-92799 | Medium | 5.3 | 2026-09-25 | The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in all versions… |
CVE-2026-92746 | Medium | 6.4 | 2026-09-25 | The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Comment Block 'suffixM… |
CVE-2026-92212 | Medium | 6.1 | 2026-09-25 | The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parame… |
CVE-2026-78397 | Medium | 4.0 | 2026-09-25 | The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling back to an unprotected fetch when its sa… |
CVE-2026-78394 | Medium | 4.1 | 2026-09-25 | The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied destination folder before writing a generated image to disk, allowing users wi… |
CVE-2026-78393 | Medium | 6.1 | 2026-09-25 | The Link Library WordPress plugin before 7.9.6 does not properly escape some parameters before outputting them in the addresses of links it generates on its fr… |
CVE-2026-19775 | Medium | 4.3 | 2026-09-25 | The OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and i… |
CVE-2026-97736 | Medium | 5.4 | 2026-09-25 | tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression. |
CVE-2026-97732 | Medium | 5.1 | 2026-09-25 | IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticates client executables by checking for expected publisher and root-certificate st… |
CVE-2025-14814 | Medium | 6.4 | 2026-09-25 | The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cjtoolbox shortcode in all versions up to, and… |
CVE-2026-97724 | Medium | 4.3 | 2026-09-25 | A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlled object containing a __proto__ propert… |
CVE-2026-97650 | Medium | 4.3 | 2026-09-25 | A vulnerability has been found in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function e… |
CVE-2026-97723 | Medium | 5.4 | 2026-09-25 | madpsy ka9q_ubersdr before 0.1.58 has a stored cross-site scripting (XSS) vulnerability in the chat message rendering functionality. User-controlled URLs in ch… |
CVE-2026-97649 | Medium | 4.7 | 2026-09-25 | A flaw has been found in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this vulnerability is an unknown func… |
CVE-2026-97648 | Medium | 4.3 | 2026-09-25 | A vulnerability was detected in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected is an unknown function. Performin… |
CVE-2026-97647 | Medium | 5.3 | 2026-09-25 | A security vulnerability has been detected in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This impacts an unknown func… |
CVE-2026-95811 | Medium | 6.5 | 2026-09-25 | Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path… |
CVE-2026-97636 | Medium | 6.5 | 2026-09-24 | Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deploymen… |
CVE-2026-97368 | Medium | 6.3 | 2026-09-24 | A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInfo of the file blade-service/blade-syste… |
CVE-2026-97366 | Medium | 6.3 | 2026-09-24 | A security flaw has been discovered in jhen0409 react-native-debugger up to 0.14.0. The impacted element is the function openDevTools of the file electron/wind… |
CVE-2026-93353 | Medium | 5.3 | 2026-09-24 | copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users to create, remove, and truncate arbitra… |
CVE-2026-88387 | Medium | 5.5 | 2026-09-24 | LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::parse_tiff_ifd() when processing TIFF tag 0x00fe (NewSubfileType). A specially… |
CVE-2026-88386 | Medium | 5.5 | 2026-09-24 | libsndfile 1.2.2 contains a misaligned memory access issue in psf_binheader_readf() while parsing WAV fmt chunks. A specially crafted WAV file can cause the fu… |
CVE-2026-87118 | Medium | 5.7 | 2026-09-24 | The Botslab G980H dash camera firmware contains an out of bounds write vulnerability in its command processing functionality. An authenticated attacker with ad… |
CVE-2026-84403 | Medium | 6.2 | 2026-09-24 | The Botslab G980H dash camera firmware does not require authenticated pairing or client binding before permitting access to Bluetooth Low Energy communications… |
CVE-2026-82716 | Medium | 4.6 | 2026-09-24 | The Botslab G980H dash camera firmware includes sensitive configuration information, including WiFi credentials, in diagnostic logs generated during the suppor… |
CVE-2026-82708 | Medium | 6.5 | 2026-09-24 | The Botslab G980H dash camera firmware contains a path traversal vulnerability in its HTTP server. An attacker with access to the device's WiFi network could s… |
CVE-2026-82585 | Medium | 6.5 | 2026-09-24 | The Botslab G980H dash camera firmware transmits sensitive information over unencrypted HTTP and RTSP connections. An attacker capable of intercepting communic… |
CVE-2026-79959 | Medium | 6.8 | 2026-09-24 | The Botslab G980H dash camera firmware contains a hard-coded root account password that cannot be changed by the user. An attacker who obtains the firmware or… |
CVE-2026-75558 | Medium | 5.3 | 2026-09-24 | The Botslab G980H dash camera firmware uses a hard-coded cryptographic key and initialization vector to protect WiFi credentials communicated by the device. An… |
CVE-2026-97365 | Medium | 6.3 | 2026-09-24 | A vulnerability was determined in chonkie-inc littrs 0.6.1/0.6.2. Impacted is the function Sandbox::mount of the file crates/littrs/src/lib.rs. Executing a man… |
CVE-2026-97325 | Medium | 4.3 | 2026-09-24 | A security flaw has been discovered in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected by this vulnerability is the function validOAuthClientFromCac… |
CVE-2026-93290 | Medium | 5.5 | 2026-09-24 | Omni C20 uses hard-coded credentials that could allow an attacker to monitor log files to obtain credentials to access information like mapping data. |
CVE-2026-88956 | Medium | 6.8 | 2026-09-24 | The Botslab G980H dash camera firmware contains an authentication vulnerability in the root account exposed through the device's UART interface. The affected a… |
CVE-2026-88761 | Medium | 5.3 | 2026-09-24 | The Botslab G980H dash camera firmware generates the default WiFi password using predictable device information, portions of which are advertised by the produc… |
CVE-2026-48543 | Medium | 5.4 | 2026-09-24 | Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in… |
CVE-2026-48542 | Medium | 5.4 | 2026-09-24 | Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in… |
CVE-2026-48541 | Medium | 5.4 | 2026-09-24 | Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in… |
CVE-2026-48540 | Medium | 5.4 | 2026-09-24 | Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in… |
CVE-2026-97323 | Medium | 6.3 | 2026-09-24 | A vulnerability was determined in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This impacts the function getOriginalFilename of the file yudao-module-mp/s… |
CVE-2026-97322 | Medium | 4.3 | 2026-09-24 | A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This affects an unknown function of the file yudao-module-infra/src/main/java/cn… |
CVE-2026-97321 | Medium | 6.3 | 2026-09-24 | A vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The impacted element is the function GoViewDataServiceImpl.getDataBySQL of… |
CVE-2026-97320 | Medium | 6.3 | 2026-09-24 | A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The affected element is the function AiKnowledgeDocumentServiceImpl.readUrl of the f… |
CVE-2026-96748 | Medium | 6.5 | 2026-09-24 | PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an applica… |
CVE-2026-96747 | Medium | 5.0 | 2026-09-24 | The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain… |
CVE-2026-85738 | Medium | 6.3 | 2026-09-24 | TREK is a collaborative travel planner. Prior to 3.4.0, the checkSsrf logic in server/src/utils/ssrfGuard.ts does not recognize NAT64, 6to4, or Teredo IPv6 tra… |
CVE-2026-77321 | Medium | 4.3 | 2026-09-24 | TREK is a collaborative travel planner. Prior to 3.3.0, the get_trip_summary tool in server/src/mcp/tools/trips.ts is registered for scoped OAuth MCP tokens wi… |
CVE-2026-77320 | Medium | 5.3 | 2026-09-24 | TREK is a collaborative travel planner. Prior to 3.3.0, getSharedTripData in server/src/services/shareService.ts returns days, assignments, dayNotes, and place… |
CVE-2026-65827 | Medium | 6.5 | 2026-09-24 | Docmost is open-source collaborative wiki and documentation software. From 0.21.0 until 0.95.0, any authenticated workspace member with edit rights to a space… |
CVE-2026-62286 | Medium | 4.3 | 2026-09-24 | Dozzle is a realtime log viewer for docker containers. Prior to 10.6.7, streamEvents in internal/web/events.go applies a restricted user's label filter to cont… |
CVE-2026-56792 | Medium | 4.4 | 2026-09-24 | Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulnerability. A low privileged attacker with local access could… |
CVE-2026-52853 | Medium | 5.2 | 2026-09-24 | Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow t… |
CVE-2026-52850 | Medium | 4.3 | 2026-09-24 | Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace member who does not belong to a private space… |
CVE-2026-48073 | Medium | 4.3 | 2026-09-24 | Docmost is open-source collaborative wiki and documentation software. From 0.70.0 until 0.80.1, a low-privileged authenticated user who can edit an exportable… |
CVE-2026-48072 | Medium | 5.3 | 2026-09-24 | Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, the public avatar and logo image endpoint accepts attacker-controlled fi… |
CVE-2026-97232 | Medium | 6.3 | 2026-09-24 | A vulnerability was determined in volotat Anagnorisis up to 0.4.2. Affected by this vulnerability is the function get_file_content/save_file_content/move_files… |
CVE-2026-93405 | Medium | 6.1 | 2026-09-24 | Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Sn… |
CVE-2026-91121 | Medium | 5.0 | 2026-09-24 | Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message… |
CVE-2026-91120 | Medium | 5.4 | 2026-09-24 | Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds cou… |
CVE-2026-91119 | Medium | 6.4 | 2026-09-24 | Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components… |
CVE-2026-81508 | Medium | 4.3 | 2026-09-24 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.5, 6.0.1, and 6.1, the BlueDroid A2DP sink function btc_a2dp_sink_handle_inc_me… |
CVE-2026-61811 | Medium | 6.5 | 2026-09-24 | Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.8.0 until 4.14.7, the _getattribu… |
CVE-2026-61784 | Medium | 6.1 | 2026-09-24 | xhtml-purifier is a Node.js library to take in raw/unknown/untrusted HTML and output cleaned, purified, trusted HTML. Versions prior to 0.4.3 do not HTML-entit… |
CVE-2026-57179 | Medium | 4.2 | 2026-09-24 | Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the partial-pipeline resume mechanism accepted `partial_token` as… |
CVE-2026-57177 | Medium | 4.3 | 2026-09-24 | Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the a… |
CVE-2026-57176 | Medium | 6.8 | 2026-09-24 | Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend user_id as the… |
CVE-2026-57175 | Medium | 6.4 | 2026-09-24 | Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consume… |
CVE-2026-54461 | Medium | 6.5 | 2026-09-24 | Habitica is a habit tracker application that treats goals like a role-playing game. From 4.172.1 until 5.48.2, a query parameter on Habitica's /api/v3/groups/… |
CVE-2026-94281 | Medium | 6.5 | 2026-09-24 | An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client. |
CVE-2026-93545 | Medium | 6.5 | 2026-09-24 | An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client. |
CVE-2026-93544 | Medium | 6.5 | 2026-09-24 | An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before 1.8.4 can be used by a malicious X server to crash an attached X client. |
CVE-2026-93542 | Medium | 6.5 | 2026-09-24 | An out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes() in libXi before 1.8.4 could be used by malicous servers to crash the X… |
CVE-2026-91161 | Medium | 6.4 | 2026-09-24 | OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the GET /api/sessions/{sessionId}/groups/{groupId}/invite-code endpoint and t… |
CVE-2026-91134 | Medium | 5.4 | 2026-09-24 | Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the Discourse post sanitizer allowed a stored cross-origi… |
CVE-2026-91133 | Medium | 6.5 | 2026-09-24 | Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metac… |
CVE-2026-91132 | Medium | 4.3 | 2026-09-24 | Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowed_iframes sett… |
CVE-2026-88384 | Medium | 5.5 | 2026-09-24 | OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially crafted EXR file containing an unknown-type attribute with da… |
CVE-2026-88377 | Medium | 6.2 | 2026-09-24 | Bento4 1.6.0.0 contains an integer underflow vulnerability in the avcC and hvcC configuration atom parsers. A specially crafted MP4 file containing an atom wit… |
CVE-2026-88367 | Medium | 6.5 | 2026-09-24 | NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__curveDivs() during SVG stroke rasterization. A specially crafted SVG document… |
CVE-2026-84302 | Medium | 4.2 | 2026-09-24 | Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with private messages… |
CVE-2026-79763 | Medium | 5.3 | 2026-09-24 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.0 until 2.5.1, the POST /users/totp/disa… |
CVE-2026-79762 | Medium | 5.5 | 2026-09-24 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, Termix derives the keys t… |
CVE-2026-47132 | Medium | 5.4 | 2026-09-24 | phpMyFAQ is an open source FAQ web application. Prior to version 4.2.0-alpha, an authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat use… |
CVE-2026-97226 | Medium | 6.3 | 2026-09-24 | A vulnerability has been found in DbGate up to 7.2.5/7.3.1-premium-beta.1. This impacts the function fs.readFile of the file packages/api/src/controllers/files… |
CVE-2026-97225 | Medium | 6.3 | 2026-09-24 | A flaw has been found in DbGate up to 7.2.5-beta.5. This affects an unknown function of the file packages/api/src/controllers/runners.js of the component JSON… |
CVE-2026-96746 | Medium | 6.5 | 2026-09-24 | An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the respo… |
CVE-2026-96745 | Medium | 5.6 | 2026-09-24 | Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored… |
CVE-2026-93541 | Medium | 6.5 | 2026-09-24 | An out-of-bounds read in libXi's XQueryDeviceState() in libXi before 1.8.4 could be used by a |
CVE-2026-92680 | Medium | 5.5 | 2026-09-24 | Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply suff… |
CVE-2026-88370 | Medium | 5.3 | 2026-09-24 | libconfini 1.16.4 contains a heap out-of-bounds write condition involving the bundled load_ini_buffer.h utility and strip_ini_cache(). The bundled utility allo… |
CVE-2026-88358 | Medium | 6.5 | 2026-09-24 | simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parse_unpadded(). A specially crafted truncated JSON document whose final s… |
CVE-2026-79761 | Medium | 6.6 | 2026-09-24 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the Termix SSH key deploy… |
CVE-2026-79760 | Medium | 6.4 | 2026-09-24 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, Termix allows authenticat… |
CVE-2026-79759 | Medium | 4.3 | 2026-09-24 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the POST /credentials/:id… |
CVE-2026-79758 | Medium | 5.4 | 2026-09-24 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.8.0 until 2.5.1, authenticated Termix user… |
CVE-2026-76907 | Medium | 6.5 | 2026-09-24 | LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 4.8.2 until 5.4.0, GET /api/v1.0/documents/search/ accepts sequential seven-d… |
CVE-2025-32000 | Medium | 4.3 | 2026-09-24 | HCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input. When user input is implicitly or expl… |
CVE-2026-97224 | Medium | 4.3 | 2026-09-24 | A vulnerability was detected in Excalidraw up to 0.18.1. The impacted element is an unknown function of the file packages/excalidraw/data/restore.ts of the com… |