Medium-severity CVEs (page 5)
Page 5 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-47232 | Medium | 4.3 | 2026-08-12 | Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive `mode=export` action in `modules/sso/keys.php` exports a PKCS#12 bun… |
CVE-2026-47230 | Medium | 6.5 | 2026-08-12 | Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-files.php` mode `file_rename_save` shares the same root-cause s… |
CVE-2026-47229 | Medium | 5.4 | 2026-08-12 | Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/sso/clients.php` validates an `adm_csrf_token` on every state-changing br… |
CVE-2026-47228 | Medium | 5.2 | 2026-08-12 | Admidio is an open-source user management solution. `modules/registration.php` mode `send_login` regenerates a random password for `user_uuid_assigned`, stores… |
CVE-2026-47227 | Medium | 6.5 | 2026-08-12 | Admidio is an open-source user management solution. `modules/categories.php` checks that the supplied `type` parameter (`ANN`, `EVT`, `ROL`, `USF`, …) correspo… |
CVE-2026-16999 | Medium | 6.3 | 2026-08-12 | Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking. This… |
CVE-2026-71408 | Medium | 5.3 | 2026-08-12 | A allocation of resources without limits or throttling vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4 all versions, FortiOS 7.2 all version… |
CVE-2026-71407 | Medium | 5.6 | 2026-08-12 | A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6 may allow an unauthenticated attacker who can bypas… |
CVE-2026-70466 | Medium | 5.3 | 2026-08-12 | A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4 all versions, FortiWe… |
CVE-2026-47226 | Medium | 6.5 | 2026-08-12 | Admidio is an open-source user management solution. Prior to version 5.0.10, an authenticated Admidio member with upload rights on any one folder can permanent… |
CVE-2026-70560 | Medium | 5.4 | 2026-08-12 | Ultimate POS (Stock Management & Point of Sale) contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inje… |
CVE-2026-17008 | Medium | 5.3 | 2026-08-12 | The Quick Paypal Payments WordPress plugin through 5.7.50 does not verify the paid amount, receiver, or payment status in its PayPal IPN handler and marks an o… |
CVE-2026-16990 | Medium | 5.3 | 2026-08-12 | The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment… |
CVE-2026-16747 | Medium | 6.5 | 2026-08-12 | The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shor… |
CVE-2026-16621 | Medium | 5.3 | 2026-08-12 | The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its P… |
CVE-2026-15213 | Medium | 5.3 | 2026-08-12 | The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauth… |
CVE-2026-15045 | Medium | 6.5 | 2026-08-12 | The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against the customer's actual stored balance d… |
CVE-2026-68868 | Medium | 6.5 | 2026-08-12 | The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the… |
CVE-2026-64955 | Medium | 6.1 | 2026-08-12 | When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution. Velocira… |
CVE-2026-64952 | Medium | 6.5 | 2026-08-12 | The hunt_delete() VQL function allows deleting hunts. Velociraptor misapplied the permission check requiring only COLLECT_CLIENT (usually assigned to the "in… |
CVE-2026-18663 | Medium | 5.9 | 2026-08-12 | A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function frees the parsed controls array on the Session Tracking critical-control rejection… |
CVE-2026-18652 | Medium | 4.9 | 2026-08-12 | Velociraptor allows reading Stacked result sets from the GUI. Velociraptor's multi-tenant design stores sub orgs within the datastore directory. The path requ… |
CVE-2025-41771 | Medium | 4.3 | 2026-08-12 | An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability a… |
CVE-2026-19217 | Medium | 5.4 | 2026-08-12 | The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could… |
CVE-2026-19073 | Medium | 5.3 | 2026-08-12 | The Order Sync with Zendesk for WooCommerce WordPress plugin before 2.2.3 does not perform any capability check on one of its REST API endpoints, and does not… |
CVE-2026-19052 | Medium | 4.3 | 2026-08-12 | The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is pu… |
CVE-2026-19050 | Medium | 6.4 | 2026-08-12 | The ProSolution WP Client WordPress plugin before 2.0.9 does not validate a user-supplied URL, and does not check the capability or nonce of the requester, bef… |
CVE-2026-18962 | Medium | 4.3 | 2026-08-12 | The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it process… |
CVE-2026-18943 | Medium | 6.5 | 2026-08-12 | The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allowing users with a role as low as subscri… |
CVE-2026-18046 | Medium | 4.3 | 2026-08-12 | The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on the REST route that stores it… |
CVE-2026-18035 | Medium | 5.3 | 2026-08-12 | The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allowing unauthenticated attackers to read… |
CVE-2026-17013 | Medium | 6.1 | 2026-08-12 | The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which cou… |
CVE-2026-16737 | Medium | 5.3 | 2026-08-12 | The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one… |
CVE-2026-16066 | Medium | 5.4 | 2026-08-12 | The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users wi… |
CVE-2026-15388 | Medium | 4.3 | 2026-08-12 | The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST rou… |
CVE-2026-15249 | Medium | 5.4 | 2026-08-12 | The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a… |
CVE-2026-14859 | Medium | 4.3 | 2026-08-12 | The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated user… |
CVE-2026-14858 | Medium | 4.3 | 2026-08-12 | The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subs… |
CVE-2026-14857 | Medium | 4.3 | 2026-08-12 | The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification… |
CVE-2026-13612 | Medium | 4.3 | 2026-08-12 | The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level user… |
CVE-2026-13177 | Medium | 4.3 | 2026-08-12 | The Eventin WordPress plugin before 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and abo… |
CVE-2026-13168 | Medium | 6.5 | 2026-08-12 | The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and abov… |
CVE-2026-12976 | Medium | 6.5 | 2026-08-12 | The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's… |
CVE-2026-12235 | Medium | 6.3 | 2026-08-12 | The Linkable Loadable Extensions (llext) subsystem mis-handles PLT/RELA relocation entries when linking a relocatable (partially-linked) ELF extension. In llex… |
CVE-2026-12233 | Medium | 5.9 | 2026-08-12 | The PSA Protected Storage credential backend (subsys/net/lib/tls_credentials/tls_credentials_trusted.c) declared its credential-store mutex as a plain zero-fil… |
CVE-2026-12232 | Medium | 6.1 | 2026-08-12 | The Intel ALH digital-audio-interface driver function dai_alh_get_properties() in drivers/dai/intel/alh/alh.c used a caller-supplied int stream_id with no rang… |
CVE-2025-15687 | Medium | 4.3 | 2026-08-12 | A security flaw has been discovered in Open5GS up to 2.7.6. Impacted is the function smf_gx_cca_cb of the component SMF Diameter Gx Credit-Control-Answer Handl… |
CVE-2026-9318 | Medium | 5.4 | 2026-08-12 | tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScr… |
CVE-2026-19588 | Medium | 6.5 | 2026-08-12 | Integer Overflow to Buffer Overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers. |
CVE-2026-19587 | Medium | 6.5 | 2026-08-12 | Uncontrolled Resource Consumption vulnerability in Samsung Open Source rlottie allows Excessive Allocation. |
CVE-2025-15686 | Medium | 4.3 | 2026-08-12 | A vulnerability has been found in Open5GS up to 2.7.6. Affected by this issue is the function fd_msg_sess_get of the component HSS Service. Such manipulation o… |
CVE-2025-15685 | Medium | 6.3 | 2026-08-12 | A flaw has been found in Open5GS up to 2.7.1. Affected by this vulnerability is an unknown functionality of the component freeDiameter. This manipulation cause… |
CVE-2025-15684 | Medium | 5.3 | 2026-08-12 | A vulnerability was detected in Open5GS up to 2.7.6. Affected is the function diam_log_func of the file lib/diameter/common/init.c of the component CER Handler… |
CVE-2026-64927 | Medium | 6.4 | 2026-08-12 | A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles… |
CVE-2024-14044 | Medium | 6.3 | 2026-08-12 | A vulnerability was identified in Open5GS up to 2.7.1. This issue affects the function pcrf_rx_aar_cb of the file src/pcrf/pcrf-rx-path.c of the component Diam… |
CVE-2024-14043 | Medium | 6.3 | 2026-08-12 | A vulnerability was determined in Open5GS up to 2.7.1. This vulnerability affects the function mme_s6a_subscription_data_from_avp of the file src/mme/mme-fd-pa… |
CVE-2026-73245 | Medium | 6.5 | 2026-08-11 | Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management… |
CVE-2026-66340 | Medium | 5.3 | 2026-08-11 | The Mira cloud authentication endpoints do not enforce per-account rate limiting, per-IP throttling, or account lockout after repeated failed login attempts. A… |
CVE-2026-66098 | Medium | 6.5 | 2026-08-11 | The Mira hormone monitor device firmware accepts a 0x01 write from any BLE central without authentication, causing the device to reboot into bootloader mode. A… |
CVE-2026-64934 | Medium | 4.3 | 2026-08-11 | The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version… |
CVE-2026-18710 | Medium | 6.5 | 2026-08-11 | A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log o… |
CVE-2026-66832 | Medium | 6.5 | 2026-08-11 | When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as a query string para… |
CVE-2026-66148 | Medium | 6.3 | 2026-08-11 | An authenticated command injection vulnerability was identified in GMS Command-Line Interface (CLI) 9.5.1 (Build 9510.1044) and earlier versions which allows l… |
CVE-2026-63134 | Medium | 5.4 | 2026-08-11 | Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` protects file extraction with libarchive's secure flags, but crea… |
CVE-2026-63133 | Medium | 6.5 | 2026-08-11 | Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` extracts uploaded archives with no limit on entry count, director… |
CVE-2026-48762 | Medium | 5.4 | 2026-08-11 | TypeBot is a chatbot builder tool. Prior to version 3.16.0, the OpenAI "Create Transcription" action handler fetches a user-supplied audio URL using `fetch()`… |
CVE-2026-29035 | Medium | 6.5 | 2026-08-11 | CivetWeb (commit 4a4f0c95) contains a heap and stack buffer overflow vulnerability in the read_websocket() function that allows unauthenticated remote attacker… |
CVE-2026-19579 | Medium | 5.4 | 2026-08-11 | Snipe-IT before 8.6.0 contains an authorization bypass (insecure direct object reference) in the asset checkout-request cancellation endpoint. The cancel_by_ad… |
CVE-2026-19550 | Medium | 4.3 | 2026-08-11 | A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permissi… |
CVE-2026-73282 | Medium | 4.8 | 2026-08-11 | In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent. |
CVE-2026-73244 | Medium | 5.3 | 2026-08-11 | kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/jav… |
CVE-2026-73243 | Medium | 5.8 | 2026-08-11 | kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated GET /addTask endpoint in kkFileView is omitted… |
CVE-2026-73235 | Medium | 6.1 | 2026-08-11 | FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constructed in src/Base/Reader.cpp by Base::XM… |
CVE-2026-73229 | Medium | 4.3 | 2026-08-11 | Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's rest_framework/renderers.py AdminRende… |
CVE-2026-73036 | Medium | 4.4 | 2026-08-11 | Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment that allows local attackers to… |
CVE-2026-71845 | Medium | 6.3 | 2026-08-11 | A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCX_TOKEN, a bearer credent… |
CVE-2026-71475 | Medium | 5.0 | 2026-08-11 | A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This oc… |
CVE-2026-71474 | Medium | 6.3 | 2026-08-11 | A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com p… |
CVE-2026-71468 | Medium | 5.3 | 2026-08-11 | A flaw was found in acm-search-v2-api-rhel9. When the `getFederationConfig` function refreshes its cache, it improperly reuses a user's bearer token for all su… |
CVE-2026-70339 | Medium | 5.4 | 2026-08-11 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-66146 | Medium | 6.1 | 2026-08-11 | Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions that allow a remote attacker to execute… |
CVE-2024-14042 | Medium | 6.3 | 2026-08-11 | A vulnerability was found in Open5GS up to 2.7.1. This affects the function hss_ogs_diam_s6a_air_cb/hss_ogs_diam_s6a_ulr_cb of the file src/hss/hss-s6a-path.c… |
CVE-2026-73228 | Medium | 5.3 | 2026-08-11 | Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in rest_framework/request.py Request._p… |
CVE-2026-69117 | Medium | 6.5 | 2026-08-11 | NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django… |
CVE-2026-69115 | Medium | 6.5 | 2026-08-11 | OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitt… |
CVE-2026-18709 | Medium | 6.4 | 2026-08-11 | An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transa… |
CVE-2026-18708 | Medium | 6.4 | 2026-08-11 | An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed with… |
CVE-2026-18707 | Medium | 4.3 | 2026-08-11 | An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly… |
CVE-2026-18706 | Medium | 6.6 | 2026-08-11 | An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause… |
CVE-2026-18705 | Medium | 6.5 | 2026-08-11 | An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different… |
CVE-2026-18704 | Medium | 6.5 | 2026-08-11 | An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections… |
CVE-2026-18703 | Medium | 4.2 | 2026-08-11 | An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authe… |
CVE-2026-18702 | Medium | 6.4 | 2026-08-11 | An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the ent… |
CVE-2026-18701 | Medium | 6.5 | 2026-08-11 | An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate unexpectedly by su… |
CVE-2026-18700 | Medium | 6.5 | 2026-08-11 | An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the… |
CVE-2026-18699 | Medium | 6.5 | 2026-08-11 | An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly b… |
CVE-2026-18698 | Medium | 5.4 | 2026-08-11 | An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that… |
CVE-2026-18696 | Medium | 6.5 | 2026-08-11 | An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data-definition operati… |
CVE-2026-18695 | Medium | 6.5 | 2026-08-11 | An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticated user with write… |
CVE-2026-73216 | Medium | 6.5 | 2026-08-11 | Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, shutdown_client_connection() in src/server/ns_turn_server.c prematurely c… |