Medium-severity CVEs (page 51)
Page 51 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-82643 | Medium | 6.5 | 2026-08-30 | WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php that accepts credentials over GET without… |
CVE-2026-82548 | Medium | 5.3 | 2026-08-30 | A vulnerability was determined in Linux Foundation Magma 1.9.0. The impacted element is an unknown function of the component InitialUEMessage Handler. This man… |
CVE-2026-82547 | Medium | 6.5 | 2026-08-30 | A vulnerability was found in Linux Foundation Magma 1.9.0. The affected element is an unknown function of the file tasks/amf/amf_fsm.cpp of the component Regis… |
CVE-2026-82545 | Medium | 6.3 | 2026-08-30 | A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/sup_searchfrm.php. The manipu… |
CVE-2026-82640 | Medium | 5.5 | 2026-08-30 | browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions. Attackers with re… |
CVE-2026-82637 | Medium | 5.3 | 2026-08-30 | browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in run_agent_task, allowing attackers to create directories at arbitrar… |
CVE-2026-82544 | Medium | 4.3 | 2026-08-30 | A flaw has been found in wger-project wger up to 2.6.0-alpha2. This issue affects the function reset_user_password of the file wger/gym/views/gym.py of the com… |
CVE-2026-82634 | Medium | 6.5 | 2026-08-30 | Frappe Framework development builds contain an authorization flaw in the render_jinja_template endpoint that allows low-privileged users to render arbitrary Ji… |
CVE-2026-82633 | Medium | 4.3 | 2026-08-30 | Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users… |
CVE-2026-82541 | Medium | 6.3 | 2026-08-30 | A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pag… |
CVE-2026-82540 | Medium | 6.3 | 2026-08-30 | A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/cust_searchfrm.php. The manip… |
CVE-2026-82487 | Medium | 6.3 | 2026-08-30 | A vulnerability was determined in Beetel 450TC3 01.00.00_01. This affects an unknown part. Executing a manipulation can lead to weak password recovery. The att… |
CVE-2026-82486 | Medium | 5.0 | 2026-08-30 | A vulnerability was found in SiteServer SSCMS 7.4.0. Affected by this issue is some unknown functionality of the component Agent Installation Workflow. Perform… |
CVE-2026-82485 | Medium | 6.3 | 2026-08-30 | A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/pr… |
CVE-2026-82484 | Medium | 6.3 | 2026-08-30 | A flaw has been found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/emp_searchfrm.php. This manipulation o… |
CVE-2026-81766 | Medium | 6.6 | 2026-08-30 | The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9… |
CVE-2026-19722 | Medium | 6.6 | 2026-08-30 | The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during res… |
CVE-2026-14835 | Medium | 6.8 | 2026-08-30 | The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved fro… |
CVE-2026-82479 | Medium | 6.3 | 2026-08-30 | A vulnerability was identified in NASA cFS up to 7.0.1. Impacted is the function OS_read of the file modules/protocol/tcp/fsw/src/sbn_tcp_if.c of the component… |
CVE-2026-82417 | Medium | 5.3 | 2026-08-30 | ### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member… |
CVE-2026-82424 | Medium | 6.3 | 2026-08-29 | A weakness has been identified in PHPGurukul Student Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /student_ed… |
CVE-2026-82423 | Medium | 5.4 | 2026-08-29 | A vulnerability has been found in macrozheng mall up to 1.0.3. The affected element is an unknown function of the file /order/paySuccess of the component Payme… |
CVE-2026-82422 | Medium | 6.3 | 2026-08-29 | A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/emp_del.php. The manipul… |
CVE-2026-82421 | Medium | 6.3 | 2026-08-29 | A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This issue affects some unknown processing of the file /pages/emp_edit.php. The… |
CVE-2026-82476 | Medium | 5.3 | 2026-08-29 | Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in its link-metadata fetcher, allowing unauthenticated attack… |
CVE-2026-82470 | Medium | 5.4 | 2026-08-29 | Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Atta… |
CVE-2026-82469 | Medium | 5.4 | 2026-08-29 | Rodauth before 2.47.0 contains an authentication bypass vulnerability in the jwt_refresh route that issues new JWT access tokens without requiring a refresh to… |
CVE-2026-82468 | Medium | 4.7 | 2026-08-29 | Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cr… |
CVE-2026-82467 | Medium | 4.7 | 2026-08-29 | Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirm_password, login_return_to_requested_location, and two_factor_auth_return_t… |
CVE-2026-82465 | Medium | 5.3 | 2026-08-29 | pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest(). When an IdP sends… |
CVE-2026-82464 | Medium | 6.1 | 2026-08-29 | pac4j-core before 6.5.6 contains an open redirect vulnerability in DefaultLogoutLogic.perform() that accepts backslash-prefixed logout redirect targets matchin… |
CVE-2026-82462 | Medium | 6.5 | 2026-08-29 | pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. Attackers can substitute access… |
CVE-2026-82477 | Medium | 5.8 | 2026-08-29 | In MITRE SAF Heimdall 2.11.6 through 2.13.x before 2.14.0, an SSRF issue allows remote attackers to access internal network resources via the Tenable proxy end… |
CVE-2026-82451 | Medium | 6.1 | 2026-08-29 | Formwork before 2.3.11 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped. Unauthenticated a… |
CVE-2026-82449 | Medium | 5.3 | 2026-08-29 | Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attack… |
CVE-2026-82364 | Medium | 4.2 | 2026-08-29 | A security vulnerability has been detected in macrozheng mall up to 1.0.3. This impacts an unknown function of the file /order/submit of the component Order Su… |
CVE-2026-81346 | Medium | 4.3 | 2026-08-29 | The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX actions, allowing any authenticated use… |
CVE-2026-81342 | Medium | 4.7 | 2026-08-29 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it… |
CVE-2026-81026 | Medium | 4.8 | 2026-08-29 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before… |
CVE-2026-80488 | Medium | 4.1 | 2026-08-29 | The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, whi… |
CVE-2026-80311 | Medium | 4.3 | 2026-08-29 | The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to the customer bound to the requesting cust… |
CVE-2026-77786 | Medium | 4.9 | 2026-08-29 | The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires… |
CVE-2026-77010 | Medium | 6.5 | 2026-08-29 | The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation checks on its REST API routes and does not… |
CVE-2026-77008 | Medium | 6.5 | 2026-08-29 | The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have any authorisation or authentication check when saving its s… |
CVE-2026-76547 | Medium | 6.6 | 2026-08-29 | The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing hig… |
CVE-2026-76546 | Medium | 6.8 | 2026-08-29 | The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as cont… |
CVE-2026-19430 | Medium | 5.3 | 2026-08-29 | The Catfolders Document Gallery Pro WordPress plugin before 2.0.7 does not authorise some of its REST API routes, and the token identifying the requested conte… |
CVE-2026-18234 | Medium | 6.5 | 2026-08-29 | The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not de… |
CVE-2026-18233 | Medium | 6.5 | 2026-08-29 | The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any… |
CVE-2026-17522 | Medium | 5.4 | 2026-08-29 | The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted… |
CVE-2026-17520 | Medium | 4.8 | 2026-08-29 | The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source, deriving it from a publicly known value, allowin… |
CVE-2026-55860 | Medium | 5.9 | 2026-08-28 | MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb does not gate clear-text pass… |
CVE-2026-55859 | Medium | 5.9 | 2026-08-28 | MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb encodes and decodes all chara… |
CVE-2026-55858 | Medium | 5.9 | 2026-08-28 | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, the connector e… |
CVE-2026-55857 | Medium | 5.9 | 2026-08-28 | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog auth… |
CVE-2026-55856 | Medium | 5.9 | 2026-08-28 | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, when a Java app… |
CVE-2026-55855 | Medium | 6.5 | 2026-08-28 | MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB… |
CVE-2026-55854 | Medium | 5.9 | 2026-08-28 | MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB… |
CVE-2026-55779 | Medium | 5.4 | 2026-08-28 | Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage() in src/RestoreAction.php builds ArchiveA… |
CVE-2026-82018 | Medium | 6.1 | 2026-08-28 | IGEL OS 12 before 12.9.0, 12.8.3 LTS and IGEL OS 11 before 11.11.150 contain a secure boot bypass vulnerability in the GRUB boot stage that allows physically p… |
CVE-2026-55696 | Medium | 4.3 | 2026-08-28 | PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/privatebin.js uses ge… |
CVE-2026-51665 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getTracerouteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain traceroute diagnostic… |
CVE-2026-51664 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getTelnetCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Telnet service enablement… |
CVE-2026-3686 | Medium | 6.2 | 2026-08-28 | IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 is vulnerable to a denial of service due to improper limitation of resources. |
CVE-2026-19294 | Medium | 6.4 | 2026-08-28 | IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute and read any user's private flow due to improper authorization. |
CVE-2026-18545 | Medium | 4.3 | 2026-08-28 | IBM Langflow OSS 1.0.0 through 1.11.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized reques… |
CVE-2026-13734 | Medium | 6.5 | 2026-08-28 | Zephyr's WireGuard VPN data-plane receive handler wg_process_data_message() in subsys/net/lib/wireguard/wg_crypto.c validated the anti-replay counter too late… |
CVE-2025-64649 | Medium | 5.9 | 2026-08-28 | IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions using man in the middle techniques due to improper certificate va… |
CVE-2025-36290 | Medium | 5.9 | 2026-08-28 | IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to… |
CVE-2025-36271 | Medium | 5.9 | 2026-08-28 | IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sens… |
CVE-2026-82343 | Medium | 6.1 | 2026-08-28 | A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count pa… |
CVE-2026-82306 | Medium | 6.5 | 2026-08-28 | StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail endpoint that returns unfiltered query history for all users. Aut… |
CVE-2026-82290 | Medium | 5.3 | 2026-08-28 | Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users'… |
CVE-2026-82276 | Medium | 5.3 | 2026-08-28 | StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute() directly instead of implementing… |
CVE-2026-82274 | Medium | 4.7 | 2026-08-28 | Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query para… |
CVE-2026-82273 | Medium | 6.5 | 2026-08-28 | Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitte… |
CVE-2026-82272 | Medium | 6.5 | 2026-08-28 | Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain access… |
CVE-2026-82271 | Medium | 6.5 | 2026-08-28 | R2R through 3.6.5 fails to properly validate user ownership in conversation update and message handlers, allowing authenticated users to modify other users' co… |
CVE-2026-82267 | Medium | 5.4 | 2026-08-28 | Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/{variant… |
CVE-2026-82265 | Medium | 6.5 | 2026-08-28 | Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API port without authentication, allowing unauthenticated attackers to access sensit… |
CVE-2026-82264 | Medium | 6.8 | 2026-08-28 | Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. At… |
CVE-2026-82263 | Medium | 6.8 | 2026-08-28 | Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint that fails to validate the issuer URL par… |
CVE-2026-82262 | Medium | 6.8 | 2026-08-28 | Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host val… |
CVE-2026-82020 | Medium | 6.8 | 2026-08-28 | Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability that allows attackers who can influence ingested message content to ove… |
CVE-2026-77939 | Medium | 6.5 | 2026-08-28 | Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbi… |
CVE-2026-77218 | Medium | 4.9 | 2026-08-28 | PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The web_login_fir… |
CVE-2026-77217 | Medium | 4.9 | 2026-08-28 | PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains authenticated stack buffer overflow and null pointer dereference vulnerabilities in /cgi-bin/disp… |
CVE-2026-77184 | Medium | 5.2 | 2026-08-28 | In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL returned by SHOW CRE… |
CVE-2026-76798 | Medium | 6.3 | 2026-08-28 | The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them f… |
CVE-2026-76797 | Medium | 6.3 | 2026-08-28 | The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreads… |
CVE-2026-76794 | Medium | 4.6 | 2026-08-28 | MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can i… |
CVE-2026-75126 | Medium | 4.9 | 2026-08-28 | PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains multiple authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The foll… |
CVE-2026-75125 | Medium | 4.9 | 2026-08-28 | PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated null pointer dereference vulnerability in /cgi-bin/dispatcher.cgi. The web_poe_a… |
CVE-2026-70331 | Medium | 5.4 | 2026-08-28 | Improper neutralization of input used for llm prompting in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-70309 | Medium | 5.4 | 2026-08-28 | Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-66798 | Medium | 4.3 | 2026-08-28 | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-66324 | Medium | 6.5 | 2026-08-28 | External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-66323 | Medium | 5.4 | 2026-08-28 | Improper neutralization of parameter/argument delimiters in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-62904 | Medium | 5.4 | 2026-08-28 | Incorrect authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. |
CVE-2026-58616 | Medium | 4.4 | 2026-08-28 | Concurrent execution using shared resource with improper synchronization ('race condition') in Copilot Chat (Microsoft Edge) allows an authorized attacker to d… |