Medium-severity CVEs (page 52)
Page 52 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-55834 | Medium | 4.3 | 2026-08-28 | Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.6.0 until 2.9.0, frontend/src/routes/authorize/+page.ts… |
CVE-2026-55569 | Medium | 6.6 | 2026-08-28 | aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink… |
CVE-2026-55566 | Medium | 4.3 | 2026-08-28 | Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp… |
CVE-2026-55549 | Medium | 6.5 | 2026-08-28 | Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirect_uri parameter from GET /auth/authorize into yamcs-core/src… |
CVE-2026-55547 | Medium | 4.3 | 2026-08-28 | Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and I… |
CVE-2026-55545 | Medium | 6.5 | 2026-08-28 | Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce the privileges required by equivalent R… |
CVE-2026-55425 | Medium | 5.0 | 2026-08-28 | Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/… |
CVE-2026-55067 | Medium | 5.0 | 2026-08-28 | Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket} allows the reques… |
CVE-2026-55064 | Medium | 4.3 | 2026-08-28 | Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project ca… |
CVE-2026-54746 | Medium | 6.4 | 2026-08-28 | Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. From 0.40.0 until 0.91.1, the Dispatcher gRPC service does… |
CVE-2026-51656 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getVpnPassCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain VPN pass-through and WAN… |
CVE-2026-51655 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain MAC filter rules via… |
CVE-2026-51654 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain schedule or scheduled-r… |
CVE-2026-51653 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getStorageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain storage feature state in… |
CVE-2026-51652 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getUPnPCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain UPnP enablement and parsed… |
CVE-2026-51651 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getSmartQosCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Smart QoS configuration… |
CVE-2026-51640 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getMeshNeighborTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mesh neighbor inf… |
CVE-2026-51639 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getApWiFiSchCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain AP-specific Wi-Fi sche… |
CVE-2026-51638 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain guest Wi-Fi configurat… |
CVE-2026-51637 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getMeshPortalTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mesh portal table i… |
CVE-2026-51635 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Wi-Fi scheduling ru… |
CVE-2026-51634 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain core wireless settings… |
CVE-2026-51633 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getWiFiEasyGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain simplified guest W… |
CVE-2026-51632 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain advanced wireless s… |
CVE-2026-51631 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WPS runtime status… |
CVE-2026-51630 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getDdnsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain DDNS configuration, includi… |
CVE-2026-51629 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain static DHCP reserva… |
CVE-2026-51614 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain access-device polic… |
CVE-2026-51613 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getDeviceInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain device identification de… |
CVE-2026-51610 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the RebootSystem function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to arbitrarily force an immediate r… |
CVE-2026-51376 | Medium | 6.5 | 2026-08-28 | An issue in BitChat for iOS v1.15.0 allows a remote attacker to cause a denial of service via an unauthenticated MESSAGE packet into the mesh gossip cache |
CVE-2026-50980 | Medium | 6.1 | 2026-08-28 | Cross-Site Scripting (XSS) vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote attackers to execute arbitrary JavaScri… |
CVE-2026-39071 | Medium | 5.4 | 2026-08-28 | WordPress plugin (Spiffy Plugin) before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field. An authenticated attacker with the lowest privil… |
CVE-2026-39070 | Medium | 4.8 | 2026-08-28 | WordPress plugin (Bit Assist) before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An authenticated attacker with the privileged… |
CVE-2026-82330 | Medium | 6.1 | 2026-08-28 | A flaw was found in the file-pvr plugin in GIMP. When processing a specially crafted PVR image file, the VQ (compressed) decoder does not properly perform memo… |
CVE-2026-82328 | Medium | 6.1 | 2026-08-28 | A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the plugin does not properly validate the used_clrs (palet… |
CVE-2026-82327 | Medium | 5.5 | 2026-08-28 | A flaw was found in libsolv, a dependency-resolution library used by RPM-based package managers such as dnf and zypper to work with .solv repository cache file… |
CVE-2026-82324 | Medium | 6.1 | 2026-08-28 | A flaw was found in the file-iff (IFF/ILBM) plugin in GIMP. When processing a specially crafted IFF/ILBM image file, the plugin does not properly validate the… |
CVE-2026-82220 | Medium | 5.3 | 2026-08-28 | Unauthenticated Other Vulnerability Type in Forminator <= 1.57.1 versions. |
CVE-2026-82181 | Medium | 5.5 | 2026-08-28 | Medical Practice Management System developed by Le-yan has a Sensitive Data in URL vulnerability. Unauthenticated remote attackers can obtain sensitive informa… |
CVE-2026-81761 | Medium | 4.3 | 2026-08-28 | Subscriber Broken Access Control in WpEvently <= 5.5.0 versions. |
CVE-2026-81759 | Medium | 5.4 | 2026-08-28 | Contributor Broken Access Control in WpEvently <= 5.5.0 versions. |
CVE-2026-81341 | Medium | 6.5 | 2026-08-28 | wolfEngine before 1.4.1 sources the explicit AES-CCM nonce for TLS 1.2 and DTLS 1.2 records from the record input buffer instead of the TLS sequence number car… |
CVE-2026-81299 | Medium | 4.3 | 2026-08-28 | Subscriber Insecure Direct Object References (IDOR) in WP Job Portal <= 2.5.9 versions. |
CVE-2026-81284 | Medium | 4.3 | 2026-08-28 | Contributor Broken Access Control in ACF Extended <= 0.9.2.6 versions. |
CVE-2026-5953 | Medium | 6.1 | 2026-08-28 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ceviz Informatics Inc. Web Design allows Reflected XSS. … |
CVE-2026-5800 | Medium | 6.1 | 2026-08-28 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Dayneks Software Industry and Trade Inc. E-Commerce Platf… |
CVE-2026-5096 | Medium | 5.3 | 2026-08-28 | The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the `load_previ… |
CVE-2026-4378 | Medium | 5.4 | 2026-08-28 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Akilli Ticaret Software Technologies Ltd. E-Commerce Pack… |
CVE-2026-3423 | Medium | 6.4 | 2026-08-28 | The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to, a… |
CVE-2026-38725 | Medium | 5.4 | 2026-08-28 | xipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject arbitrary JavaScript via the name and content parameters in a… |
CVE-2026-37710 | Medium | 6.1 | 2026-08-28 | Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site navigation custom URL function |
CVE-2026-15603 | Medium | 5.3 | 2026-08-28 | morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the… |
CVE-2026-82258 | Medium | 4.8 | 2026-08-28 | SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a sing… |
CVE-2026-82257 | Medium | 4.3 | 2026-08-28 | SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-control… |
CVE-2026-82256 | Medium | 5.3 | 2026-08-28 | SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads… |
CVE-2026-82255 | Medium | 6.8 | 2026-08-28 | gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controll… |
CVE-2026-82250 | Medium | 6.5 | 2026-08-28 | gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines w… |
CVE-2026-82248 | Medium | 5.3 | 2026-08-28 | gix-worktree-state before 0.33.0 (part of gitoxide) allows writing files outside the worktree on Windows. gix_worktree_state::checkout() follows an existing te… |
CVE-2026-82235 | Medium | 5.9 | 2026-08-28 | filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, allowing attackers to trigger blocking open syscal… |
CVE-2026-82233 | Medium | 5.7 | 2026-08-28 | SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that accepts arbitrary absolute file paths without workspace boundary… |
CVE-2026-82111 | Medium | 4.3 | 2026-08-28 | A vulnerability was detected in iswalle getnote-mcp up to 1.5.0. The affected element is the function fs.readFileSync of the file src/index.ts of the component… |
CVE-2026-81777 | Medium | 5.3 | 2026-08-28 | Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing. This issue affects Essential Addons fo… |
CVE-2026-73209 | Medium | 6.5 | 2026-08-28 | An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process i… |
CVE-2026-6128 | Medium | 6.4 | 2026-08-28 | The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wm_backups_path' parameter in all… |
CVE-2026-5510 | Medium | 6.4 | 2026-08-28 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'give_form' shortcode in all ve… |
CVE-2026-52687 | Medium | 6.5 | 2026-08-28 | An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory… |
CVE-2026-42395 | Medium | 4.3 | 2026-08-28 | A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The log… |
CVE-2026-42392 | Medium | 4.3 | 2026-08-28 | An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response return… |
CVE-2026-42008 | Medium | 4.3 | 2026-08-28 | Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that ho… |
CVE-2026-40205 | Medium | 5.9 | 2026-08-28 | An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the configur… |
CVE-2026-40019 | Medium | 5.9 | 2026-08-28 | An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This… |
CVE-2026-40017 | Medium | 6.5 | 2026-08-28 | An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD c… |
CVE-2026-40015 | Medium | 4.3 | 2026-08-28 | An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid commands, which can intermittently cause an out… |
CVE-2026-40014 | Medium | 6.5 | 2026-08-28 | An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message… |
CVE-2026-40013 | Medium | 4.3 | 2026-08-28 | An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write when the ManageSiev… |
CVE-2026-33607 | Medium | 4.3 | 2026-08-28 | An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial of service for IMAP. Monitor system for a… |
CVE-2026-33606 | Medium | 4.8 | 2026-08-28 | Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protoc… |
CVE-2026-33604 | Medium | 5.9 | 2026-08-28 | An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body… |
CVE-2026-33263 | Medium | 4.3 | 2026-08-28 | When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues. If r… |
CVE-2026-18393 | Medium | 5.4 | 2026-08-28 | A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond the bounds of a heap-allocated buffer when processing crafted TDSC cursor data. A rem… |
CVE-2026-9548 | Medium | 6.5 | 2026-08-28 | An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22… |
CVE-2026-9491 | Medium | 4.3 | 2026-08-28 | A server-ide request forgery (SSRF) vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users to obtain non-sensiti… |
CVE-2026-82123 | Medium | 6.5 | 2026-08-28 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Tangible Loops & Logic. |
CVE-2026-79995 | Medium | 4.3 | 2026-08-28 | The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email change is being cancelled belongs to the… |
CVE-2026-79706 | Medium | 5.3 | 2026-08-28 | The Breeze Cache WordPress plugin before 2.5.13 does not sanitise a value taken from the request before using it to build the paths of the files it caches, all… |
CVE-2026-78238 | Medium | 5.4 | 2026-08-28 | SOY Gallery contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product. |
CVE-2026-77838 | Medium | 5.4 | 2026-08-28 | SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product. |
CVE-2026-77701 | Medium | 5.3 | 2026-08-28 | The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated user… |
CVE-2026-73827 | Medium | 5.4 | 2026-08-28 | SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product. |
CVE-2026-4246 | Medium | 6.1 | 2026-08-28 | The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's' parameter of the Advanced Search REST endpoint in all version… |
CVE-2026-14567 | Medium | 5.3 | 2026-08-28 | The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retriev… |
CVE-2026-12514 | Medium | 5.3 | 2026-08-28 | The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handle… |
CVE-2026-12513 | Medium | 6.8 | 2026-08-28 | The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend fi… |
CVE-2026-82081 | Medium | 6.4 | 2026-08-28 | wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export. |
CVE-2026-3129 | Medium | 6.4 | 2026-08-28 | The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted `<img>` tag attributes in all versions up to, and including… |
CVE-2026-16759 | Medium | 6.5 | 2026-08-28 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation i… |
CVE-2026-16654 | Medium | 6.4 | 2026-08-28 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'size' Shortcode Attribute in all versions up to, and includin… |
CVE-2026-15798 | Medium | 6.4 | 2026-08-28 | The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slider' Block Attribute in all versions up to, and including, 3.5.1.3… |
CVE-2026-61802 | Medium | 6.5 | 2026-08-28 | Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, a low… |