Medium-severity CVEs (page 53)

Page 53 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.

All medium-severity CVEs — newest first (page 53 of 100)
CVESeverityScorePublishedSummary
CVE-2026-54084Medium5.32026-08-28Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.0.0 through 4.14.6, a mali…
CVE-2026-38345Medium6.52026-08-28A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a De…
CVE-2026-38343Medium6.52026-08-28An integer overflow in the libavfilter/vf_scale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a…
CVE-2026-81893Medium4.72026-08-27A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can lea…
CVE-2026-81834Medium6.32026-08-27A weakness has been identified in RooCodeInc Roo-Code up to 3.51.1. Affected by this issue is the function ExecaTerminalProcess of the component README File Ha…
CVE-2026-81833Medium5.52026-08-27A security flaw has been discovered in RooCodeInc Roo-Code up to 3.51.1. Affected by this vulnerability is the function optimizeQuery of the file src/utils/hel…
CVE-2026-81731Medium5.42026-08-27Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspace Link doctype is…
CVE-2026-81729Medium6.52026-08-27Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete() in htdocs/api/class/api_documents.class.php call…
CVE-2026-81530Medium5.62026-08-27A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management credential material supplied by the app…
CVE-2026-81528Medium5.42026-08-27A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a repl…
CVE-2026-81527Medium6.52026-08-27A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregation expression and qu…
CVE-2026-81526Medium6.52026-08-27The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server…
CVE-2026-81524Medium5.42026-08-27A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the dri…
CVE-2026-81523Medium4.42026-08-27A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted with…
CVE-2026-81521Medium6.52026-08-27The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping…
CVE-2026-59322Medium6.32026-08-27The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte pay…
CVE-2026-59321Medium4.22026-08-27A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null (not thread-safe, e.g. th…
CVE-2026-59320Medium6.52026-08-27When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one lin…
CVE-2026-59319Medium4.32026-08-27RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape()…
CVE-2026-59317Medium6.52026-08-27DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new Bi…
CVE-2026-59315Medium5.32026-08-27The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0…
CVE-2026-59311Medium6.82026-08-27A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer…
CVE-2026-59294Medium5.92026-08-27ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and…
CVE-2026-59293Medium6.62026-08-27Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate down to SMB1/CIFS, which lacks mandatory signing/encryption and is vuln…
CVE-2026-59287Medium5.92026-08-27Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. Spring for GraphQL 2.0.0 - 2.0.4 Spring f…
CVE-2026-59281Medium6.12026-08-27Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Er…
CVE-2026-59276Medium5.92026-08-27Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison…
CVE-2026-54732Medium6.52026-08-27libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileN…
CVE-2026-37073Medium5.32026-08-27Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emails from the configu…
CVE-2026-37070Medium6.52026-08-27Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by…
CVE-2026-37069Medium5.32026-08-27Absolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Manager Project 4.4.9 allows an unauthentica…
CVE-2026-37067Medium5.32026-08-27Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all appli…
CVE-2026-37066Medium6.52026-08-27Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows and authentic…
CVE-2026-37064Medium5.32026-08-27User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via…
CVE-2026-37009Medium6.52026-08-27A SQL injection vulnerability in NL2SQLTool in crewai-tools v1.10.2rc1 allows a remote attacker to execute arbitrary SQL commands via an unsanitized sql_query…
CVE-2026-34620Medium5.52026-08-27DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds write vulnerability that could lead to application denial-of-service. An attacker coul…
CVE-2026-34616Medium5.52026-08-27DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this…
CVE-2026-25250Medium6.02026-08-27EAZ EazyFix 12.9 allows a Security Feature Bypass related to a "Missing Cryptographic Step" associated with "Secure Boot disable."
CVE-2026-18374Medium4.92026-08-27Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier m…
CVE-2026-81724Medium5.32026-08-27NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial…
CVE-2026-81720Medium6.22026-08-27openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory cond…
CVE-2026-81716Medium5.22026-08-27openssl_encrypt (pip: openssl-encrypt) versions before 1.4.9 contain a path traversal flaw in PluginSandbox._is_safe_path, which authorized file access using a…
CVE-2026-81706Medium6.82026-08-27openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed…
CVE-2026-81703Medium5.52026-08-27openssl_encrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with…
CVE-2026-81697Medium5.52026-08-27openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 contain a CWD-relative configuration file resolution flaw in crypt_settings.py, where CONFIG_FI…
CVE-2026-81687Medium5.52026-08-27openssl_encrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craf…
CVE-2026-81686Medium6.22026-08-27openssl_encrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authori…
CVE-2026-81684Medium6.22026-08-27In openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8, the desktop GUI passes the steganography password to the CLI child process on the command l…
CVE-2026-81682Medium6.22026-08-27openssl_encrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable…
CVE-2026-81681Medium4.62026-08-27openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption…
CVE-2026-81680Medium4.02026-08-27openssl_encrypt versions before 1.4.9 fail to authenticate recovery-slot presence in envelope-format encrypted files, allowing attackers to remove recovery slo…
CVE-2026-81664Medium5.32026-08-27The OpenFaaS gateway registers GET /system/telemetry in gateway/main.go and, when basic_auth is enabled, wraps each administrative /system/* handler in auth.De…
CVE-2026-81334Medium6.12026-08-27darknet subscripts its layer array with an index taken from a configuration file without checking it against the array's length. The array is allocated in src-…
CVE-2026-81101Medium6.52026-08-27The configure command accepted any endpoint URL and stored it beside the user's access token. ConfigureCommand.execute in src/cli.ts persisted the value given…
CVE-2026-81100Medium6.82026-08-27tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpSe…
CVE-2026-81099Medium6.82026-08-27tiger-slack started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. mcp/src/httpServer.ts called the shared httpServer…
CVE-2026-81095Medium6.82026-08-27pg-aiguide started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFacto…
CVE-2026-81092Medium6.82026-08-27mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamable_http.go and SSEServer.Ser…
CVE-2026-80213Medium4.02026-08-27An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS label's length into a single octet without checking it…
CVE-2026-80211Medium5.92026-08-27FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5($_POST['password']) to add_user() and upd…
CVE-2026-80210Medium6.52026-08-27FrontAccounting through 2.4.20 generates a CSRF token in end_form() in includes/ui/ui_controls.inc and embeds it as the _token hidden field in every form it re…
CVE-2026-80209Medium4.32026-08-27The updateWorkspace handler in mods/identity/src/workspaces/createUpdateWorkspace.ts in Fonoster through 0.22.7 invokes the gRPC callback with PERMISSION_DENIE…
CVE-2026-80207Medium5.32026-08-27APITable through 1.13.0-beta.1 annotates the create handler of InternalNotifyController with requiredLogin = false. ResourceInterceptor honours that annotation…
CVE-2026-79720Medium5.02026-08-27Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning…
CVE-2026-79719Medium5.02026-08-27Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning…
CVE-2026-79718Medium5.02026-08-27Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning…
CVE-2026-75573Medium4.42026-08-27In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and…
CVE-2026-75159Medium5.92026-08-27An unauthenticated client that can reach a MongoDB Connector for BI deployment configured with Kerberos authentication may cause mongosqld to terminate when a…
CVE-2026-71402Medium5.42026-08-27An out-of-bounds read was found in the DHCPv4 packet capture code of wicked. ni_capture_inspect_udp_header() in src/capture.c reports the IP total length as th…
CVE-2026-5738Medium6.12026-08-27Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in BilPark Informatics Technologies Industry and Trade Inc…
CVE-2026-59280Medium4.32026-08-27Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from un…
CVE-2026-59272Medium6.82026-08-27Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of…
CVE-2026-40526Medium6.52026-08-27Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute fi…
CVE-2026-19854Medium6.12026-08-27When the ClickHouse plugin uses Native protocol (the default) with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to Cl…
CVE-2026-11754Medium5.32026-08-27Observable discrepancy vulnerability in Seres Software syWEB allows Account Footprinting. This issue affects syWEB: through 27082026. NOTE: The vendor was con…
CVE-2026-11747Medium6.12026-08-27Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Seres Software syWEB allows Reflected XSS. This issue af…
CVE-2025-62342Medium6.42026-08-27HCL IntelliOps Event Management (IEM) is affected by a Session Deletion Vulnerability. It may allow improper handling of user sessions, resulting in sessions n…
CVE-2026-81668Medium5.42026-08-27A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated…
CVE-2026-81658Medium6.52026-08-27A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authen…
CVE-2026-81562Medium5.32026-08-27A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a mani…
CVE-2026-81560Medium5.32026-08-27A vulnerability was identified in blackms aistack up to 1.6.1. Affected by this issue is some unknown functionality of the file src/web/server.ts of the compon…
CVE-2026-5218Medium4.32026-08-27Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Softtr Informatics Technology Trading Limited Company E-Commerce…
CVE-2026-17562Medium6.52026-08-27Authorization bypass through User-Controlled key vulnerability in Summit Security Systems AdisyonPro allows Accessing Functionality Not Properly Constrained by…
CVE-2026-81279Medium5.42026-08-27Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions.
CVE-2026-81276Medium5.32026-08-27Unauthenticated Broken Access Control in Kali Forms <= 2.4.23 versions.
CVE-2026-81274Medium5.32026-08-27Subscriber Broken Access Control in Ditty <= 3.1.67 versions.
CVE-2026-81272Medium4.92026-08-27Editor Broken Access Control in FluentPlayer Pro <= 1.3.2 versions.
CVE-2026-78275Medium6.82026-08-27Editor Arbitrary File Deletion in Fluent Boards Pro <= 2.0.11 versions.
CVE-2026-78273Medium6.52026-08-27Subscriber Cross Site Scripting (XSS) in Fluent Boards Pro <= 2.0.11 versions.
CVE-2026-59355Medium6.12026-08-27In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An at…
CVE-2026-78139Medium4.32026-08-27The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions u…
CVE-2026-78138Medium4.32026-08-27The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbi…
CVE-2026-78125Medium5.32026-08-27The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2…
CVE-2026-76549Medium5.92026-08-27The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could all…
CVE-2026-59278Medium6.52026-08-27JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default…
CVE-2026-59275Medium6.62026-08-27A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload…
CVE-2026-59274Medium6.52026-08-27The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can…
CVE-2026-59271Medium5.32026-08-27When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0 S…
CVE-2026-47894Medium4.92026-08-27Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path. Spring Cloud Config…
CVE-2026-47887Medium6.12026-08-27A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open…