Medium-severity CVEs (page 54)
Page 54 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-16569 | Medium | 4.3 | 2026-08-27 | The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not check the user's capabilities bef… |
CVE-2026-16568 | Medium | 4.3 | 2026-08-27 | The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user o… |
CVE-2026-16567 | Medium | 5.3 | 2026-08-27 | The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauth… |
CVE-2026-13414 | Medium | 4.8 | 2026-08-27 | The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain (an… |
CVE-2026-81486 | Medium | 5.3 | 2026-08-27 | A vulnerability was detected in bsmi021 mcp-file-context-server 1.0.0. Affected by this issue is the function read_context of the file src/index.ts of the comp… |
CVE-2026-81485 | Medium | 5.3 | 2026-08-27 | A security vulnerability has been detected in danielpopamd linkedin-ads-mcp 1.0.0. Affected by this vulnerability is the function fs.readFileSync of the file s… |
CVE-2026-47874 | Medium | 5.3 | 2026-08-27 | The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessiv… |
CVE-2026-47863 | Medium | 5.9 | 2026-08-27 | In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Rea… |
CVE-2026-47862 | Medium | 5.4 | 2026-08-27 | An attacker who can set the file_name header on a message reaching a ZipTransformer with ZipResultType.FILE (the default) can cause the resulting .zip archive… |
CVE-2026-47861 | Medium | 6.3 | 2026-08-27 | An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP da… |
CVE-2026-47860 | Medium | 6.5 | 2026-08-27 | An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message… |
CVE-2026-47859 | Medium | 5.4 | 2026-08-27 | RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet cou… |
CVE-2026-47857 | Medium | 5.9 | 2026-08-27 | In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Rea… |
CVE-2026-47856 | Medium | 6.3 | 2026-08-27 | Spring Integration's JSON to object conversion uses the json__TypeId__ header to choose the deserialization target type, and resolves that header value to a cl… |
CVE-2026-47850 | Medium | 4.3 | 2026-08-27 | Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. S… |
CVE-2026-47845 | Medium | 5.3 | 2026-08-27 | In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen… |
CVE-2026-80158 | Medium | 5.5 | 2026-08-26 | A flaw was found in the ipa_getkeytab module of the community.general Ansible collection. The module's bind_pw parameter, used to supply the LDAP simple-bind p… |
CVE-2026-21808 | Medium | 4.1 | 2026-08-26 | HCL BigFix Quantum Risk Analyzer generates highly detailed logging information by default which increases the risk of sensitive data leakage and can provide an… |
CVE-2026-75331 | Medium | 4.6 | 2026-08-26 | tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditor… |
CVE-2026-45694 | Medium | 5.4 | 2026-08-26 | LibreNMS is a network monitoring system. In versions up to and including 26.4.0, the Proxmox application view is vulnerable to reflected cross-site scripting t… |
CVE-2026-21810 | Medium | 4.4 | 2026-08-26 | HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and a lack of binary integrity which could allow an attacker to obtain… |
CVE-2026-77507 | Medium | 5.3 | 2026-08-26 | Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, Weblate's object-scoped RSS feeds do… |
CVE-2026-75364 | Medium | 6.8 | 2026-08-26 | Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX (2024-01-30 build), the update_interface_png SET handler in /usr/bin/webmgnt fails to sanitize the display_name… |
CVE-2026-75363 | Medium | 6.8 | 2026-08-26 | An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /cgi-bin/mbox-config, and the parameters… |
CVE-2026-62326 | Medium | 6.5 | 2026-08-26 | Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a user with the built-in "Edit sourc… |
CVE-2026-62249 | Medium | 4.3 | 2026-08-26 | Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, an authenticated user with access to… |
CVE-2026-61790 | Medium | 4.4 | 2026-08-26 | Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a team can require its members to co… |
CVE-2026-55227 | Medium | 4.3 | 2026-08-26 | Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting th… |
CVE-2026-52473 | Medium | 4.3 | 2026-08-26 | An issue in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the content parameter is directly concatenated to the ProcessBuilder. |
CVE-2026-39275 | Medium | 6.1 | 2026-08-26 | Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and… |
CVE-2026-79939 | Medium | 5.8 | 2026-08-26 | Dell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link (Symlink) Following vulnerability. A low privileged attacker with local… |
CVE-2026-75601 | Medium | 4.3 | 2026-08-26 | Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics fe… |
CVE-2026-74774 | Medium | 5.9 | 2026-08-26 | Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access co… |
CVE-2026-74771 | Medium | 6.5 | 2026-08-26 | Dell PowerProtect One, versions 20.1.0.0 and below, contain an Authorization Bypass Through User-Controlled Key vulnerability. A low privileged attacker with r… |
CVE-2026-71172 | Medium | 4.3 | 2026-08-26 | Dell Cloud Disaster Recovery, versions 20.2 and prior, contain a Server-Side Request Forgery (SSRF) vulnerability. A low privileged attacker with remote access… |
CVE-2026-71054 | Medium | 6.5 | 2026-08-26 | Vulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u511. Easily exploitable vulnerability allows unaut… |
CVE-2026-67275 | Medium | 5.3 | 2026-08-26 | Dell PowerProtect One, versions 20.1.0.0 and below, contain a Reliance on Insufficiently Trustworthy Component vulnerability. An unauthenticated attacker with… |
CVE-2026-49809 | Medium | 6.5 | 2026-08-26 | Dell PowerProtect Cyber Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vuln… |
CVE-2026-47848 | Medium | 6.1 | 2026-08-26 | In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials. In order for this… |
CVE-2026-47844 | Medium | 5.3 | 2026-08-26 | In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. In order for this to happen, the server must be conf… |
CVE-2026-47842 | Medium | 6.5 | 2026-08-26 | Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES… |
CVE-2026-47834 | Medium | 4.8 | 2026-08-26 | Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring… |
CVE-2026-46371 | Medium | 6.5 | 2026-08-26 | Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the Apple MDM commands listing endpoint (GET /api/… |
CVE-2026-46370 | Medium | 6.5 | 2026-08-26 | Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the labels host-listing endpoint (GET /api/v1/flee… |
CVE-2025-70340 | Medium | 6.5 | 2026-08-26 | A Broken Access Control vulnerability exists in ThingsBoard Professional Edition (PE) 4.21 and below, within the Alarms comments functionality. An authenticate… |
CVE-2026-79940 | Medium | 5.9 | 2026-08-26 | Dell iDRAC9, 14G versions prior to 7.00.00.182 and 15G/16G versions prior to 7.20.30.50, contains an Improper Access Control vulnerability. An unauthenticated… |
CVE-2026-75466 | Medium | 6.5 | 2026-08-26 | libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When processing a valid indexed-color PNG image with a non-gray palet… |
CVE-2026-63179 | Medium | 4.9 | 2026-08-26 | Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, authenticated backend users can disclose… |
CVE-2026-48786 | Medium | 6.5 | 2026-08-26 | Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint (POST /api/latest/fleet/targets) r… |
CVE-2026-41262 | Medium | 4.3 | 2026-08-26 | Fleet is an open-source device management platform built on osquery. In versions prior to 4.85.0, the global policy read endpoint (GET /api/latest/fleet/polici… |
CVE-2026-54256 | Medium | 5.4 | 2026-08-26 | Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend FileUpload form widget truste… |
CVE-2026-47837 | Medium | 6.8 | 2026-08-26 | Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpo… |
CVE-2026-32639 | Medium | 6.8 | 2026-08-26 | Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the CMS section's Theme Editor AJAX handl… |
CVE-2026-32593 | Medium | 5.9 | 2026-08-26 | Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend Filter widget is vulnerable t… |
CVE-2026-81034 | Medium | 6.5 | 2026-08-26 | Netmaker disables certificate verification on the connection to the configured mail server. The sender in pro/email/smtp.go assigns a TLS configuration whose s… |
CVE-2026-81033 | Medium | 5.3 | 2026-08-26 | Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/in… |
CVE-2026-81030 | Medium | 6.5 | 2026-08-26 | Mage AI does not confine the paths accepted by its browser-items API to the project directory. BrowserItemResource in mage_ai/api/resources/BrowserItemResource… |
CVE-2026-81028 | Medium | 4.9 | 2026-08-26 | ZLMediaKit confines the downloadFile API to a configured set of root directories with a prefix comparison that does not account for directory boundaries. The c… |
CVE-2026-54614 | Medium | 4.3 | 2026-08-26 | DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in src/Controller/MailPreviewContro… |
CVE-2026-48549 | Medium | 6.5 | 2026-08-26 | Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi. When no Cookie header is present, the double-submit cookie pr… |
CVE-2026-48548 | Medium | 6.5 | 2026-08-26 | Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when the NagForm… |
CVE-2026-54553 | Medium | 5.4 | 2026-08-26 | Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API do… |
CVE-2026-13481 | Medium | 5.4 | 2026-08-26 | The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTP_MGMT_TIME management id. In tlv_mgmt_post_recv(), the PTP_MGMT_TIME… |
CVE-2026-79902 | Medium | 5.5 | 2026-08-26 | A flaw was found in the Seattle FilmWorks plugin in GIMP. When processing a specially crafted SFW image file, the plugin allocates a Variable-Length Array (VLA… |
CVE-2026-77801 | Medium | 6.5 | 2026-08-26 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain c… |
CVE-2026-73102 | Medium | 5.7 | 2026-08-26 | RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard file-paste code path. The application accepts peer-supplied… |
CVE-2026-3035 | Medium | 5.5 | 2026-08-26 | GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain cond… |
CVE-2026-15387 | Medium | 4.3 | 2026-08-26 | GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain cond… |
CVE-2025-10903 | Medium | 6.5 | 2026-08-26 | GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain con… |
CVE-2026-80206 | Medium | 5.9 | 2026-08-26 | NLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the tgrep module. The _tgrep_node_action function compiles user-sup… |
CVE-2026-80204 | Medium | 5.4 | 2026-08-26 | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab() function of BlueprintController whe… |
CVE-2026-5092 | Medium | 6.4 | 2026-08-26 | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customapi action handler in versio… |
CVE-2026-3235 | Medium | 5.3 | 2026-08-26 | The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'check_app_acces… |
CVE-2026-2388 | Medium | 6.4 | 2026-08-26 | The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.10. This is d… |
CVE-2026-80234 | Medium | 5.3 | 2026-08-26 | CAYIN CMS-WS and CMS-SE developed by CAYIN Technology have a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain media file lists… |
CVE-2026-19197 | Medium | 6.3 | 2026-08-26 | A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recove… |
CVE-2026-9668 | Medium | 6.3 | 2026-08-26 | With legitimate user credentials in hand, attackers can construct malicious SQL statements to bypass authentication logic and execute arbitrary database querie… |
CVE-2026-6178 | Medium | 6.4 | 2026-08-26 | The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's 'icon_box_2' shortcode in all versions up to, and including, 28.4… |
CVE-2026-3002 | Medium | 6.4 | 2026-08-26 | The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the multiple blocks in… |
CVE-2026-79654 | Medium | 4.3 | 2026-08-26 | A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An… |
CVE-2026-78146 | Medium | 6.5 | 2026-08-26 | The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is the subscriber named in a public request before rendering tha… |
CVE-2026-77790 | Medium | 5.5 | 2026-08-26 | The RegistrationMagic WordPress plugin before 6.0.9.4 does not sanitise and escape a parameter before using it in a SQL statement, which could allow high priv… |
CVE-2026-77789 | Medium | 4.3 | 2026-08-26 | The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a subscription belongs to the customer bound to the requesting cust… |
CVE-2026-77758 | Medium | 5.3 | 2026-08-26 | The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation s… |
CVE-2026-77757 | Medium | 5.4 | 2026-08-26 | The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference befor… |
CVE-2026-77754 | Medium | 5.3 | 2026-08-26 | The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated use… |
CVE-2026-77695 | Medium | 6.5 | 2026-08-26 | The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX action… |
CVE-2026-77694 | Medium | 5.3 | 2026-08-26 | The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unaut… |
CVE-2026-75798 | Medium | 5.3 | 2026-08-26 | The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it… |
CVE-2026-74930 | Medium | 4.3 | 2026-08-26 | The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the one making the request in one of its R… |
CVE-2026-74929 | Medium | 5.4 | 2026-08-26 | The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticat… |
CVE-2026-19226 | Medium | 6.8 | 2026-08-26 | The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which… |
CVE-2026-19094 | Medium | 5.3 | 2026-08-26 | The Tutor LMS WordPress plugin before 4.0.6 does not validate values used to build a database query, and does not restrict which template file a request may l… |
CVE-2026-16986 | Medium | 5.3 | 2026-08-26 | The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected cha… |
CVE-2026-16984 | Medium | 6.5 | 2026-08-26 | The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authoriza… |
CVE-2026-14550 | Medium | 5.3 | 2026-08-26 | The WPCafe WordPress plugin before 3.0.18 does not perform an authorization check when creating a reservation through its REST API, verifying only a publicly… |
CVE-2026-14216 | Medium | 6.5 | 2026-08-26 | The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queu… |
CVE-2026-14212 | Medium | 4.7 | 2026-08-26 | The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee (provider) owns the provider accou… |
CVE-2026-13406 | Medium | 5.3 | 2026-08-26 | The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or nonce check before returning taxonomy term data for an arbi… |
CVE-2026-13404 | Medium | 5.3 | 2026-08-26 | The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check (relying only on a publicly-scrapeable nonc… |