Medium-severity CVEs (page 55)
Page 55 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-13484 | Medium | 5.0 | 2026-06-28 | A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. The impacted element is an unknown function of the component Experimen… |
CVE-2026-10644 | Medium | 4.2 | 2026-06-28 | The Microchip SERCOM-G1 UART driver (drivers/serial/uart_mchp_sercom_g1.c), used by the PIC32CM-JH SoC family, contains an out-of-bounds write in its asynchron… |
CVE-2026-10593 | Medium | 6.5 | 2026-06-28 | The Zephyr Bluetooth LE Audio Basic Audio Profile (BAP) unicast client mishandles peer-supplied ASE state notifications. In unicast_client_ep_qos_state() (subs… |
CVE-2026-58058 | Medium | 6.5 | 2026-06-28 | Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer ad… |
CVE-2026-58057 | Medium | 5.0 | 2026-06-28 | Flowise before 3.1.3 validates Custom MCP stdio environment variables against a denylist using a case-sensitive comparison, so on Windows, where environment na… |
CVE-2026-58055 | Medium | 5.4 | 2026-06-28 | nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend… |
CVE-2026-58051 | Medium | 6.5 | 2026-06-28 | libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure re… |
CVE-2026-45259 | Medium | 6.5 | 2026-06-27 | sigqueue(2) was marked as permitted in capability mode with the introduction of Capsicum in 2011, but the implementation of kern_sigqueue did not include a cap… |
CVE-2026-9242 | Medium | 5.3 | 2026-06-27 | The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Authentication Bypass via I… |
CVE-2026-9233 | Medium | 4.3 | 2026-06-27 | The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including… |
CVE-2026-3462 | Medium | 6.5 | 2026-06-27 | The Frisbii Pay plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'upload_csv' and 'process_batch… |
CVE-2026-13295 | Medium | 6.4 | 2026-06-27 | The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via panels_data Parameter in all versions up to, and including… |
CVE-2026-12471 | Medium | 4.3 | 2026-06-27 | The Spexo theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the activate_plugin function in all versions up to, and… |
CVE-2026-12432 | Medium | 5.3 | 2026-06-27 | The WP Full Stripe Free plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.4.3 via the wpfs_update_failed_payment_… |
CVE-2026-12399 | Medium | 4.4 | 2026-06-27 | The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versi… |
CVE-2026-11987 | Medium | 4.3 | 2026-06-27 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Ob… |
CVE-2026-11783 | Medium | 6.4 | 2026-06-27 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Stored Cross-Site… |
CVE-2026-11773 | Medium | 4.3 | 2026-06-27 | The Masteriyo LMS – LMS Course Builder, Quizzes & Certificates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including… |
CVE-2026-11597 | Medium | 6.4 | 2026-06-27 | The Surbma | Infusionsoft Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'infusionsoft-form' shortcode in versions up to… |
CVE-2026-11364 | Medium | 4.3 | 2026-06-27 | The Product Specifications for WooCommerce plugin for WordPress is vulnerable to unauthorized modification, creation, and deletion of data in versions up to an… |
CVE-2026-9677 | Medium | 4.8 | 2026-06-27 | The Shariff for WordPress Shariff for WordPress plugin through 1.0.11 does not sanitize or escape the shariff_infourl setting before outputting it in the front… |
CVE-2026-13245 | Medium | 6.1 | 2026-06-27 | The MaxButtons – Create buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'view' parameter in all versions up to, and includ… |
CVE-2026-12404 | Medium | 5.3 | 2026-06-27 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.2.2. Thi… |
CVE-2026-13422 | Medium | 4.3 | 2026-06-27 | The HD Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 2.2.0 to 2.2.1. This is due to missing or incorrect nonce validation o… |
CVE-2026-13335 | Medium | 6.4 | 2026-06-27 | The CodePeople Post Map for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cpm_point' Post Meta in all versions up to, and… |
CVE-2026-13333 | Medium | 6.5 | 2026-06-27 | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via 'query[select]' Parameter in all ve… |
CVE-2026-13331 | Medium | 6.5 | 2026-06-27 | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'search' parameter in all versi… |
CVE-2026-11356 | Medium | 4.4 | 2026-06-27 | The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'menu_title' and 'menu_magnifier_color' Settin… |
CVE-2025-59868 | Medium | 5.5 | 2026-06-27 | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a sensitive data exposure vulnerability which could allow an attacker to exploit application inform… |
CVE-2026-53577 | Medium | 6.5 | 2026-06-26 | Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the previewFileFromExecution endpoint (GET /api/v1/{tenant}/executio… |
CVE-2026-50767 | Medium | 5.4 | 2026-06-26 | A stored cross-site scripting (XSS) vulnerability in the item type administration page of Koha Library Management System 0 through 25.11 versions allow an auth… |
CVE-2026-50766 | Medium | 5.4 | 2026-06-26 | A stored cross-site scripting (XSS) vulnerability in the OPAC item detail page of Koha Library Management System 0 through 25.11 versions allow an authenticate… |
CVE-2026-50765 | Medium | 6.1 | 2026-06-26 | A stored cross-site scripting (XSS) vulnerability in the patron restriction type administration page of Koha Library Management System 0 through 25.11 versions… |
CVE-2026-38571 | Medium | 4.6 | 2026-06-26 | Cleartext storage and exposure of WPA2 credentials, and missing authentication on the rr/wr memory read/write commands, in the unauthenticated UART debug conso… |
CVE-2026-36908 | Medium | 5.5 | 2026-06-26 | A stack overflow in the AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity component of axiomatic-systems Bento4 before v1.8.9allows attackers to cause a Denial of… |
CVE-2026-36907 | Medium | 5.5 | 2026-06-26 | A stack overflow in the AP4_StsdAtom::AP4_StsdAtom component of axiomatic-systems Bento4 before v1.8.9allows attackers to cause a Denial of Service (DoS) via a… |
CVE-2026-52885 | Medium | 6.3 | 2026-06-26 | Notepad++ is a free and open-source source code editor. Prior to 8.9.6.4, NppCommands.cpp checks the HMAC of the on-disk shortcuts.xml at the moment a user com… |
CVE-2026-48770 | Medium | 5.0 | 2026-06-26 | Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, a local process in the same interactive Windows session can send a malformed WM_COPYD… |
CVE-2026-39031 | Medium | 5.5 | 2026-06-26 | Lansweeper lsrunase 2.0 and lsencrypt 2.0 use RC4 encryption with a hardcoded 142-byte static key array to encrypt credentials. An 8-character prefix is stored… |
CVE-2024-23581 | Medium | 6.7 | 2026-06-26 | The HCL Traveler for Microsoft Outlook libraries are being flagged as potentially malicious software or an unrecognized application. |
CVE-2026-55838 | Medium | 4.3 | 2026-06-26 | RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.7 and earlier, the real-time metrics endpoint at /rustfs/admin/v3/metrics is accessi… |
CVE-2026-53324 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: net: mana: Use pci_name() for debugfs directory naming Use pci_name(pdev) for the per-dev… |
CVE-2026-53323 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: net: dsa: remove redundant netdev_lock_ops() from conduit ethtool ops DSA replaces the co… |
CVE-2026-53321 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: io_uring/napi: cap busy_poll_to 10 msec Currently there's no cap on the maximum amount of… |
CVE-2026-53320 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() nilfs_ioctl_mark_block… |
CVE-2026-53319 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: blk-wbt: remove WARN_ON_ONCE from wbt_init_enable_default() wbt_init_enable_default() use… |
CVE-2026-53318 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_tx_check_aggr() Move the N… |
CVE-2026-53317 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: Place upper limit on station AID Any station configured with an AID o… |
CVE-2026-53316 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/ras: Fix NULL deref in ras_core_ras_interrupt_detected() Fixes a NULL pointer der… |
CVE-2026-53315 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/ras: Fix NULL deref in ras_core_get_utc_second_timestamp() ras_core_get_utc_secon… |
CVE-2026-53314 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: padata: Put CPU offline callback in ONLINE section to allow failure syzbot reported the f… |
CVE-2026-53313 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths In dc_dmub_srv_log_dia… |
CVE-2026-53312 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: iommu/riscv: Remove overflows on the invalidation path Since RISC-V supports a sign exten… |
CVE-2026-53311 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: fuse: fix uninit-value in fuse_dentry_revalidate() fuse_dentry_revalidate() may be called… |
CVE-2026-53310 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: soc/tegra: cbb: Fix cross-fabric target timeout lookup When a fabric receives an error in… |
CVE-2026-53308 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: power: supply: max77705: Free allocated workqueue and fix removal order Use devm interfac… |
CVE-2026-53307 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: pinconf-generic: Fully validate 'pinmux' property The pinconf_generic_parse_dt_p… |
CVE-2026-53306 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: tty: hvc_iucv: fix off-by-one in number of supported devices MAX_HVC_IUCV_LINES == HVC_AL… |
CVE-2026-53305 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: ps883x: Fix Oops at unbind When trying to unbind a device in order to bind to… |
CVE-2026-53304 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: scsi: sg: Resolve soft lockup issue when opening /dev/sgX The parameter def_reserved_size… |
CVE-2026-53302 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: crypto: eip93 - fix hmac setkey algo selection eip93_hmac_setkey() allocates a temporary… |
CVE-2026-53301 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: reset: amlogic: t7: Fix null reset ops Fix missing reset ops causing kernel null pointer… |
CVE-2026-53299 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: net: airoha: Move ndesc initialization at end of airoha_qdma_init_tx() If queue entry lis… |
CVE-2026-53298 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: net: airoha: Move ndesc initialization at end of airoha_qdma_init_rx_queue() If queue ent… |
CVE-2026-53297 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: net: mana: Guard mana_remove against double invocation If PM resume fails (e.g., mana_att… |
CVE-2026-53295 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: mailbox: add sanity check for channel array Fail gracefully if there is no channel array… |
CVE-2026-53293 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG There were multiple issues in that code. First… |
CVE-2026-53292 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind syzbot reported a ker… |
CVE-2026-53291 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/conexant: Fix missing error check for jack detection In cx_probe(), the return… |
CVE-2026-53289 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: ice: fix NULL pointer dereference in ice_reset_all_vfs() ice_reset_all_vfs() ignores the… |
CVE-2026-53288 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: arm64: Reserve an extra page for early kernel mapping The final part of [data, end) segme… |
CVE-2026-53287 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: audit: fix incorrect inheritable capability in CAPSET records __audit_log_capset() record… |
CVE-2026-53285 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED [W… |
CVE-2026-53283 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Bounds-check devid in __rlookup_amd_iommu() iommu_device_register() walks ever… |
CVE-2026-53282 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: x86/kexec: Push kjump return address even for non-kjump kexec The version of purgatory co… |
CVE-2026-53280 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: iommu: Fix NULL group->domain dereference in pci_dev_reset_iommu_done() Local sashiko rev… |
CVE-2026-53279 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: drm/gma500/oaktrail_lvds: fix hang on init failure The LVDS init code looks up an I2C ada… |
CVE-2026-53278 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: arm_mpam: Check whether the config array is allocated before destroying it __destroy_comp… |
CVE-2026-52781 | Medium | 6.4 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the HTML sanitizer grants <macro> elements unrestricted data-* a… |
CVE-2026-52779 | Medium | 5.4 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, a cross-project IDOR / authorization context confusion in the Ca… |
CVE-2026-49355 | Medium | 4.3 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.4.0, `GET /api/v3/meetings/:meeting_id/agenda_items/:agenda_item_id` discloses p… |
CVE-2026-44736 | Medium | 6.5 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.4.0, the GET /api/v3/relations endpoint allows any authenticated user to retriev… |
CVE-2026-44735 | Medium | 6.5 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the GET /api/v3/shares endpoint returns share details for ALL wo… |
CVE-2026-44734 | Medium | 6.5 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, a Missing Authorization vulnerability exists in OpenProject's Co… |
CVE-2026-44733 | Medium | 5.9 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, Business Logic Error on OpenProject through PATCH request to /ap… |
CVE-2026-44732 | Medium | 4.3 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, OpenProject exposes a document update endpoint used to modify ex… |
CVE-2026-44731 | Medium | 4.3 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the web application's meetings filter feature leaks whether a gi… |
CVE-2026-44696 | Medium | 5.7 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.4.0, OpenProject's rich text (markdown) rendering pipeline uses Sanitize::Config… |
CVE-2026-29509 | Medium | 5.4 | 2026-06-26 | Patool before 4.0.5 contains a path traversal vulnerability in the safe_extract() function in patoolib/programs/py_tarfile.py when running on Python before 3.1… |
CVE-2026-54753 | Medium | 5.9 | 2026-06-26 | Nx is a monorepo solution for TypeScript and polyglot codebases. From 17.0.4 until 22.7.2 and 23.0.0-beta.2, the local HTTP server started by nx graph sent Acc… |
CVE-2026-48090 | Medium | 5.9 | 2026-06-26 | Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, the HTTP OAuth2 filter (envoy.filte… |
CVE-2026-47205 | Medium | 5.9 | 2026-06-26 | Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.36.0 until 1.36.9, 1.37.5, and 1.38.3, a Use-After-Free (UAF) vul… |
CVE-2026-55448 | Medium | 6.3 | 2026-06-26 | mise manages dev tools like node, python, cmake, and terraform. From 2026.3.15 until 2026.6.4, mise loads github.credential_command from local project config b… |
CVE-2026-54557 | Medium | 5.5 | 2026-06-26 | mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.1, the mise HTTP backend builds its install symlink destination from the raw re… |
CVE-2026-48706 | Medium | 5.9 | 2026-06-26 | Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, a vulnerability e… |
CVE-2026-48497 | Medium | 5.9 | 2026-06-26 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, in cases where UDP DNS fil… |
CVE-2026-47778 | Medium | 4.4 | 2026-06-26 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a structural flaw was iden… |
CVE-2026-47775 | Medium | 6.8 | 2026-06-26 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, the OAuth2 HTTP filter's e… |
CVE-2026-47692 | Medium | 4.8 | 2026-06-26 | Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, PROXY Protocol v2… |
CVE-2026-47221 | Medium | 5.9 | 2026-06-26 | Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.18.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the router filter… |