Medium-severity CVEs (page 57)
Page 57 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-37256 | Medium | 5.4 | 2026-06-25 | Grav before 1.6.30 contains a cross-site scripting vulnerability in the Admin plugin page editor default security configuration. Privileged users with page edi… |
CVE-2026-6681 | Medium | 5.3 | 2026-06-25 | The PKCS#7 decode path ignores the caller-supplied output buffer size (outputSz), allowing decoded content to be written past the bounds of the provided buffer… |
CVE-2026-6678 | Medium | 5.3 | 2026-06-25 | Integer underflow in wc_PKCS7_DecryptOri when handling crafted Other Recipient Info, leading to incorrect length handling during decryption. |
CVE-2026-6450 | Medium | 5.3 | 2026-06-25 | A CRL critical extension bypass exists in ParseCRL_Extensions where critical extensions are not properly enforced, allowing a crafted CRL with an unhandled cri… |
CVE-2026-6412 | Medium | 4.3 | 2026-06-25 | Certificate policy and RFC 8446 compliance concerns regarding the continued acceptance of SHA-1/MD5 in certificate processing. |
CVE-2026-57521 | Medium | 4.3 | 2026-06-25 | Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organization billing dat… |
CVE-2026-55964 | Medium | 5.3 | 2026-06-25 | Chain intermediate CA:TRUE without keyCertSign accepted as a signing CA. Intermediate CA certificates are required to have the keyCertSign key usage when a Key… |
CVE-2026-2299 | Medium | 4.2 | 2026-06-25 | The Mattermost Google Drive plugin before version 1.1.0 fails to validate channel membership in the file creation endpoint, allowing authenticated users with a… |
CVE-2026-10592 | Medium | 5.3 | 2026-06-25 | Certificates with wildcard DNS SANs (e.g. *.example.com) bypassed CA name-constraint checks. A certificate with a wildcard DNS SAN that should be rejected by t… |
CVE-2025-60465 | Medium | 6.1 | 2026-06-25 | A use-after-free in the gf_filter_pid_inst_swap function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial o… |
CVE-2026-56789 | Medium | 6.5 | 2026-06-25 | RTKLIB through 2.4.3 contains a heap buffer overflow vulnerability in the readrnxobsb function in src/rinex.c that allows attackers to trigger memory corruptio… |
CVE-2026-56788 | Medium | 4.4 | 2026-06-25 | RTKLIB through 2.4.3 contains an out-of-bounds read vulnerability in getcodepri function when processing unrecognized RINEX observation codes, allowing attacke… |
CVE-2026-56787 | Medium | 6.5 | 2026-06-25 | RTKLIB through 2.4.3 contains an off-by-one out-of-bounds read vulnerability in the decode_ssr3 function at src/rtcm3.c:1446 that allows remote attackers to tr… |
CVE-2026-56779 | Medium | 6.4 | 2026-06-25 | MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints that allows authenticated users to make arbitrar… |
CVE-2026-56774 | Medium | 5.4 | 2026-06-25 | Kanboard through 1.2.52, fixed in commit 928c68a, UserViewController::removeSession fails to validate the session id parameter before passing it to RememberMeS… |
CVE-2026-56772 | Medium | 4.3 | 2026-06-25 | NewsBlur before 14.5.0 contains a broken access control vulnerability that allows authenticated users to read private notification feeds by supplying arbitrary… |
CVE-2026-54250 | Medium | 5.8 | 2026-06-25 | K3s is a fully conformant production-ready Kubernetes distribution. Prior to 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1, a path traversal vulnerability exists in… |
CVE-2026-54092 | Medium | 6.5 | 2026-06-25 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, unche… |
CVE-2026-46611 | Medium | 5.3 | 2026-06-25 | Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s, implemented in glances/server.py) does… |
CVE-2026-28898 | Medium | 5.3 | 2026-06-25 | swift-nio-http2's HTTP/2-to-HTTP/1.1 codec did not validate pseudo-header values for control characters before placing them into the translated HTTP/1.1 messag… |
CVE-2026-6291 | Medium | 6.5 | 2026-06-25 | Bleichenbacher padding oracle in PKCS#7 KTRI decryption. When decrypting PKCS#7 EnvelopedData using RSA PKCS#1 v1.5 key transport, wolfSSL returned distinguish… |
CVE-2026-6091 | Medium | 6.5 | 2026-06-25 | Partial-chain certificate verification may accept chains that terminate at a peer-supplied, untrusted intermediate certificate rather than a trusted anchor. An… |
CVE-2026-55699 | Medium | 6.5 | 2026-06-25 | pnpm is a package manager. Prior to 10.34.2 and 11.5.3, Manifest bin object keys such as "", ".", and ".." passed pnpm's bin-name guard. When a malicious packa… |
CVE-2026-55180 | Medium | 6.5 | 2026-06-25 | pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm and pacquet expanded ${ENV_VAR} placeholders from repository-controlled .npmrc and pnpm-workspace… |
CVE-2026-54679 | Medium | 5.5 | 2026-06-25 | jq is a command-line JSON processor. Prior to 1.8.2, on 32bit system, jvp_string_append has a chance of integer/multiple overflowing and then causing a massive… |
CVE-2026-50573 | Medium | 6.8 | 2026-06-25 | pnpm is a package manager. Prior to 10.34.0 and 11.4.0, `pnpm install` in non-frozen mode can accept new remote package content after detecting that the downlo… |
CVE-2026-50021 | Medium | 6.8 | 2026-06-25 | pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm's tarball extraction worker skips integrity verification when the integrity field is absent from t… |
CVE-2026-50017 | Medium | 6.5 | 2026-06-25 | pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm can send user-level unscoped npm authentication credentials to a registry chosen by a repository-l… |
CVE-2026-50014 | Medium | 6.4 | 2026-06-25 | pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm passes the lockfile-controlled git resolution.commit value to git fetch without a -- separator or… |
CVE-2026-47770 | Medium | 5.5 | 2026-06-25 | jq is a command-line JSON processor. Prior to 1.8.2, comparing two sufficiently deeply nested arrays with the == operator exhausts the C stack on jq's ordinary… |
CVE-2026-9799 | Medium | 4.6 | 2026-06-25 | A flaw was found in org.keycloak.authorization. An authenticated user with a granted User-Managed Access (UMA) permission ticket for one resource can exploit t… |
CVE-2026-9705 | Medium | 6.5 | 2026-06-25 | A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access Token (RAT), could exploit th… |
CVE-2026-9083 | Medium | 4.9 | 2026-06-25 | A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a… |
CVE-2026-55439 | Medium | 5.5 | 2026-06-25 | Halo is an open source website building tool. Prior to 2.24.3, a path traversal vulnerability in the backup download endpoint allows authenticated administrato… |
CVE-2026-55411 | Medium | 6.8 | 2026-06-25 | ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.1780-lts, the aut… |
CVE-2026-54448 | Medium | 6.5 | 2026-06-25 | Trivy is a security scanner. Prior to 0.71.0, when Trivy scans a Helm chart archive (.tgz), its custom tar unpacker reads each entry with io.ReadAll(tr) and no… |
CVE-2026-54040 | Medium | 5.9 | 2026-06-25 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the POST /api/auth/2fa/backup/regenerate endpoint regenerates a… |
CVE-2026-54037 | Medium | 6.5 | 2026-06-25 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the fix for CVE-2025-7105 added forkIpLimiter and forkUserLimit… |
CVE-2026-54029 | Medium | 5.3 | 2026-06-25 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the DELETE /api/messages/:conversationId/:messageId endpoint al… |
CVE-2026-54027 | Medium | 6.5 | 2026-06-25 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the POST /api/files/images endpoint allows any authenticated us… |
CVE-2026-54025 | Medium | 5.4 | 2026-06-25 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, there is a vulnerability in LibreChat's markdown artifact previ… |
CVE-2026-54024 | Medium | 6.5 | 2026-06-25 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the fix for CVE-2024-11171 (commit bb58a2d0) added limits: { fi… |
CVE-2026-9718 | Medium | 6.5 | 2026-06-25 | CWE-617 Reachable Assertion vulnerability exists that could allow an authenticated attacker to trigger a denial-of-service condition, impacting system availabi… |
CVE-2026-9651 | Medium | 4.4 | 2026-06-25 | CWE-732 Incorrect Permission Assignment for Critical Resource vulnerability that could cause unauthorized disclosure of password hashes and potential account c… |
CVE-2026-57454 | Medium | 6.1 | 2026-06-25 | Vim is an open source, command line text editor. From 9.2.0320 until 9.2.0679, a crafted undo or swap file can store a virtual-text property whose offset and l… |
CVE-2026-57453 | Medium | 6.5 | 2026-06-25 | Vim is an open source, command line text editor. From 9.1.1784 until 9.2.0678, when the bundled zip plugin autoload/zip.vim falls back to PowerShell to browse… |
CVE-2026-57452 | Medium | 5.5 | 2026-06-25 | Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt~04! or VimCrypt~05! method (xchacha20poly… |
CVE-2026-57451 | Medium | 5.3 | 2026-06-25 | Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 property count stored inline after a line… |
CVE-2026-57438 | Medium | 6.6 | 2026-06-25 | Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, XInclude substitution performed by Nokogiri::XML::Node#do_x… |
CVE-2026-55892 | Medium | 5.5 | 2026-06-25 | Vim is an open source, command line text editor. Prior to 9.2.0662, the dump_prefixes() function in src/spell.c walks a spell-file prefix trie iteratively with… |
CVE-2026-54036 | Medium | 5.3 | 2026-06-25 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the GET /api/auth/2fa/enable endpoint can be called by an authe… |
CVE-2026-48946 | Medium | 6.3 | 2026-06-25 | The K2 frontend article-attachment upload path accepts files whose extension is `.php`, and Apache's standard mod_php matches `\.php$` and executes them under… |
CVE-2026-48945 | Medium | 5.3 | 2026-06-25 | The K2 article gallery upload path accepts a zip/tar archive, extracts it under `/media/k2/galleries/<id>/`, and only renames image files (gif/jpg/jpeg/png/web… |
CVE-2026-48944 | Medium | 6.5 | 2026-06-25 | The K2 frontend article-save handler accepts an `attachment[N][existing]` POST field that is concatenated with `JPATH_SITE/` and passed to `JFile::copy()`. `JP… |
CVE-2026-48943 | Medium | 6.5 | 2026-06-25 | K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin `plg_user_k2`. A Registered Joomla user, by including the field `K2UserForm=1` in a st… |
CVE-2026-48942 | Medium | 6.1 | 2026-06-25 | K2 ≤ 2.26 renders the `#__k2_users.image` column directly into HTML `src` attributes via two distinct templates, in both cases without HTML escaping. |
CVE-2026-48941 | Medium | 6.5 | 2026-06-25 | The K2 frontend `item.checkin` task accepts an unauthenticated `sigProFolder` query parameter and uses it directly to address a `JFolder::delete()` call under… |
CVE-2026-57587 | Medium | 5.3 | 2026-06-25 | A SQL injection vulnerability in Nessus allows a remote, unauthenticated attacker who controls reverse DNS records for a scanned host to inject malicious SQL i… |
CVE-2026-57437 | Medium | 5.3 | 2026-06-25 | Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::XPathContext did not keep its source documen… |
CVE-2026-57436 | Medium | 5.3 | 2026-06-25 | Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::Document#root= validated only that the new r… |
CVE-2026-49319 | Medium | 6.5 | 2026-06-25 | Remote Keyless Entry System (RKES), using the 433 MHz key fob bearing FCC ID CWTR53R0 manufactured by ALPS ALPINE CO., LTD., is vulnerable to a roll-back attac… |
CVE-2026-57619 | Medium | 6.5 | 2026-06-25 | Contributor Sensitive Data Exposure in Elementor Website Builder <= 4.1.3 versions. |
CVE-2026-57429 | Medium | 6.5 | 2026-06-25 | Contributor Broken Access Control in Slim SEO <= 4.6.2 versions. |
CVE-2026-56050 | Medium | 6.5 | 2026-06-25 | Improper Access Control vulnerability in Themeisle PPOM for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue af… |
CVE-2026-56023 | Medium | 5.4 | 2026-06-25 | Customer Broken Access Control in UPI QR Code Payment Gateway for WooCommerce <= 1.6.2 versions. |
CVE-2026-56013 | Medium | 6.5 | 2026-06-25 | Unauthenticated Insecure Direct Object References (IDOR) in License Manager for WooCommerce <= 3.0.15 versions. |
CVE-2026-52690 | Medium | 5.9 | 2026-06-25 | Spoofing replies to Recursor might mark an IP of an authoritative server as not supporting EDNS, causing valdiation of DNSSEC records served by that server to… |
CVE-2026-4526 | Medium | 6.5 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, malformed global ZCL messages can trigger out-of-bounds reads in framework parsing logic and terminate the process. These mess… |
CVE-2026-47154 | Medium | 6.5 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, a malformed GetProfileResponse message can trigger out-of-bounds reads while iterating interval entries and terminate the proc… |
CVE-2026-47153 | Medium | 6.5 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, a malformed Level Control Step command can terminate the process through a divide-by-zero fault. This command must come from a… |
CVE-2026-47152 | Medium | 6.5 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, a malformed Level Control Move command can terminate the process through a divide-by-zero fault. This command must come from a… |
CVE-2026-47149 | Medium | 6.5 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, malformed or out-of-range Door Lock user identifiers can trigger out-of-bounds table reads and terminate the process. These me… |
CVE-2026-47148 | Medium | 6.5 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, malformed GetGroupMembership commands can trigger repeated reads past the end of the message payload and terminate the process… |
CVE-2026-47146 | Medium | 6.5 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These messages must come from a device that h… |
CVE-2026-47145 | Medium | 6.5 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These messages must come from a device that h… |
CVE-2026-46732 | Medium | 6.7 | 2026-06-25 | Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain a Concurrent Execution using Shared Resource with Improper Synchronization ('Rac… |
CVE-2026-42390 | Medium | 5.3 | 2026-06-25 | An invalid zone might pass ZONEMD validation while it should not. This is only relevant if ZoneToCache is configured with ZONEMD validation. |
CVE-2026-42389 | Medium | 5.3 | 2026-06-25 | This fix provides extra hardening for the 5.4.x branch by doing extra validation of incoming answers from authoritative servers. |
CVE-2026-42388 | Medium | 5.9 | 2026-06-25 | Incomplete validation of the SOA record present in a catalog zone might lead to a crash. |
CVE-2026-42387 | Medium | 5.9 | 2026-06-25 | A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to a crash of the Recursor due to insuffcient input validation. |
CVE-2026-40012 | Medium | 5.3 | 2026-06-25 | ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled; |
CVE-2026-40211 | Medium | 5.3 | 2026-06-25 | An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The buffer will be freed a… |
CVE-2026-40210 | Medium | 4.8 | 2026-06-25 | An out-of-bounds read might happen when SetMacAddrAction is used, potentially resulting in uninitialized memory being sent over the network or a crash. |
CVE-2026-40209 | Medium | 5.3 | 2026-06-25 | An attacker might be able to cause outgoing TCP connections to backend to be stuck until a timeout occurs instead of being released immediately, by sending IXF… |
CVE-2026-42005 | Medium | 4.3 | 2026-06-25 | An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web serve… |
CVE-2026-53274 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS A logic flaw in __… |
CVE-2026-53271 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers smb2_oplock_break_n… |
CVE-2026-53269 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: add mutex to guard hook reference counting As the synproxy infrastru… |
CVE-2026-53263 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix off-by-one in multicast context address compression The second memcpy in low… |
CVE-2026-53261 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: devlink: Release nested relation on devlink free devlink relation state is normally relea… |
CVE-2026-53258 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: wifi: fix leak if split 6 GHz scanning fails rdev->int_scan_req is leaked if cfg80211_sca… |
CVE-2026-53257 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: enforce HE/EHT cap/oper consistency Xiang Mei reports that mac80211 could… |
CVE-2026-53252 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix memory leak in error path of hci_alloc_dev() Early failures in Bluetooth H… |
CVE-2026-53251 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync hci_get_route() ret… |
CVE-2026-53249 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options This patch restricts setting Loose Sourc… |
CVE-2026-53245 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr In mrp_pdu_parse_vecat… |
CVE-2026-53243 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: rseq: Fix using an uninitialized stack variable in rseq_exit_user_update() There is an bu… |
CVE-2026-53241 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: dummy: fix UMP event stack overread The dummy sequencer port forwards events b… |
CVE-2026-53238 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: netlabel: validate unlabeled address and mask attribute lengths netlbl_unlabel_addrinfo_g… |
CVE-2026-53237 | Medium | 5.5 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: gpio: mvebu: fix NULL pointer dereference in suspend/resume mvebu_pwm_suspend() and mvebu… |