Medium-severity CVEs (page 58)
Page 58 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-12561 | Medium | 6.4 | 2026-08-25 | The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vc_raw_html shortcode in all versions up to and including 5.4.5… |
CVE-2026-76063 | Medium | 6.4 | 2026-08-25 | The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfp_featured_video_url' paramete… |
CVE-2026-75930 | Medium | 4.3 | 2026-08-25 | The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.1. Thi… |
CVE-2026-19943 | Medium | 6.4 | 2026-08-25 | The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'titleTag' Block Attribute… |
CVE-2026-17089 | Medium | 6.1 | 2026-08-25 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'header_format' parame… |
CVE-2026-14280 | Medium | 6.6 | 2026-08-25 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7… |
CVE-2026-75982 | Medium | 4.4 | 2026-08-25 | The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the l… |
CVE-2026-75019 | Medium | 6.4 | 2026-08-25 | The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2026-10627 | Medium | 5.3 | 2026-08-25 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7… |
CVE-2025-9878 | Medium | 6.4 | 2026-08-25 | The PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pp… |
CVE-2026-78679 | Medium | 6.5 | 2026-08-25 | GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypasses the unsafe optio… |
CVE-2026-78678 | Medium | 6.5 | 2026-08-25 | GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits --contents and -S options, allowing attacke… |
CVE-2026-76839 | Medium | 6.5 | 2026-08-25 | Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet() and offsetexists() methods that lack field… |
CVE-2026-75575 | Medium | 5.3 | 2026-08-25 | Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The me… |
CVE-2026-72702 | Medium | 5.4 | 2026-08-25 | Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer() and Pages::referrerRoute() methods, which validate the Referer header using… |
CVE-2026-72699 | Medium | 5.3 | 2026-08-25 | The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable to email address enumeration. The register() method in classes/Login.php throws a… |
CVE-2026-72698 | Medium | 6.5 | 2026-08-25 | Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive confi… |
CVE-2026-72697 | Medium | 6.5 | 2026-08-25 | Grav CMS before 2.0.16 contains a path traversal vulnerability in the media_directory() Twig function that fails to validate filesystem paths, allowing authent… |
CVE-2026-56708 | Medium | 5.3 | 2026-08-25 | Grav API plugin before 1.0.16 contains a server-side request forgery vulnerability in webhook delivery that allows attackers to bypass hostname validation by D… |
CVE-2026-56706 | Medium | 6.8 | 2026-08-25 | Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token (format (rand XOR secret):rand), allowing an… |
CVE-2026-56704 | Medium | 6.1 | 2026-08-25 | Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controllin… |
CVE-2026-34967 | Medium | 5.4 | 2026-08-25 | Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file write vulnerability in the ns parameter of plugins/sql-log.php… |
CVE-2026-34964 | Medium | 5.8 | 2026-08-25 | Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for… |
CVE-2026-34959 | Medium | 4.7 | 2026-08-25 | Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $_SERVER["REQUEST_URI"] with no trusted-proxy check and no validation of t… |
CVE-2026-19801 | Medium | 4.3 | 2026-08-25 | The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin for WordPress is vulnerable to authorization bypass in all vers… |
CVE-2026-15023 | Medium | 6.5 | 2026-08-25 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to generic SQL Injection via Stored 'meta_key' via Event/Locatio… |
CVE-2026-10630 | Medium | 4.3 | 2026-08-25 | The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to Insecure Direct Objec… |
CVE-2026-59183 | Medium | 5.5 | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.1.0 through 3.2.1… |
CVE-2026-55373 | Medium | 6.2 | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions prior to 3.2.10, 3.3.1… |
CVE-2026-55059 | Medium | 6.1 | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions prior to 3.2.10, 3.3.1… |
CVE-2026-78434 | Medium | 6.5 | 2026-08-24 | A flaw has been found in Faveo Helpdesk up to 2.0.3. This impacts the function FormController::post_ticket_reply of the file app/Http/Controllers/Client/helpde… |
CVE-2026-78266 | Medium | 6.5 | 2026-08-24 | Subscriber Broken Access Control in AutomatorWP <= 5.8.3 versions. |
CVE-2026-68516 | Medium | 6.5 | 2026-08-24 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4… |
CVE-2026-27364 | Medium | 6.5 | 2026-08-24 | Subscriber Broken Access Control in Style Kits <= 2.6.5 versions. |
CVE-2026-17113 | Medium | 6.0 | 2026-08-24 | A flaw was found in CRI-O's container-creation environment-variable handling (`mergeEnvs` in `server/utils.go`, consumed by `setupContainerEnvironmentAndWorkdi… |
CVE-2026-5006 | Medium | 6.8 | 2026-08-24 | A vulnerability was identified in HashiCorp Vault and Vault Enterprise (“Vault”) such that an authenticated attacker may manipulate an identity value reference… |
CVE-2026-56136 | Medium | 4.7 | 2026-08-24 | In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfs_ir_nill() in libntfs-3g/index.c that allows an attacker to read possibly confidential inform… |
CVE-2026-55468 | Medium | 4.3 | 2026-08-24 | Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the i… |
CVE-2026-16782 | Medium | 5.3 | 2026-08-24 | A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulner… |
CVE-2026-16781 | Medium | 5.5 | 2026-08-24 | A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can trigger an Uncontrolled Recursion vulnerability. A malicious actor may leverage this… |
CVE-2022-30983 | Medium | 6.1 | 2026-08-24 | A cross-site scripting (XSS) vulnerability in Support chatbot in Nopaperforms Niaa-Chatbot through 2022-05-17 allows remote attackers to inject arbitrary web s… |
CVE-2026-78430 | Medium | 5.3 | 2026-08-24 | A vulnerability was detected in sworddut mcp-ffmpeg-helper 0.1.0/0.1.1/0.2.1. This affects the function handleToolCall of the file src/tools/handlers.ts of the… |
CVE-2026-77923 | Medium | 4.3 | 2026-08-24 | Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check wi… |
CVE-2026-77310 | Medium | 5.3 | 2026-08-24 | jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3… |
CVE-2026-75509 | Medium | 6.5 | 2026-08-24 | joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to version 1.7.3, JWTClaimsRe… |
CVE-2026-72714 | Medium | 6.3 | 2026-08-24 | Rocq Prover does not restore the universe graph's copy of the universe checking flag when a module that locally disabled the check is closed. Local Unset Unive… |
CVE-2026-72711 | Medium | 6.3 | 2026-08-24 | The Lean 4 kernel does not check that the body of an opaque declaration is closed. environment::add_opaque omits the check_no_metavar_no_fvar call that the def… |
CVE-2026-72705 | Medium | 6.3 | 2026-08-24 | The guard checker in Rocq Prover does not follow recursive calls made through a fixpoint's own arguments. A fixpoint may pass itself as a higher-order argument… |
CVE-2026-72704 | Medium | 6.3 | 2026-08-24 | The guard checker in Rocq Prover does not recheck the recursive tree representation of an inductive type parameter after that parameter has been changed by tra… |
CVE-2026-72703 | Medium | 6.3 | 2026-08-24 | The guard checker in Rocq Prover treats a parameter of a nested mutual fixpoint as uniform without examining calls between the different bodies of that fixpoin… |
CVE-2026-71511 | Medium | 6.5 | 2026-08-24 | Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to… |
CVE-2026-71510 | Medium | 6.5 | 2026-08-24 | Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API that allows authenticated attackers with user-read rights to extract sensit… |
CVE-2026-63693 | Medium | 6.6 | 2026-08-24 | Dell Client BIOS contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could po… |
CVE-2020-37268 | Medium | 6.3 | 2026-08-24 | Print Assumptions does not report that a definition was produced while universe checking was disabled when that definition reaches the caller through Parameter… |
CVE-2026-78417 | Medium | 4.3 | 2026-08-24 | Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, al… |
CVE-2026-75370 | Medium | 6.5 | 2026-08-24 | An out-of-bounds read/write vulnerability in the MessageParser::parseECSSTCHeader component of SpaceDot AcubeSAT OBC software commit eaf90ec allows attackers t… |
CVE-2026-71832 | Medium | 6.2 | 2026-08-24 | Aria2 version 1.37.0 and below is affected by a Divide By Zero issue in src/bittorrent_helper.cc, which allows a remote malicious user to cause a Denial of Ser… |
CVE-2026-71509 | Medium | 6.5 | 2026-08-24 | Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint that allows authenticated attackers with… |
CVE-2026-71508 | Medium | 6.5 | 2026-08-24 | Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API update endpoint that allows attackers with user-write rights to mo… |
CVE-2026-71507 | Medium | 6.5 | 2026-08-24 | Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated a… |
CVE-2026-71503 | Medium | 6.1 | 2026-08-24 | Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is… |
CVE-2026-78475 | Medium | 6.1 | 2026-08-24 | A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array (VLA) o… |
CVE-2026-76837 | Medium | 6.4 | 2026-08-24 | Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/account/ stores the first_name value verbat… |
CVE-2026-71932 | Medium | 4.9 | 2026-08-24 | Multiple DrayTek VigorSwitch models contain a directory traversal vulnerability in the getSyslogFile function. The vulnerability is caused by insufficient vali… |
CVE-2026-71920 | Medium | 4.9 | 2026-08-24 | Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function. The vulnerability is caused by missing checks… |
CVE-2026-13213 | Medium | 5.3 | 2026-08-24 | The Hearing Access Service (HAS) GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BT_CONN_CB_DEFINE, so secur… |
CVE-2026-77914 | Medium | 6.5 | 2026-08-24 | rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames… |
CVE-2026-75099 | Medium | 5.3 | 2026-08-24 | Unauthenticated REST disclosure of certain content items in Apache Allura. This issue affects Apache Allura: through 1.19.1. Users are recommended to upg… |
CVE-2026-63621 | Medium | 5.3 | 2026-08-24 | Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel Kna… |
CVE-2026-60093 | Medium | 5.5 | 2026-08-24 | Relative path traversal vulnerability in Apache Camel Azure-Storage Datalake component This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15… |
CVE-2026-59230 | Medium | 6.5 | 2026-08-24 | Improper input validation vulnerability in Apache Camel. This issue affects Apache Camel: from 2.17.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0… |
CVE-2025-36939 | Medium | 5.7 | 2026-08-24 | Multiple vulnerabilities exist in OpenThread's handling of MLE packets. An authenticated attacker on the same Thread network could send specially crafted packe… |
CVE-2026-67204 | Medium | 5.4 | 2026-08-24 | BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to ma… |
CVE-2026-13343 | Medium | 5.3 | 2026-08-24 | The UMP Stream responder library in lib/midi2/ump_stream_responder.c builds reply packets in a 16-byte struct midi_ump (uint32_t data[4]). The builders make_en… |
CVE-2026-9728 | Medium | 6.4 | 2026-08-24 | The userspace syscall verifier z_vrfy_mbox_send() in drivers/mbox/mbox_handlers.c validated the nested msg->data/msg->size fields by reading them directly out… |
CVE-2026-65053 | Medium | 6.1 | 2026-08-24 | Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble… |
CVE-2026-39914 | Medium | 6.5 | 2026-08-24 | TIM Flow before 26.0.6 contains an improper authorization vulnerability that allows any authenticated user to submit arbitrary SQL queries to a privileged dash… |
CVE-2026-21755 | Medium | 5.3 | 2026-08-24 | HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denia… |
CVE-2026-78250 | Medium | 4.3 | 2026-08-24 | A vulnerability was identified in bytebot-ai bytebot 0.0.1. The affected element is an unknown function of the component Agent Execution Workflow. Such manipul… |
CVE-2026-76845 | Medium | 6.5 | 2026-08-24 | adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the st… |
CVE-2026-17033 | Medium | 6.8 | 2026-08-24 | An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL… |
CVE-2025-68833 | Medium | 5.3 | 2026-08-24 | HCL Hive Keycloak IAM Instance is affected by insufficient granularity of access control which could allow an attacker unauthorized access to resources. |
CVE-2026-21759 | Medium | 4.3 | 2026-08-24 | HCL Hive is affected by an information exposure vulnerability where Swagger documentation was found exposed publicly. Although no sensitive information (e.g… |
CVE-2026-78323 | Medium | 6.5 | 2026-08-24 | A flaw was found in JSS (Java Security Services). The JSSTrustManager class does not verify NSS trust flags when validating CA certificates, allowing certifica… |
CVE-2026-78291 | Medium | 5.3 | 2026-08-24 | Unauthenticated Broken Access Control in RepairBuddy <= 4.1223 versions. |
CVE-2026-78290 | Medium | 6.5 | 2026-08-24 | Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.6 versions. |
CVE-2026-78280 | Medium | 4.3 | 2026-08-24 | Unauthenticated Cross Site Request Forgery (CSRF) in Hash Form <= 1.4.0 versions. |
CVE-2026-78279 | Medium | 5.4 | 2026-08-24 | Unauthenticated Cross Site Request Forgery (CSRF) in Fluent Support Pro <= 2.3.1 versions. |
CVE-2026-78278 | Medium | 5.3 | 2026-08-24 | Subscriber Insecure Direct Object References (IDOR) in Fluent Boards Pro <= 2.0.11 versions. |
CVE-2026-78277 | Medium | 4.9 | 2026-08-24 | Subscriber Server Side Request Forgery (SSRF) in FluentCRM Pro <= 3.1.12 versions. |
CVE-2026-78272 | Medium | 5.4 | 2026-08-24 | Subscriber Broken Access Control in Fluent Support Pro <= 2.3.1 versions. |
CVE-2026-78269 | Medium | 6.4 | 2026-08-24 | Contributor Server Side Request Forgery (SSRF) in Shared Files <= 1.7.69 versions. |
CVE-2026-78258 | Medium | 5.3 | 2026-08-24 | Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.5 versions. |
CVE-2026-59295 | Medium | 5.9 | 2026-08-24 | It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service (DoS) condition due to an unbounded memory leak. … |
CVE-2026-10618 | Medium | 5.4 | 2026-08-24 | Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in ma… |
CVE-2026-8173 | Medium | 5.3 | 2026-08-24 | The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC address table when an authenticated administrator uses the 'Copy… |
CVE-2026-78200 | Medium | 6.3 | 2026-08-24 | A flaw has been found in itsourcecode Library Management System 1.0. The affected element is an unknown function of the file editbooks.php. Executing a manipul… |
CVE-2026-78196 | Medium | 4.4 | 2026-08-24 | A security flaw has been discovered in achorein expo-share-intent up to 8.0.0. This affects the function getDataColumn of the file ExpoShareIntentModule.kt of… |
CVE-2026-78186 | Medium | 4.3 | 2026-08-24 | A flaw has been found in Open5GS up to 2.8.0. This affects an unknown function of the file src/hss/hss-cx-path.c of the component HSS. This manipulation of the… |
CVE-2026-78185 | Medium | 6.3 | 2026-08-24 | A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/cust_edit.php. The… |