Medium-severity CVEs (page 60)
Page 60 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-15046 | Medium | 4.2 | 2026-08-21 | The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authent… |
CVE-2026-77769 | Medium | 6.5 | 2026-08-21 | The report.list procedure in packages/trpc/src/routers/report.ts accepted a projectId and a dashboardId and returned getReportsByDashboardId(dashboardId). The… |
CVE-2026-77768 | Medium | 6.5 | 2026-08-21 | The report.get procedure in packages/trpc/src/routers/report.ts accepted only a reportId and returned getReportById(reportId) directly. The enforceAccess middl… |
CVE-2026-77763 | Medium | 6.5 | 2026-08-21 | The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from path(key)… |
CVE-2026-77686 | Medium | 5.4 | 2026-08-21 | A weakness has been identified in Dolibarr up to 23.0.4. This affects an unknown part of the file htdocs/user/card.php of the component Account Handler. This m… |
CVE-2026-59296 | Medium | 5.9 | 2026-08-21 | Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose in… |
CVE-2026-77681 | Medium | 6.3 | 2026-08-21 | A vulnerability was identified in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /users/update-profile… |
CVE-2026-59323 | Medium | 5.3 | 2026-08-21 | An application using Micrometer Tracing with W3C baggage propagation in the Brave bridge is vulnerable to denial of service (DoS) due to unbounded object alloc… |
CVE-2026-74866 | Medium | 5.8 | 2026-08-21 | @fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-fee… |
CVE-2026-66797 | Medium | 5.4 | 2026-08-21 | Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation… |
CVE-2026-65613 | Medium | 4.3 | 2026-08-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries. This iss… |
CVE-2026-61422 | Medium | 4.3 | 2026-08-21 | Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality. When registering a template or ISO, CloudS… |
CVE-2026-61399 | Medium | 4.8 | 2026-08-21 | Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Lock User Functionality. This issue affects Apache CloudStack: fro… |
CVE-2026-73537 | Medium | 4.7 | 2026-08-21 | Cross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited, an arbitrary script may be executed in the browser compon… |
CVE-2026-19441 | Medium | 5.3 | 2026-08-21 | Missing authentication for critical function vulnerability in IKAS Technology Inc. Rush allows Fake the Source of Data. This issue affects Rush: through 21082… |
CVE-2026-16962 | Medium | 5.3 | 2026-08-21 | The Tamara Checkout WordPress plugin through 1.9.9.20 does not verify the order key, a nonce, or any capability on its public payment cancel/fail return URLs… |
CVE-2026-16959 | Medium | 6.8 | 2026-08-21 | The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-libr… |
CVE-2026-16575 | Medium | 5.3 | 2026-08-21 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not restrict access to per-vendor commission configurat… |
CVE-2026-14601 | Medium | 6.8 | 2026-08-21 | The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated us… |
CVE-2026-13736 | Medium | 5.3 | 2026-08-21 | The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing… |
CVE-2025-15671 | Medium | 5.4 | 2026-08-21 | The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-… |
CVE-2026-65645 | Medium | 4.3 | 2026-08-21 | Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the Meteor DDP methods getThreadsList and getThreadMessages… |
CVE-2026-45202 | Medium | 5.5 | 2026-08-21 | Software installed and run as a non-privileged user may conduct GPU system calls which cause GPU memory leaks and possible kernel heap corruption. Scenario… |
CVE-2026-76131 | Medium | 5.3 | 2026-08-21 | Use of hard-coded credentials issue exists in VOCALOID6 , which may allow an attacker to impersonate a legitimate VOCALOID6 Editor and gain access to Yamaha's… |
CVE-2026-77392 | Medium | 6.3 | 2026-08-21 | A weakness has been identified in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This impacts the function saveUser of the file /pu… |
CVE-2026-77391 | Medium | 4.3 | 2026-08-21 | A security flaw has been discovered in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This affects an unknown function. The manipul… |
CVE-2026-20679 | Medium | 4.3 | 2026-08-21 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. Processing a maliciously craf… |
CVE-2026-77643 | Medium | 4.4 | 2026-08-20 | A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HT… |
CVE-2026-72846 | Medium | 6.4 | 2026-08-20 | Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleCha… |
CVE-2026-70105 | Medium | 6.5 | 2026-08-20 | Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. |
CVE-2026-67448 | Medium | 6.5 | 2026-08-20 | Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for t… |
CVE-2026-67447 | Medium | 5.3 | 2026-08-20 | Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go readData() function calls bufio.Reader.Rea… |
CVE-2026-62945 | Medium | 4.3 | 2026-08-20 | TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservation_id, place_id, and ass… |
CVE-2026-55491 | Medium | 5.4 | 2026-08-20 | BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape meetingName in record-and-playback/screenshare/playback/inde… |
CVE-2026-55489 | Medium | 4.9 | 2026-08-20 | BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified… |
CVE-2026-55015 | Medium | 5.5 | 2026-08-20 | Uncontrolled search path element in Windows Remote Help allows an authorized attacker to deny service locally. |
CVE-2026-54509 | Medium | 6.5 | 2026-08-20 | TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result o… |
CVE-2026-54389 | Medium | 5.5 | 2026-08-20 | Ghidra before 12.1.3 contains an uncontrolled resource consumption vulnerability in the PDB parser that allows attackers to terminate the Ghidra process by sup… |
CVE-2026-49244 | Medium | 5.9 | 2026-08-20 | SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable shar… |
CVE-2026-19783 | Medium | 6.7 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause kernel memory corruption due to insufficient validation. A crafted filesyst… |
CVE-2026-19448 | Medium | 6.5 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 A stack memory corruption vulnerability exists in the AIX IPsec ESP decapsulation handler. Successful exploitatio… |
CVE-2026-18828 | Medium | 5.4 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a stack-based buffer overflow. |
CVE-2026-18822 | Medium | 4.4 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to uncontrolled resource consumption when parsing d… |
CVE-2026-17424 | Medium | 4.8 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to bypass security restrictions due to improper limitation of a pathname to a restr… |
CVE-2026-17195 | Medium | 6.5 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to an out-of-bounds write. |
CVE-2026-17120 | Medium | 5.3 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a buffer overflow. |
CVE-2026-17009 | Medium | 4.7 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to a NULL pointer dereference. |
CVE-2026-17007 | Medium | 6.7 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to obtain sensitive information or cause a denial of service due to an out-of-bounds… |
CVE-2026-16980 | Medium | 6.3 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to improper validation of symbolic links. |
CVE-2026-16973 | Medium | 5.5 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to disclose sensitive kernel memory due to an out-of-bounds read. |
CVE-2026-16972 | Medium | 6.5 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information due to improper authentication. |
CVE-2026-16964 | Medium | 6.5 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to intercept messages and forge replies due to the exposure of sensitive informatio… |
CVE-2026-16958 | Medium | 6.5 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an out-of-bounds write. |
CVE-2026-16952 | Medium | 5.5 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to uncontrolled resource consumption. |
CVE-2026-16951 | Medium | 6.7 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local authenticated attacker to execute arbitrary code due to a heap-based buffer overflow. |
CVE-2026-16944 | Medium | 6.7 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a stack-based buffer overflow. |
CVE-2026-77641 | Medium | 6.5 | 2026-08-20 | tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails. The return value of relay_send_command_from_edge() was igno… |
CVE-2026-77639 | Medium | 5.3 | 2026-08-20 | Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream det… |
CVE-2026-77587 | Medium | 5.9 | 2026-08-20 | Tor before 0.4.9.11 is prone to a use-after-free (and potential double free) of a conflux object when a recovery leg revives a conflux set whose last linked le… |
CVE-2026-77506 | Medium | 4.8 | 2026-08-20 | Znuny before LTS 6.5.22 allows AgentTicketEmailResend template XSS. |
CVE-2026-68921 | Medium | 4.7 | 2026-08-20 | DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate option into an SVG transform attribute witho… |
CVE-2026-67446 | Medium | 5.3 | 2026-08-20 | Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checkin… |
CVE-2026-67445 | Medium | 5.3 | 2026-08-20 | Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit reads SMTP commands through internal/smtpd/smtpd.go session.readLine() using… |
CVE-2026-75910 | Medium | 6.5 | 2026-08-20 | Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticate… |
CVE-2026-72861 | Medium | 5.8 | 2026-08-20 | The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src… |
CVE-2026-9033 | Medium | 4.3 | 2026-08-20 | An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including for… |
CVE-2026-75526 | Medium | 4.4 | 2026-08-20 | django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.render_plac… |
CVE-2026-75514 | Medium | 5.9 | 2026-08-20 | BunkerWeb is an open-source, next-generation Web Application Firewall. Prior to 1.6.13, the blacklist, greylist, and antibot modules in src/common/core/blackli… |
CVE-2026-72854 | Medium | 5.3 | 2026-08-20 | msgpack_unpacker_expand_buffer in src/unpack.c, reached through the public msgpack_unpacker_reserve_buffer API, computes its new buffer size using an unchecked… |
CVE-2026-66787 | Medium | 5.4 | 2026-08-20 | A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of ad… |
CVE-2026-64777 | Medium | 4.3 | 2026-08-20 | A malicious builder peer may be able to request an in-context file by name from the host and receive the contents of whatever the name resolves to, even when i… |
CVE-2026-63003 | Medium | 6.5 | 2026-08-20 | django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-le… |
CVE-2026-61663 | Medium | 4.3 | 2026-08-20 | django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to au… |
CVE-2026-54624 | Medium | 6.5 | 2026-08-20 | django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, render_object_structure in cms/view… |
CVE-2026-54622 | Medium | 6.5 | 2026-08-20 | django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the copy_plugins endpoint in cms/ad… |
CVE-2026-53586 | Medium | 6.5 | 2026-08-20 | libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your a… |
CVE-2026-53585 | Medium | 5.3 | 2026-08-20 | libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your a… |
CVE-2026-53584 | Medium | 4.3 | 2026-08-20 | libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your a… |
CVE-2026-53583 | Medium | 6.5 | 2026-08-20 | libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your a… |
CVE-2026-43678 | Medium | 5.3 | 2026-08-20 | An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed Web… |
CVE-2026-15743 | Medium | 5.7 | 2026-08-20 | Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The _serve_static method always sets the Cache-Control h… |
CVE-2026-77036 | Medium | 6.3 | 2026-08-20 | A vulnerability was found in elunez eladmin up to 2.7. The impacted element is the function EmailController/AliPayController/GeneratorController/GenConfigContr… |
CVE-2026-73259 | Medium | 5.4 | 2026-08-20 | Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using… |
CVE-2026-73258 | Medium | 6.5 | 2026-08-20 | Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input proce… |
CVE-2026-73255 | Medium | 6.5 | 2026-08-20 | Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences… |
CVE-2026-73254 | Medium | 5.4 | 2026-08-20 | Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cr… |
CVE-2026-72847 | Medium | 4.6 | 2026-08-20 | broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain to_string_lossy()… |
CVE-2026-72844 | Medium | 6.3 | 2026-08-20 | The Lean 4 kernel does not verify that the structure named in a projection expression matches the type of the value being projected, and environment::add_induc… |
CVE-2026-54625 | Medium | 4.8 | 2026-08-20 | django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request head… |
CVE-2026-77025 | Medium | 6.3 | 2026-08-20 | A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /viewappointmentpending.php. This manip… |
CVE-2026-61625 | Medium | 6.8 | 2026-08-20 | VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate back… |
CVE-2026-55586 | Medium | 6.6 | 2026-08-20 | SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffman code lengths to make_decode_table in… |
CVE-2026-54770 | Medium | 6.1 | 2026-08-20 | WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response._make_location_absolute() in src/webob/response.py checks a Location value fo… |
CVE-2026-18273 | Medium | 6.6 | 2026-08-20 | Kenwood DNR1007XR USB Incorrect Default Permissions Local Privilege Escalation Vulnerability. This vulnerability allows physically present attackers to escalat… |
CVE-2026-18272 | Medium | 6.8 | 2026-08-20 | Kenwood DNR1007XR startUpdateProcess Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affec… |
CVE-2026-18271 | Medium | 6.8 | 2026-08-20 | Kenwood DNR1007XR vCardParser Heap-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitr… |
CVE-2026-18269 | Medium | 6.8 | 2026-08-20 | Kenwood DNR1007XR tchdr_bytestream_read Out-Of-Bounds Write Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arb… |
CVE-2026-18267 | Medium | 6.8 | 2026-08-20 | Kenwood DNR1007XR Firmware Update Link Following Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code… |
CVE-2026-76999 | Medium | 6.3 | 2026-08-20 | A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects the function add_grade of the file /… |
CVE-2026-76997 | Medium | 6.3 | 2026-08-20 | A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/ajax.ph… |