Medium-severity CVEs (page 61)
Page 61 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-61625 | Medium | 6.8 | 2026-08-20 | VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate back… |
CVE-2026-55586 | Medium | 6.6 | 2026-08-20 | SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffman code lengths to make_decode_table in… |
CVE-2026-54770 | Medium | 6.1 | 2026-08-20 | WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response._make_location_absolute() in src/webob/response.py checks a Location value fo… |
CVE-2026-18273 | Medium | 6.6 | 2026-08-20 | Kenwood DNR1007XR USB Incorrect Default Permissions Local Privilege Escalation Vulnerability. This vulnerability allows physically present attackers to escalat… |
CVE-2026-18272 | Medium | 6.8 | 2026-08-20 | Kenwood DNR1007XR startUpdateProcess Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affec… |
CVE-2026-18271 | Medium | 6.8 | 2026-08-20 | Kenwood DNR1007XR vCardParser Heap-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitr… |
CVE-2026-18269 | Medium | 6.8 | 2026-08-20 | Kenwood DNR1007XR tchdr_bytestream_read Out-Of-Bounds Write Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arb… |
CVE-2026-18267 | Medium | 6.8 | 2026-08-20 | Kenwood DNR1007XR Firmware Update Link Following Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code… |
CVE-2026-76999 | Medium | 6.3 | 2026-08-20 | A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects the function add_grade of the file /… |
CVE-2026-76997 | Medium | 6.3 | 2026-08-20 | A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/ajax.ph… |
CVE-2026-63044 | Medium | 5.4 | 2026-08-20 | Server-Side Request Forgery (SSRF) vulnerability in Apache InLong. Any authenticated user (no admin role required) can cause the InLong Manager server to make… |
CVE-2026-63016 | Medium | 5.3 | 2026-08-20 | Uncontrolled Resource Consumption vulnerability in Apache InLong. Users could affect operational configuration or allow upload of non-official packages. This… |
CVE-2026-63015 | Medium | 4.3 | 2026-08-20 | Uncontrolled Resource Consumption vulnerability in Apache InLong. Non-template responsible persons can view template information. This issue affects Apache In… |
CVE-2026-76995 | Medium | 4.7 | 2026-08-20 | A vulnerability was identified in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /admin/ajax.php… |
CVE-2026-76993 | Medium | 5.0 | 2026-08-20 | A vulnerability was determined in GreyDGL PentestGPT up to 1.0.0. This vulnerability affects unknown code of the component Web-Page Crawling. Executing a manip… |
CVE-2026-76991 | Medium | 6.3 | 2026-08-20 | A vulnerability was found in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /viewappointmentapproved.php. Performing a m… |
CVE-2026-55558 | Medium | 5.9 | 2026-08-20 | aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.start_tls in src/aiosmtplib/protocol.py consumes the server's 220… |
CVE-2026-44725 | Medium | 6.6 | 2026-08-20 | EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the pl… |
CVE-2026-76634 | Medium | 6.5 | 2026-08-20 | WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitr… |
CVE-2026-76989 | Medium | 5.3 | 2026-08-20 | A security vulnerability has been detected in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. This impacts an unknown function of the file source/… |
CVE-2026-76988 | Medium | 5.3 | 2026-08-20 | A weakness has been identified in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. This affects the function CipConnMgrClass::forward_open of the f… |
CVE-2026-28163 | Medium | 5.3 | 2026-08-20 | Missing Authorization vulnerability in myCred New User Approve allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects New… |
CVE-2026-21784 | Medium | 4.8 | 2026-08-20 | HCL IntelliOps Event Management (IEM) is affected by missing or insecure Cross-Origin Security headers. This issue makes the application's environment and reso… |
CVE-2025-62306 | Medium | 5.0 | 2026-08-20 | HCL IntelliOps Event Management (IEM) is affected by information omission. The lack of information breaks auditability and observability of a workflow. if an a… |
CVE-2025-62300 | Medium | 5.9 | 2026-08-20 | HCL IntelliOps Event Management (IEM) is affected by a race condition. A "timing window" can occur where an attacker can modify the resource causing unpredicta… |
CVE-2025-62299 | Medium | 6.6 | 2026-08-20 | HCL IntelliOps Event Management (IEM) is affected by a least privileges violation which could allow an attacker to access the resource with the elevated privil… |
CVE-2026-77085 | Medium | 6.5 | 2026-08-20 | n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-supplied API URL us… |
CVE-2026-77083 | Medium | 5.9 | 2026-08-20 | n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not freeze the sandbox's Fu… |
CVE-2026-77082 | Medium | 4.3 | 2026-08-20 | n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service (ReDoS) vulnerability in the Filter and Switch… |
CVE-2026-77076 | Medium | 6.5 | 2026-08-20 | n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability in the GraphQL node. When a GraphQL request fails at the conne… |
CVE-2026-77074 | Medium | 6.5 | 2026-08-20 | n8n versions before 1.123.69 contain a server-side request forgery vulnerability in the Edit Image node's Draw Text operation that allows authenticated users t… |
CVE-2026-77073 | Medium | 4.3 | 2026-08-20 | n8n versions before 2.34.1 contain a credential validation bypass in the MCP create_workflow_from_code tool when authentication type is set to an expression. A… |
CVE-2026-77069 | Medium | 4.3 | 2026-08-20 | n8n before 1.123.69, 2.33.4, and 2.34.1 contains an SSRF protection bypass in the OAuth2 credential authorization-code-to-access-token exchange. While OAuth2 d… |
CVE-2026-73402 | Medium | 6.5 | 2026-08-20 | Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions. |
CVE-2026-66647 | Medium | 6.5 | 2026-08-20 | Subscriber Broken Access Control in Homlisti <= 3.1.2 versions. |
CVE-2026-66601 | Medium | 6.5 | 2026-08-20 | Subscriber Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.39 versions. |
CVE-2026-66595 | Medium | 5.9 | 2026-08-20 | Unauthenticated Broken Access Control in WP Data Access <= 5.5.80 versions. |
CVE-2026-66586 | Medium | 6.6 | 2026-08-20 | Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions. |
CVE-2025-62307 | Medium | 5.4 | 2026-08-20 | HCL IntelliOps Event Management (IEM) is affected by insufficient logging. Insufficient logging weakens accountability, obscures attack detection, and enables… |
CVE-2025-53999 | Medium | 6.5 | 2026-08-20 | Unauthenticated Broken Access Control in Altair <= 5.2.2 versions. |
CVE-2026-77067 | Medium | 5.0 | 2026-08-20 | The setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts stores the caller-supplied url without any address validation, and the file imports no v… |
CVE-2026-77066 | Medium | 5.0 | 2026-08-20 | The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to axios.get(url, rssParserConfig()) with no… |
CVE-2026-73199 | Medium | 6.5 | 2026-08-20 | A flaw was found in the `ipa-enrollment` SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malforme… |
CVE-2026-73196 | Medium | 4.3 | 2026-08-20 | A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password (OTP) key value. Th… |
CVE-2026-77014 | Medium | 5.3 | 2026-08-20 | A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction re… |
CVE-2026-14953 | Medium | 4.3 | 2026-08-20 | A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges using the endpoint /api/user/fetch-all… |
CVE-2026-14949 | Medium | 6.5 | 2026-08-20 | A low privileged remote attacker with a valid session can submit a request to the user creation functionality exposed through /api/user/add.php to create new a… |
CVE-2026-71368 | Medium | 6.1 | 2026-08-20 | F-RevoCRM contains a cross-site scripting vulnerability. If a user views a crafted page while logged in to the affected product, unintended operations may be p… |
CVE-2026-74992 | Medium | 6.8 | 2026-08-20 | The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users with the Editor role, and does not remove… |
CVE-2026-19697 | Medium | 6.8 | 2026-08-20 | The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload cap… |
CVE-2026-19615 | Medium | 6.8 | 2026-08-20 | The Admin and Site Enhancements (ASE) WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every route it accepts them through, allowing users… |
CVE-2026-17153 | Medium | 5.3 | 2026-08-20 | The AI Agent by SiteGround plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.7. This is due to the plugin no… |
CVE-2026-13405 | Medium | 6.6 | 2026-08-20 | The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later exe… |
CVE-2026-76957 | Medium | 4.9 | 2026-08-20 | libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-502… |
CVE-2026-76956 | Medium | 5.9 | 2026-08-20 | In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to has… |
CVE-2026-76800 | Medium | 6.3 | 2026-08-20 | A flaw has been found in DeDeCMS 3. Affected by this vulnerability is an unknown functionality of the file /include/dialog/select_media_post.php. Executing a m… |
CVE-2026-76799 | Medium | 5.3 | 2026-08-20 | A weakness has been identified in code-projects Login Registration System 1.0. This affects an unknown function of the file /loginsystem/database/login_registr… |
CVE-2026-76785 | Medium | 6.3 | 2026-08-20 | A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System 0.1. Affected is the function Transaction::getAll of the file appli… |
CVE-2026-75628 | Medium | 5.7 | 2026-08-20 | Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same_origin_path accepts a backslash or tab in the re… |
CVE-2022-4996 | Medium | 5.3 | 2026-08-20 | A flaw has been found in mruby 3.1.0. Affected is the function udiv of the file bigint.c. Executing a manipulation can lead to floating point comparison with i… |
CVE-2026-76929 | Medium | 4.7 | 2026-08-19 | Pcapng file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service |
CVE-2026-76927 | Medium | 4.7 | 2026-08-19 | H.245 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service |
CVE-2026-76924 | Medium | 5.5 | 2026-08-19 | Kerberos protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service |
CVE-2026-76923 | Medium | 5.5 | 2026-08-19 | Bluetooth HFP Profile protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service |
CVE-2026-76922 | Medium | 5.5 | 2026-08-19 | Bluetooth BR/EDR FHS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service |
CVE-2026-76921 | Medium | 5.5 | 2026-08-19 | CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service |
CVE-2026-76920 | Medium | 4.7 | 2026-08-19 | 3gpp phone log file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service |
CVE-2026-76919 | Medium | 5.3 | 2026-08-19 | ESS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service |
CVE-2026-76918 | Medium | 5.5 | 2026-08-19 | SSH protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service |
CVE-2026-76917 | Medium | 5.5 | 2026-08-19 | Bluetooth AVRCP Profile protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service |
CVE-2026-76889 | Medium | 4.7 | 2026-08-19 | UMTS FP protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service |
CVE-2026-76883 | Medium | 4.7 | 2026-08-19 | Catapult DCT2000 file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service |
CVE-2026-76882 | Medium | 4.7 | 2026-08-19 | Bluetooth Attribute Protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service |
CVE-2026-76881 | Medium | 4.7 | 2026-08-19 | CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service |
CVE-2026-76405 | Medium | 4.3 | 2026-08-19 | In Splunk On-Call (VictorOps) app versions below 1.0.43 on Splunkbase, a user who does not hold the "admin" or "power" Splunk roles could read a partially mask… |
CVE-2026-76401 | Medium | 5.9 | 2026-08-19 | In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer (REST) API could conf… |
CVE-2026-76400 | Medium | 5.9 | 2026-08-19 | In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer (REST) API and influe… |
CVE-2026-76398 | Medium | 4.3 | 2026-08-19 | In Splunk AI Toolkit versions below 6.0.1, a user who does not hold the "admin" or "power" Splunk roles could delete the experiment history of another user wit… |
CVE-2026-76393 | Medium | 5.9 | 2026-08-19 | In Splunk AI Toolkit versions below 6.0.0, a user who can upload models could overwrite a model being uploaded by another user by sending a concurrent upload r… |
CVE-2026-76392 | Medium | 5.4 | 2026-08-19 | In Splunk AI Toolkit versions below 6.0.0, a user who does not hold the "admin" or "power" Splunk roles could obtain predictable or default credentials for con… |
CVE-2026-76390 | Medium | 5.3 | 2026-08-19 | In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthenticated user could access the add-on OpenAPI specification through S… |
CVE-2026-76386 | Medium | 4.3 | 2026-08-19 | In versions below 3.2.2 of the Zoom app for Splunk SOAR, a user who holds a role with permission to run actions could expose meeting and personal meeting ID pa… |
CVE-2026-76385 | Medium | 4.3 | 2026-08-19 | In versions below 2.1.4 of the Venafi app for Splunk SOAR, a user who holds a role with permission to run actions could expose keystore and private-key passwor… |
CVE-2026-76384 | Medium | 4.3 | 2026-08-19 | In versions below 2.2.1 of the Splunk Attack Analyzer Connector for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitiv… |
CVE-2026-76383 | Medium | 4.3 | 2026-08-19 | In versions below 1.0.5 of the RSA SecurID Authentication Manager app for Splunk SOAR, a user who holds a role with permission to run actions could expose a se… |
CVE-2026-76382 | Medium | 4.3 | 2026-08-19 | In versions below 3.8.5 of the Phantom app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive archive password by… |
CVE-2026-76381 | Medium | 4.3 | 2026-08-19 | In versions below 1.5.2 of the MS Graph for Active Directory app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensiti… |
CVE-2026-76380 | Medium | 4.3 | 2026-08-19 | In versions below 5.1.3 of the CrowdStrike OAuth API app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive docum… |
CVE-2026-76379 | Medium | 4.3 | 2026-08-19 | In versions below 2.2.1 of the Cisco Webex app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive meeting passwor… |
CVE-2026-76378 | Medium | 4.3 | 2026-08-19 | In versions below 2.4.5 of the Cisco Secure Malware Analytics app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensit… |
CVE-2026-76377 | Medium | 4.3 | 2026-08-19 | In versions below 2.5.3 of the Azure AD Graph app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive password by… |
CVE-2026-76376 | Medium | 4.3 | 2026-08-19 | In versions below 2.1.9 of the AWS IAM app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive AWS credentials by in… |
CVE-2026-76375 | Medium | 5.0 | 2026-08-19 | In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive credentials by invoki… |
CVE-2026-76374 | Medium | 4.3 | 2026-08-19 | In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could cause sensitive Active Directory respo… |
CVE-2026-76373 | Medium | 5.4 | 2026-08-19 | In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could inject crafted input into an Active Di… |
CVE-2026-76372 | Medium | 6.6 | 2026-08-19 | In Nmap Scanner versions below 3.0.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the scan network action in a Sa… |
CVE-2026-76370 | Medium | 4.3 | 2026-08-19 | In Splunk SOAR versions below 8.6.0, an authenticated user with restricted tenant access could use the Representational State Transfer (REST) API to view the n… |
CVE-2026-76367 | Medium | 4.0 | 2026-08-19 | In Splunk SOAR versions below 8.6.0, a user who holds the "Incident Commander" Splunk SOAR role could store JavaScript in a note and run it in the browser of a… |
CVE-2026-76366 | Medium | 6.5 | 2026-08-19 | In Splunk SOAR versions below 8.6.0, a user with a valid Splunk SOAR account could use Representational State Transfer (REST) API filtering on playbook runs to… |
CVE-2026-76365 | Medium | 6.5 | 2026-08-19 | In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" Splunk SOAR role could run arbitrary Structured Query Language (SQL) statements… |