Medium-severity CVEs (page 62)
Page 62 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-8636 | Medium | 5.5 | 2026-06-22 | IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 allows an attacker to retrieve user passwords and cryptographic keys from… |
CVE-2026-8059 | Medium | 6.1 | 2026-06-22 | IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 is vulnerable to cross-site scripting. This vulnerability allows an unaut… |
CVE-2026-7253 | Medium | 6.0 | 2026-06-22 | IBM Sterling B2B Integrator and IBM Sterling File Gateway are vulnerable to SQL injection. A privileged user could send specially crafted SQL statements, which… |
CVE-2026-54267 | Medium | 6.1 | 2026-06-22 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, a… |
CVE-2026-54266 | Medium | 6.1 | 2026-06-22 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, a… |
CVE-2026-54265 | Medium | 6.1 | 2026-06-22 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, a… |
CVE-2026-54264 | Medium | 6.1 | 2026-06-22 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, a… |
CVE-2026-53655 | Medium | 5.5 | 2026-06-22 | node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next… |
CVE-2026-53550 | Medium | 5.3 | 2026-06-22 | js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key… |
CVE-2026-52725 | Medium | 6.1 | 2026-06-22 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2… |
CVE-2026-50557 | Medium | 6.1 | 2026-06-22 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2… |
CVE-2026-41047 | Medium | 5.5 | 2026-06-22 | Lack of authentication when using the "snapshot diff" functions in qSnapper before version 1.3.3 allowed a local attacker to see otherwise read protected infor… |
CVE-2026-12725 | Medium | 5.9 | 2026-06-22 | A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing unsupp… |
CVE-2026-12549 | Medium | 4.8 | 2026-06-22 | The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed comparison. When a client se… |
CVE-2026-12479 | Medium | 6.1 | 2026-06-22 | A path traversal vulnerability exists in keras-team/keras version 3.14.0, specifically in the `DiskIOStore.make` method within the Keras 3 model saving and loa… |
CVE-2026-11372 | Medium | 5.4 | 2026-06-22 | IBM TRIRIGA Application Platform 5.0.2 through 5.0.3 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary… |
CVE-2024-51454 | Medium | 6.5 | 2026-06-22 | IBM Engineering Workflow Management 7.0.2 through 7.0.2 Interim Fix 035, 7.0.3 through 7.0.3 Interim Fix 017, and 7.1 through 7.1 Interim Fix 004 is vulnerable… |
CVE-2023-33854 | Medium | 5.3 | 2026-06-22 | IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, and 5.3 could allow an authenticated user to bypass client-s… |
CVE-2026-9162 | Medium | 4.3 | 2026-06-22 | Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to invalidate cached authentication state for active WebSock… |
CVE-2026-6673 | Medium | 6.4 | 2026-06-22 | Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to authenticate Atlassian Connect installed callbacks, allow… |
CVE-2026-6062 | Medium | 6.4 | 2026-06-22 | Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 Fail to validate channel ownership of an existing subscription be… |
CVE-2026-5139 | Medium | 5.4 | 2026-06-22 | Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to enforce administrator authorization on the {{setDefaultIn… |
CVE-2026-10601 | Medium | 5.4 | 2026-06-22 | A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on… |
CVE-2025-33128 | Medium | 5.4 | 2026-06-22 | IBM Engineering Workflow Management 7.0.3 through 7.0.3 Interim Fix 020, and 7.1 through 7.1 Interim Fix 007 is vulnerable to cross-site scripting. This vulner… |
CVE-2025-2669 | Medium | 6.0 | 2026-06-22 | IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, 5.3 could allow a privileged user to perform operations and… |
CVE-2024-54178 | Medium | 6.5 | 2026-06-22 | IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8,5.0,5.1,5.2,5.3 could allow an authenticated user to cause a denial of servi… |
CVE-2026-12580 | Medium | 5.4 | 2026-06-22 | EasyFlow .NET developed by Digiwin has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote attackers to inject persistent JavaScript cod… |
CVE-2026-54665 | Medium | 5.3 | 2026-06-22 | Apache NiFi 0.0.1 through 2.9.0 support building qualified URLs from one of several HTTP request headers that provide an alternative to the standard Host heade… |
CVE-2026-44911 | Medium | 6.3 | 2026-06-22 | Authorization handling for component configuration verification requests in Apache NiFi 1.15.0 through 2.9.0 allows clients with read access to submit proposed… |
CVE-2025-62198 | Medium | 5.4 | 2026-06-22 | An authenticated user can perform XSS. This issue affects Apache Atlas versions 2.4.0 and earlier. Users are recommended to upgrade to version 2.5.0, which f… |
CVE-2026-7859 | Medium | 5.3 | 2026-06-22 | The Motors WordPress plugin before 1.4.110 does not have proper authorisation and CSRF checks on one of its AJAX actions, allowing unauthenticated attackers t… |
CVE-2026-4110 | Medium | 6.1 | 2026-06-22 | The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outputting it back in the page, leading to… |
CVE-2026-10530 | Medium | 5.3 | 2026-06-22 | The Pie Register WordPress plugin before 3.8.4.10 does not use sufficiently random values when generating its account verification tokens, allowing unauthenti… |
CVE-2026-12822 | Medium | 5.3 | 2026-06-22 | A vulnerability was identified in langflow-ai langflow up to 1.9.3. This affects an unknown function of the component Bundle URL Loader. The manipulation leads… |
CVE-2026-12821 | Medium | 6.3 | 2026-06-22 | A vulnerability was determined in FlowiseAI Flowise up to 3.1.2. The impacted element is an unknown function of the file packages/components/nodes/documentload… |
CVE-2026-12815 | Medium | 6.3 | 2026-06-22 | A vulnerability has been found in coollabsio coolify 4.0.0. Impacted is an unknown function of the component Image Name Handler. Such manipulation leads to os… |
CVE-2026-12814 | Medium | 6.3 | 2026-06-21 | A flaw has been found in Comfast CF-WR631AX V3 up to 2.7.0.8. This issue affects the function system of the file /cgi-bin/mbox-config?section=ping_config of th… |
CVE-2026-12813 | Medium | 6.3 | 2026-06-21 | A vulnerability was detected in activepieces up to 0.83.0. This vulnerability affects the function handleUrlFile in the library packages/server/engine/src/lib/… |
CVE-2026-12811 | Medium | 4.3 | 2026-06-21 | A weakness has been identified in kortix-ai suna up to 0.8.38. Affected by this issue is the function router.replace/router.push of the file apps/frontend/src/… |
CVE-2026-12810 | Medium | 6.3 | 2026-06-21 | A security flaw has been discovered in Edimax BR-6478AC V2 1.23. Affected by this vulnerability is the function mp of the file /goform/mp of the component POST… |
CVE-2026-12809 | Medium | 6.3 | 2026-06-21 | A vulnerability was identified in Edimax BR-6478AC V2 1.23. Affected is the function wiz_5in1_redirect of the file /goform/wiz_5in1_redirect of the component P… |
CVE-2026-12808 | Medium | 6.3 | 2026-06-21 | A vulnerability was determined in Edimax BR-6478AC V2 1.23. This impacts the function stainfo of the file /goform/stainfo of the component POST Request Handler… |
CVE-2026-12807 | Medium | 6.3 | 2026-06-21 | A vulnerability was found in Edimax BR-6478AC V2 1.23. This affects the function setWAN of the file /goform/setWAN of the component POST Request Handler. The m… |
CVE-2026-12805 | Medium | 6.3 | 2026-06-21 | A flaw has been found in OFFIS DCMTK up to 3.7.0. The affected element is the function XMLNode::parseFile in the library ofstd/libsrc/ofxml.cc. Executing a man… |
CVE-2026-12804 | Medium | 4.3 | 2026-06-21 | A vulnerability was detected in lemonldap-ng up to 2.23.0. Impacted is an unknown function in the library lemonldap-ng-portal/lib/Lemonldap/NG/Portal/CDC.pm of… |
CVE-2026-56412 | Medium | 4.9 | 2026-06-21 | libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers… |
CVE-2026-56411 | Medium | 6.9 | 2026-06-21 | xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations. |
CVE-2026-56410 | Medium | 6.9 | 2026-06-21 | xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId. |
CVE-2026-56409 | Medium | 6.5 | 2026-06-21 | xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used. |
CVE-2026-56408 | Medium | 6.9 | 2026-06-21 | libexpat before 2.8.2 has an integer overflow in copyString. |
CVE-2026-56407 | Medium | 6.9 | 2026-06-21 | libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen. |
CVE-2026-56406 | Medium | 6.9 | 2026-06-21 | libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse. |
CVE-2026-56405 | Medium | 6.9 | 2026-06-21 | libexpat before 2.8.2 has an integer overflow in getAttributeId. |
CVE-2026-56404 | Medium | 6.9 | 2026-06-21 | libexpat before 2.8.2 has an integer overflow in addBinding. |
CVE-2026-56403 | Medium | 6.9 | 2026-06-21 | libexpat before 2.8.2 has an integer overflow in storeAtts. |
CVE-2026-56394 | Medium | 6.5 | 2026-06-21 | Craft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability in the assets/icon endpoint where the extension parameter is not validated befo… |
CVE-2026-56393 | Medium | 4.8 | 2026-06-21 | Craft CMS 4.x (>= 4.0.0-RC1, < 4.17.0-beta.1) and 5.x (>= 5.0.0-RC1, < 5.9.0-beta.1) contain multiple stored cross-site scripting vulnerabilities where setting… |
CVE-2026-56385 | Medium | 4.3 | 2026-06-21 | Craft CMS versions >= 5.0.0-RC1, <= 5.9.13 and >= 4.0.0-RC1, <= 4.17.7 contain an authorization bypass in the assets/preview-file endpoint. The action does not… |
CVE-2026-56384 | Medium | 4.3 | 2026-06-21 | Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint. A Control Panel user without permission to view a target private… |
CVE-2026-56383 | Medium | 4.8 | 2026-06-21 | Craft CMS contains a stored cross-site scripting (XSS) vulnerability in the editableTable.twig component when using the 'Row Heading' column type. The applicat… |
CVE-2026-56381 | Medium | 4.8 | 2026-06-21 | Craft CMS from version 5.0.0-RC1 contains a stored cross-site scripting vulnerability in the User Permissions page where user group names are rendered without… |
CVE-2026-56316 | Medium | 5.3 | 2026-06-21 | Cap-go before 12.128.2 contains an information disclosure vulnerability in the OPTIONS /build/upload/:jobId/* endpoint that allows unauthenticated attackers to… |
CVE-2026-56299 | Medium | 5.3 | 2026-06-21 | Capgo before 12.128.2 contains an authentication bypass vulnerability in the /build/upload/:jobId/* endpoint that allows unauthenticated attackers to trigger c… |
CVE-2026-56251 | Medium | 6.5 | 2026-06-21 | Capgo before 12.128.2 contains a broken row level security policy in the org_users table that allows authenticated users to elevate privileges from admin to su… |
CVE-2026-56236 | Medium | 6.1 | 2026-06-21 | Capgo CLI before 12.128.2 contains arbitrary file overwrite vulnerabilities in login and build credentials operations that follow symlinks without validation… |
CVE-2026-56229 | Medium | 6.5 | 2026-06-21 | Capgo before 12.128.2 contains an authorization bypass vulnerability in the /build/status and /build/logs endpoints that allows attackers to access build jobs… |
CVE-2026-12799 | Medium | 4.3 | 2026-06-21 | A security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this issue is the function ui_view_users of the file litellm/proxy/mana… |
CVE-2026-12798 | Medium | 6.3 | 2026-06-21 | A weakness has been identified in BerriAI litellm up to 1.82.2. Affected by this vulnerability is the function load_openapi_spec_async of the file litellm/prox… |
CVE-2026-12797 | Medium | 6.3 | 2026-06-21 | A security flaw has been discovered in BerriAI litellm up to 1.82.5. Affected is the function async_pre_call_hook of the file enterprise/enterprise_hooks/banne… |
CVE-2026-12796 | Medium | 6.3 | 2026-06-21 | A vulnerability was identified in BerriAI litellm up to 1.82.2. This impacts the function get_redirect_response_from_openid of the file litellm/proxy/managemen… |
CVE-2026-12789 | Medium | 4.7 | 2026-06-21 | A vulnerability was identified in ILIAS Learning Management System 11.0. This issue affects the function ilTrQuery::executeQueries of the file components/ILIAS… |
CVE-2026-12788 | Medium | 6.3 | 2026-06-21 | A vulnerability was determined in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. This vulnerability affects unknown code of the file /… |
CVE-2026-12787 | Medium | 6.3 | 2026-06-21 | A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. This affects an unknown part of the component testConnecti… |
CVE-2026-12776 | Medium | 6.3 | 2026-06-21 | A flaw has been found in Montodel House-Rental-Management up to 90010017b81265eb1ef3810268909f7719a33863. This affects an unknown part of the file /index.php?p… |
CVE-2026-12774 | Medium | 6.3 | 2026-06-21 | A security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this vulnerability is the function _execute_with_mcp_client of the file… |
CVE-2026-12772 | Medium | 6.3 | 2026-06-21 | A security flaw has been discovered in BerriAI litellm up to 1.82.2. This impacts the function authenticate_user of the file litellm/proxy/auth/login_utils.py… |
CVE-2026-12771 | Medium | 5.0 | 2026-06-21 | A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/user_api_key_auth.py of the com… |
CVE-2026-12770 | Medium | 5.4 | 2026-06-21 | A vulnerability was determined in BerriAI litellm up to 1.63.1. The impacted element is an unknown function of the file litellm/proxy/management_endpoints/key_… |
CVE-2026-56347 | Medium | 6.1 | 2026-06-20 | AVideo TopMenu plugin through version 26.0 contains a stored cross-site scripting vulnerability in menu item rendering due to missing output encoding of icon c… |
CVE-2026-56346 | Medium | 6.5 | 2026-06-20 | AVideo through version 25.0 contains an authentication bypass vulnerability in the decryptMessage.json.php endpoint that allows unauthenticated users to decryp… |
CVE-2026-56342 | Medium | 6.8 | 2026-06-20 | AVideo through version 27.0 contains a server-side request forgery vulnerability in plugin/Live/test.php that allows authenticated administrators to read arbit… |
CVE-2025-71379 | Medium | 4.3 | 2026-06-20 | vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities. Several regex patterns — in vllm/lora/utils.p… |
CVE-2026-56332 | Medium | 4.7 | 2026-06-20 | Capgo before 12.128.2 contains an open redirect vulnerability in the confirm-signup endpoint that allows attackers to redirect users to arbitrary external webs… |
CVE-2026-56319 | Medium | 4.3 | 2026-06-20 | Capgo before 12.128.2 contains an information disclosure vulnerability in the GET /statistics/app/:app_id endpoint that allows app-limited API keys to distingu… |
CVE-2026-56317 | Medium | 6.1 | 2026-06-20 | Nuxt before 4.4.7 (and the 3.x branch before 3.21.7) contains a cross-site scripting vulnerability in the NoScript component that writes slot content to innerH… |
CVE-2026-56307 | Medium | 4.3 | 2026-06-20 | Cap-go before 12.128.12 contains a broken cursor pagination vulnerability in the /private/devices endpoint on the Cloudflare/workerd path that allows authentic… |
CVE-2026-56304 | Medium | 6.5 | 2026-06-20 | picklescan before 1.0.1 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to create arbitrary zero-byte files via logg… |
CVE-2026-56295 | Medium | 6.3 | 2026-06-20 | Capgo before 12.128.2 contains an authorization bypass vulnerability in webhook management endpoints that allows non-expiring API keys to bypass the require_ap… |
CVE-2026-56294 | Medium | 4.8 | 2026-06-20 | capacitor-native-biometric before 12.128.2 contains an authentication bypass vulnerability where the onAuthenticationSucceeded() method fails to validate Crypt… |
CVE-2026-56282 | Medium | 5.3 | 2026-06-20 | Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /replication endpoint that exposes internal PostgreSQL replicatio… |
CVE-2026-56235 | Medium | 5.3 | 2026-06-20 | Cap-go capgo before 12.128.2 contains an authorization bypass in several Supabase PostgREST RPC functions (get_app_metrics, get_global_metrics, get_total_metri… |
CVE-2026-56228 | Medium | 4.9 | 2026-06-20 | Capgo before 12.128.2 fails to enforce a maximum value on the minimum password length field in its password policy configuration. An authenticated organization… |
CVE-2026-56227 | Medium | 5.4 | 2026-06-20 | Capgo before 12.128.2 contains a server-side request forgery vulnerability in webhook URL validation that allows loopback and internal addresses. Organization… |
CVE-2026-56218 | Medium | 5.3 | 2026-06-20 | Capgo before 12.128.2 fails to strip EXIF metadata including GPS geolocation data from uploaded images, allowing information disclosure. Attackers can download… |
CVE-2025-71331 | Medium | 6.1 | 2026-06-20 | Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient input filtering in chat messages and custom agent functions. An… |
CVE-2026-12119 | Medium | 6.5 | 2026-06-20 | The Simple File List plugin for WordPress is vulnerable to unauthorized file operations due to a missing authorization check on the 'frontmanage' shortcode att… |
CVE-2026-56213 | Medium | 5.3 | 2026-06-20 | Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.upsert_version_meta SECURITY DEFINER function exposed via PostgREST RPC, all… |
CVE-2026-56080 | Medium | 4.9 | 2026-06-19 | Capgo before 12.128.2 contains a flaw in the Enforce Password Policy feature: after a Super Admin enables the policy and successfully changes their password to… |
CVE-2026-56079 | Medium | 6.5 | 2026-06-19 | Capgo before 12.128.2 contains a cross-tenant authorization bypass vulnerability in PostgREST endpoints that allows org-scoped read API keys to access other te… |
CVE-2026-50519 | Medium | 6.5 | 2026-06-19 | Initialization of a resource with an insecure default in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a n… |