Medium-severity CVEs (page 63)
Page 63 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-49337 | Medium | 4.3 | 2026-06-19 | libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted sequence of H.265 NAL units causes `decoder_context::rea… |
CVE-2026-48129 | Medium | 6.5 | 2026-06-19 | Kestra is an open-source, event-driven orchestration platform. Prior to versions 1.3.19, 1.2.19, 1.1.19, and 1.0.43, Kestra task `inputFiles` writes rendered f… |
CVE-2026-42895 | Medium | 6.5 | 2026-06-19 | Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering o… |
CVE-2026-49342 | Medium | 5.3 | 2026-06-19 | YARD is a documentation generation tool for the Ruby programming language. Prior to version 0.9.44, YARD's static cache lookup reads a request path before the… |
CVE-2026-49288 | Medium | 4.3 | 2026-06-19 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, an authenticated Control Panel user could view metadata and… |
CVE-2026-27878 | Medium | 6.5 | 2026-06-19 | A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive amount of memory, resulting in an out-… |
CVE-2026-12726 | Medium | 6.3 | 2026-06-19 | A flaw was found in the AWX GitHub webhook integration. When processing GitHub pull_request webhooks, the controller stores the pull_request.statuses_url value… |
CVE-2026-12238 | Medium | 5.3 | 2026-06-19 | The WP Go Maps – Most Popular Map Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.1.01. This is due… |
CVE-2026-49359 | Medium | 6.5 | 2026-06-19 | PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` fetches the content of… |
CVE-2026-49271 | Medium | 6.5 | 2026-06-19 | libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.1, the uncompressed HEIF decoder validates explicit icef compressed-unit offs… |
CVE-2019-25760 | Medium | 6.2 | 2026-06-19 | Joomla! Component Easy Shop 1.2.3 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by supplying base… |
CVE-2026-3196 | Medium | 5.5 | 2026-06-19 | An integer overflow vulnerability was found in the virtio-snd device via PCM_INFO requests from the guest. A malicious guest can provide out-of-bounds stream c… |
CVE-2026-12622 | Medium | 5.4 | 2026-06-19 | The GridTime 3000 GNSS Time Server has an open redirect vulnerability in the password change form submission. This issue affects GridTime 3000: from 1.0r0.03… |
CVE-2026-12621 | Medium | 5.4 | 2026-06-19 | Improper neutralization of input during web page generation XSS vulnerability in the GridTime 3000 (password reset form) allows XSS. This issue affects GridT… |
CVE-2026-12620 | Medium | 6.5 | 2026-06-19 | The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints. This issue affects GridTime 3000: from 1.0r0.03 through 1.1… |
CVE-2026-12619 | Medium | 5.4 | 2026-06-19 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip GridTime 3000 allows Cross-Site Scriptin… |
CVE-2026-21768 | Medium | 6.3 | 2026-06-19 | The compose-rich-editor library (v1.0.0-rc14) used in HCL Verse for Android's rich text email composition fails to properly validate all HTML input thereby all… |
CVE-2026-49231 | Medium | 5.4 | 2026-06-19 | Authentication Bypass by Spoofing vulnerability in opa plugin. An attacker could relay spoofed identity headers to upstream capitalising on non-default config… |
CVE-2026-48141 | Medium | 5.3 | 2026-06-19 | There is a memory leak in NI grpc-device BeginSidebandStream that may result in denial of service due to memory exhaustion. This affects NI grpc-device 2.17.0… |
CVE-2026-48140 | Medium | 6.5 | 2026-06-19 | There is an unchecked enum cast vulnerability in NI grpc-device BeginSidebandStream that may allow an attacker to trigger invalid enum states and undefined beh… |
CVE-2026-47341 | Medium | 6.5 | 2026-06-19 | Authentication Bypass by Capture-replay vulnerability in Apache APISIX. Attacker can benefit from certain configurations in hmac-auth to re-use a token foreve… |
CVE-2026-44915 | Medium | 6.1 | 2026-06-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The default configuration of cas-auth in Apache APISIX is vulnerable to ph… |
CVE-2026-44046 | Medium | 5.8 | 2026-06-19 | Use of Less Trusted Source vulnerability in Apache APISIX. Attacker can take advantage of wolf-rbac plugin under default configuration to potentially pollute… |
CVE-2026-12706 | Medium | 6.5 | 2026-06-19 | A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but… |
CVE-2026-11941 | Medium | 5.6 | 2026-06-19 | Cloudflare Quiche was affected by 2 use-after-free vulnerabilities in the connection ID iterator FFI functions. The “quiche_connection_id_iter_next” and “qu… |
CVE-2026-6798 | Medium | 5.3 | 2026-06-19 | The 2Download Connector for 2DL Hosted Checkout plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 0.1.5. This is… |
CVE-2026-3640 | Medium | 5.3 | 2026-06-19 | The STRABL – A checkout solution plugin for WordPress is vulnerable to Missing Authentication in all versions up to and including 4.5. The plugin registers a R… |
CVE-2026-9822 | Medium | 6.5 | 2026-06-19 | The WP Hotel Booking WordPress plugin before 2.3.1 does not enforce capability checks in several of its AJAX handlers, allowing authenticated users with Subscr… |
CVE-2026-9013 | Medium | 4.3 | 2026-06-19 | The Bogo plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the bogo_rest_create_post_transla… |
CVE-2026-8118 | Medium | 6.5 | 2026-06-19 | The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Arbitrary File Read in versions 1.7.1058 through… |
CVE-2026-7547 | Medium | 4.9 | 2026-06-19 | The Woosa – Marktplaats for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in versions up to and including 2.0.4. Thi… |
CVE-2026-56132 | Medium | 6.9 | 2026-06-19 | In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there… |
CVE-2026-56131 | Medium | 4.9 | 2026-06-19 | libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-fr… |
CVE-2026-4328 | Medium | 6.4 | 2026-06-19 | The Advanced Import plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.6. This is due to the plugin us… |
CVE-2026-1856 | Medium | 6.4 | 2026-06-19 | The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom booking field labels in all versions up to, and i… |
CVE-2026-12644 | Medium | 5.3 | 2026-06-19 | Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.prototype methods (such… |
CVE-2026-12430 | Medium | 4.4 | 2026-06-19 | The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1.45 due to… |
CVE-2026-12157 | Medium | 6.4 | 2026-06-19 | The BetterDocs - Knowledge Base Docs & FAQ Solution for Elementor & Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bloc… |
CVE-2026-11989 | Medium | 6.5 | 2026-06-19 | The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Server-Side Request Forgery i… |
CVE-2026-10779 | Medium | 4.3 | 2026-06-19 | The Classified Listing – Classified ads & Business Directory plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including… |
CVE-2026-10034 | Medium | 5.3 | 2026-06-19 | The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.39. This is due to the plugin no… |
CVE-2026-11775 | Medium | 4.3 | 2026-06-19 | The User Admin Simplifier plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.0. This is due to missing… |
CVE-2026-52866 | Medium | 6.5 | 2026-06-19 | An attacker within BLE communication range can monopolize the device's only available BLE connection slot, preventing legitimate users or applications from e… |
CVE-2026-50034 | Medium | 6.5 | 2026-06-19 | An attacker within BLE communication range can passively intercept wireless traffic and obtain sensitive health-related information, including glucose measur… |
CVE-2026-12050 | Medium | 4.3 | 2026-06-19 | SQL injection in pgAdmin 4's named restore point endpoint (POST /browser/server/restore_point/{gid}/{sid}). The user-supplied 'value' field was interpolated di… |
CVE-2026-12049 | Medium | 4.3 | 2026-06-19 | Open redirect in pgAdmin 4's multi-factor authentication flow. The MFA validate and register endpoints honoured the user-supplied 'next' query/form parameter w… |
CVE-2026-56077 | Medium | 6.5 | 2026-06-18 | PraisonAI before 1.5.115 contains an information disclosure vulnerability in the MultiAgentLedger component that allows attackers to access sensitive data by r… |
CVE-2026-56074 | Medium | 5.5 | 2026-06-18 | PraisonAI before 1.5.128 caches tool approval decisions by tool name only, not by invocation arguments, allowing subsequent execute_command calls to bypass app… |
CVE-2026-49205 | Medium | 6.5 | 2026-06-18 | phpMyFAQ is an open source FAQ web application. Versions prior to 4.1.4 have Missing Authorization in the API CategoryController. CVE-2026-24421 addressed thi… |
CVE-2026-22674 | Medium | 4.8 | 2026-06-18 | Hashgraph Guardian through 3.6.0, fixed in commit ba8c566, contains a stored cross-site scripting vulnerability that allows authenticated users with the STANDA… |
CVE-2026-45696 | Medium | 6.5 | 2026-06-18 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.1… |
CVE-2026-44663 | Medium | 6.1 | 2026-06-18 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.1… |
CVE-2025-15661 | Medium | 6.5 | 2026-06-18 | libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a m… |
CVE-2026-56099 | Medium | 5.3 | 2026-06-18 | OpenBSD before commit 6a23123 (2026-06-18) contains an out-of-bounds read vulnerability in the mpls_do_error function within sys/netmpls/mpls_input.c that allo… |
CVE-2026-48983 | Medium | 5.8 | 2026-06-18 | pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, a symlink race condition exists in per-device an… |
CVE-2026-48982 | Medium | 5.8 | 2026-06-18 | pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, when updating a one-time pad file, a temporary f… |
CVE-2026-48981 | Medium | 6.7 | 2026-06-18 | pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, pam_usb calls xmlReadFile() with flags=0 when lo… |
CVE-2026-48980 | Medium | 6.3 | 2026-06-18 | pam_usb provides hardware authentication for Linux using removable media. In versions prior to 0.9.2, getenv() environment variables XRDP_SESSION, DISPLAY and… |
CVE-2026-47847 | Medium | 5.3 | 2026-06-18 | Bitnami MariaDB Galera container images and Helm chart are affected by a hardcoded default credential vulnerability in the Galera replication health-check user… |
CVE-2026-43915 | Medium | 5.4 | 2026-06-18 | Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.11.0 contain a stored cross-site scripting (XSS) vulnerability in the… |
CVE-2026-9692 | Medium | 5.3 | 2026-06-18 | Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely. The default session id generator returns a SHA-1 hash seeded w… |
CVE-2026-55392 | Medium | 5.5 | 2026-06-18 | NILFS utilities through 2.3.0, fixed in commit 26efb5d, nilfs_sb_is_valid() function fails to validate s_log_block_size field in NILFS2 superblock before bit-s… |
CVE-2026-48937 | Medium | 5.3 | 2026-06-18 | A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects two supported rele… |
CVE-2026-47833 | Medium | 6.1 | 2026-06-18 | setupBpmLogs follows symlink for bpm.log open and chown — container-to-host privilege escalation via /etc/shadow. A compromised process inside a bpm container… |
CVE-2026-48986 | Medium | 4.7 | 2026-06-18 | pam_usb provides hardware authentication for Linux using removable media. In pam_usb 0.9.1 and earlier, usb_get_process_parent_id() can cause an infinite loop… |
CVE-2026-48985 | Medium | 5.5 | 2026-06-18 | pam_usb provides hardware authentication for Linux using ordinary removable media. In versions 0.9.1 and below, pusb_is_loginctl_local() can cause a NULL deref… |
CVE-2026-48984 | Medium | 4.7 | 2026-06-18 | pam_usb provides hardware authentication for Linux using ordinary removable media. In versions 0.9.1 and below, the xfree() memory release helper in calls free… |
CVE-2026-56024 | Medium | 6.5 | 2026-06-18 | Cross-Site Request Forgery (CSRF) vulnerability in Saad Iqbal WP EasyPay allows Cross Site Request Forgery. This issue affects WP EasyPay: from n/a through 4… |
CVE-2026-56022 | Medium | 5.3 | 2026-06-18 | Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, allowing bypass of additional MFA requir… |
CVE-2026-56021 | Medium | 5.3 | 2026-06-18 | Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due to a bypassable regex pattern. |
CVE-2026-55205 | Medium | 5.3 | 2026-06-18 | Hermes WebUI before 0.51.468 contains a resource exhaustion vulnerability in the unauthenticated POST /api/onboarding/oauth/start endpoint that allows unbounde… |
CVE-2026-54106 | Medium | 4.7 | 2026-06-18 | The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing S… |
CVE-2026-54105 | Medium | 5.3 | 2026-06-18 | The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing S… |
CVE-2026-22551 | Medium | 6.5 | 2026-06-18 | In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs with… |
CVE-2026-11791 | Medium | 5.0 | 2026-06-18 | A flaw was found in 389 Directory Server. During schema reload, the attr_syntax_swap_ht() function unconditionally frees attribute syntax information nodes, by… |
CVE-2025-58175 | Medium | 6.5 | 2026-06-18 | GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a GeoServer that uses `ENTITY_RESO… |
CVE-2026-56009 | Medium | 5.9 | 2026-06-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bricksable for Bricks Builder allows Stored XSS. This is… |
CVE-2026-56007 | Medium | 5.9 | 2026-06-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OceanWP Ocean Product Sharing allows Stored XSS. This is… |
CVE-2026-44942 | Medium | 6.5 | 2026-06-18 | A path traversal in handling the "path" component of .repo files processed by libzypp before 17.38.13 in the 17.x series, or before 16.22.19 could be used by a… |
CVE-2026-42490 | Medium | 6.5 | 2026-06-18 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To create and manage guests… |
CVE-2026-42489 | Medium | 5.3 | 2026-06-18 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To create and manage guests… |
CVE-2026-8039 | Medium | 6.4 | 2026-06-18 | The Fancy Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' shortcode attribute in the 'testimonial' shortcode in… |
CVE-2026-2021 | Medium | 6.4 | 2026-06-18 | The Slideshow Gallery LITE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alwaysauto' shortcode attribute in all versions up to, an… |
CVE-2026-9815 | Medium | 6.5 | 2026-06-18 | The MagicForm WordPress plugin through 0.1.3 does not properly validate the type of files uploaded through an unauthenticated AJAX action when a form's per-fie… |
CVE-2026-55745 | Medium | 5.4 | 2026-06-18 | Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.ed… |
CVE-2026-28573 | Medium | 5.5 | 2026-06-18 | In AndroidManifest.xml, there is a possible persistent denial of service due to a missing permission check. This could lead to local denial of service with no… |
CVE-2026-12137 | Medium | 6.1 | 2026-06-18 | The SysBasics Customize My Account for WooCommerce – Dashboard, Endpoints, Avatar & Menu Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scr… |
CVE-2026-12136 | Medium | 6.4 | 2026-06-18 | The Customize My Account For Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sysbasics_user_avatar' shortcode in version… |
CVE-2026-12111 | Medium | 4.3 | 2026-06-18 | The Appointment Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.4.01. This is due to… |
CVE-2026-12098 | Medium | 6.4 | 2026-06-18 | The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'embed' Episode Meta Field in all versions up… |
CVE-2026-9199 | Medium | 4.3 | 2026-06-18 | The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress is vulnerable to authorization bypass in all versio… |
CVE-2026-12120 | Medium | 5.3 | 2026-06-18 | The FireBox Popups – Increase Sales and Grow Your Email List plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and in… |
CVE-2026-12093 | Medium | 5.3 | 2026-06-18 | The Simple Membership plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.7.5. This is due to the plugin not pro… |
CVE-2026-11784 | Medium | 4.3 | 2026-06-18 | The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in… |
CVE-2026-11777 | Medium | 4.9 | 2026-06-18 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'name' parameter… |
CVE-2026-11776 | Medium | 4.9 | 2026-06-18 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'groupids' param… |
CVE-2026-11402 | Medium | 6.4 | 2026-06-18 | The Services Section Block – Showcase Service Details in Grid or Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'link' Block Att… |
CVE-2026-11360 | Medium | 4.9 | 2026-06-18 | The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'sort_direction' parameter in all versions up to… |
CVE-2026-11358 | Medium | 4.4 | 2026-06-18 | The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi… |
CVE-2026-11357 | Medium | 4.3 | 2026-06-18 | The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and… |