Medium-severity CVEs (page 64)
Page 64 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-10736 | Medium | 4.9 | 2026-06-18 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions up to… |
CVE-2026-10623 | Medium | 4.3 | 2026-06-18 | The PressPrimer Quiz – AI Quiz Maker, Exam Builder & LMS Assessment Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versio… |
CVE-2026-10029 | Medium | 5.3 | 2026-06-18 | The Event Koi Lite – Events Calendar, Event Management, RSVP, and Tickets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions… |
CVE-2026-10023 | Medium | 4.3 | 2026-06-18 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Ob… |
CVE-2026-50267 | Medium | 4.7 | 2026-06-17 | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Configuration.Abstract… |
CVE-2026-50202 | Medium | 5.9 | 2026-06-17 | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Security.Authenticatio… |
CVE-2026-50201 | Medium | 6.5 | 2026-06-17 | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Management.Endpoint pr… |
CVE-2026-44646 | Medium | 5.3 | 2026-06-17 | LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, Context.spawn() creates a child Contex… |
CVE-2026-44645 | Medium | 6.5 | 2026-06-17 | LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the renderLimit option can be fully by… |
CVE-2026-44644 | Medium | 6.1 | 2026-06-17 | LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. Versions 10.25.7 and below are vulnerable to XSS through a flaw in th… |
CVE-2026-12568 | Medium | 6.5 | 2026-06-17 | The postman_download module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious works… |
CVE-2026-12565 | Medium | 5.3 | 2026-06-17 | The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of exter… |
CVE-2026-8049 | Medium | 5.3 | 2026-06-17 | In SignalRGB versions prior to 1.3.7.0, the \\.\SignalIo device object is created without an explicit SDDL security descriptor and without FILE_DEVICE_SECURE_O… |
CVE-2026-54386 | Medium | 6.1 | 2026-06-17 | marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page that allows unauthenticated attackers to inject arbitrary Jav… |
CVE-2026-48991 | Medium | 5.5 | 2026-06-17 | XianYuLauncher is a Minecraft Java Edition launcher. In versions prior to 1.5.5, sensitive authentication artifacts could be exposed during a user-initiated lo… |
CVE-2026-48990 | Medium | 5.3 | 2026-06-17 | joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions 1.3.4 through 1.6.5, jo… |
CVE-2026-49133 | Medium | 6.5 | 2026-06-17 | Typemill before 2.24.0 contains a path traversal vulnerability that allows authenticated attackers with Author-level privileges to read arbitrary files outside… |
CVE-2026-48988 | Medium | 5.3 | 2026-06-17 | markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^… |
CVE-2026-48821 | Medium | 5.8 | 2026-06-17 | Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a DOM-based Cross-Site Scripting (XSS) vulnerability in the Thumbnail Synchronizer… |
CVE-2026-55201 | Medium | 6.8 | 2026-06-17 | Evil-WinRM through 3.9, fixed in commit 6ecd570, contains a path traversal vulnerability in the download_dir() function that allows a rogue or compromised remo… |
CVE-2026-55199 | Medium | 5.9 | 2026-06-17 | libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c… |
CVE-2026-48823 | Medium | 4.8 | 2026-06-17 | Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a stored Cross-Site Scripting (XSS) vulnerability in the tag filtering functionali… |
CVE-2026-48822 | Medium | 5.8 | 2026-06-17 | Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a stored Cross-Site Scripting (XSS) vulnerability in the Markdown-to-HTML conversi… |
CVE-2026-48817 | Medium | 5.3 | 2026-06-17 | Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the… |
CVE-2026-32682 | Medium | 6.5 | 2026-06-17 | When NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remote attacker with permission to create or modify GRPCRoute resources can cause t… |
CVE-2026-10741 | Medium | 4.9 | 2026-06-17 | Sonatype Nexus Repository Manager before 3.93.0 contains an authorization vulnerability in the proxy repository configuration that allows a delegated repositor… |
CVE-2026-55198 | Medium | 6.5 | 2026-06-17 | Hermes WebUI before 0.51.443 contains an authorization bypass vulnerability in the session export endpoint that allows authenticated users to access sessions f… |
CVE-2026-55197 | Medium | 6.5 | 2026-06-17 | Hermes WebUI before 0.51.443 contains a broken access control vulnerability in the /api/session endpoint that allows authenticated users to disclose cross-prof… |
CVE-2026-53870 | Medium | 5.5 | 2026-06-17 | Hermes Agent before 0.16.0 creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644), exposing conversation history… |
CVE-2026-9679 | Medium | 5.9 | 2026-06-17 | Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into th… |
CVE-2026-9678 | Medium | 5.9 | 2026-06-17 | Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified p… |
CVE-2026-7300 | Medium | 6.5 | 2026-06-17 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Web Integration Service) allows Filter Failur… |
CVE-2026-2675 | Medium | 6.5 | 2026-06-17 | Missing Authentication for Critical Function vulnerability in RTI Connext Professional (Security Plugins) allows Fake the Source of Data.This issue affects Con… |
CVE-2026-20265 | Medium | 4.3 | 2026-06-17 | In Splunk AI Toolkit versions below 5.7.4, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cause the Splunk AI Toolkit to ma… |
CVE-2026-20178 | Medium | 4.3 | 2026-06-17 | A vulnerability in the browser-based version of Cisco Webex App could have allowed an unauthenticated, remote attacker to redirect users to a malicious webpage… |
CVE-2026-35069 | Medium | 5.7 | 2026-06-17 | Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnera… |
CVE-2026-20246 | Medium | 6.0 | 2026-06-17 | A vulnerability in the vmadmin CLI of Cisco Umbrella Virtual Appliance could allow an authenticated, local attacker to elevate privileges on an affected device… |
CVE-2026-20220 | Medium | 6.3 | 2026-06-17 | A vulnerability in the web-based management interface of Cisco Crosswork Network Controller could allow an authenticated, remote attacker to execute arbit… |
CVE-2026-1288 | Medium | 5.5 | 2026-06-17 | A maliciously crafted RFA file, when converted to FormIt via “Convert RFA to FormIt” in Autodesk Revit, can force a NULL Pointer Dereference vulnerability. Suc… |
CVE-2026-12515 | Medium | 4.3 | 2026-06-17 | A flaw was found in Katello's of Red Hat Satellite. A content upload functionality where insufficient authorization checks in the ContentUploadsController allo… |
CVE-2025-32748 | Medium | 4.3 | 2026-06-17 | Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) a Host Header Injection vulnerability. An unauthenticated attacker with remote access could pot… |
CVE-2026-55748 | Medium | 6.0 | 2026-06-17 | OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some p… |
CVE-2026-48142 | Medium | 4.8 | 2026-06-17 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content is served or proxied through a location block with bo… |
CVE-2026-48117 | Medium | 6.8 | 2026-06-17 | DroneAware is a drone detection platform. The centralized DroneAware server backing droneaware.io was vulnerable to an account pre-hijacking attack in which an… |
CVE-2026-40641 | Medium | 4.8 | 2026-06-17 | Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Use of a Broken or Risky Cryptographic Algorithm vulnerability. An unauthenticated attacker… |
CVE-2026-35162 | Medium | 4.3 | 2026-06-17 | Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Access Control vulnerability. A low privileged attacker with remote access could po… |
CVE-2026-35067 | Medium | 5.7 | 2026-06-17 | Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Access Control vulnerability. A low privileged attacker with adjacent network acces… |
CVE-2026-12528 | Medium | 5.4 | 2026-06-17 | A flaw was found in 389 Directory Server in the __aclp__normalize_acltxt() function of aclparse.c. A malformed ACI (Access Control Instruction) string can trig… |
CVE-2026-10850 | Medium | 5.4 | 2026-06-17 | Plane CE 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the description_html field when creating an intake work item through the A… |
CVE-2024-47477 | Medium | 6.5 | 2026-06-17 | Dell PowerFlex Manager, versions prior to 4.5.1.1, contain an improper certificate validation vulnerability. A remote unauthenticated attacker could potentiall… |
CVE-2026-54817 | Medium | 6.5 | 2026-06-17 | Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder MStore API allows Password Recovery Exploitation. This issue affects MSt… |
CVE-2026-52716 | Medium | 6.5 | 2026-06-17 | Unauthenticated Arbitrary File Deletion in WorkScout-Core <= 1.7.11 versions. |
CVE-2025-15657 | Medium | 5.3 | 2026-06-17 | Unauthenticated Insecure Direct Object References (IDOR) in School Management <= 93.1.0 versions. |
CVE-2026-8607 | Medium | 6.4 | 2026-06-17 | The Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin for WordPress is vulnerable to Stored Cross-Site Scri… |
CVE-2026-8494 | Medium | 6.4 | 2026-06-17 | The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in the admin URI Editor interface in all versions… |
CVE-2026-8383 | Medium | 5.3 | 2026-06-17 | The LearnPress WordPress plugin before 4.3.7 does not gate the `edit` context on one of its REST endpoint behind the `edit_users` capability, allowing unauthe… |
CVE-2026-7850 | Medium | 5.9 | 2026-06-17 | The WP Magnific Popup WordPress plugin through 1.0 does not properly escape user-controlled link URLs before injecting them into the DOM when displaying image… |
CVE-2026-55706 | Medium | 5.8 | 2026-06-17 | sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 076e2b1 allows authentication bypass via certain zero values for lengths. |
CVE-2026-54196 | Medium | 6.8 | 2026-06-17 | Subscriber Privilege Escalation in JetFormBuilder <= 3.6.1 versions. |
CVE-2026-49072 | Medium | 6.5 | 2026-06-17 | Unauthenticated Broken Access Control in WooCommerce Anti-Fraud <= 7.2.6 versions. |
CVE-2026-49071 | Medium | 6.5 | 2026-06-17 | Unauthenticated Broken Authentication in WooCommerce Dropshipping <= 5.2.4 versions. |
CVE-2026-48783 | Medium | 4.8 | 2026-06-17 | Postiz is an AI social media scheduling tool. Versions prior to 2.21.8 contained an unauthenticated endpoint that accepted a signed token and applied subscript… |
CVE-2026-48782 | Medium | 6.8 | 2026-06-17 | Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.56.0 through 1.101.0, 2.0.0b1, and 2.0.0b2, t… |
CVE-2026-47340 | Medium | 6.5 | 2026-06-17 | Allow authenticated users to access alert instances associated with alert groups they do not have permission to access. in Apache DolphinScheduler. This issue… |
CVE-2026-47277 | Medium | 6.5 | 2026-06-17 | Runtipi is a personal homeserver orchestrator. In versions 4.9.1 through 4.9.3, Runtipi serves marketplace app logos from files inside cloned app-store reposit… |
CVE-2026-45436 | Medium | 6.5 | 2026-06-17 | Subscriber Broken Access Control in WPBakery Page Builder <= 8.7.2 versions. |
CVE-2026-44587 | Medium | 4.7 | 2026-06-17 | CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3.1.3, the content_type_denylist check fails to escape regex… |
CVE-2026-42357 | Medium | 6.5 | 2026-06-17 | Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access. This i… |
CVE-2026-41280 | Medium | 4.9 | 2026-06-17 | Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects This issue affects Apache… |
CVE-2026-40724 | Medium | 6.5 | 2026-06-17 | CP Client Arbitrary File Download in Client Portal (Pro) <= 5.6.2 versions. |
CVE-2026-40723 | Medium | 4.3 | 2026-06-17 | Subscriber Broken Access Control in Bricks Builder <= 2.1.4 versions. |
CVE-2026-40722 | Medium | 5.5 | 2026-06-17 | Missing Authorization vulnerability in Yoast BV Yoast SEO Premium allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects… |
CVE-2026-39595 | Medium | 4.7 | 2026-06-17 | Author Broken Access Control in W3 Total Cache <= 2.9.1 versions. |
CVE-2026-39578 | Medium | 5.5 | 2026-06-17 | Unauthenticated PHP Object Injection in Valiance <= 1.2 versions. |
CVE-2026-39577 | Medium | 5.5 | 2026-06-17 | Unauthenticated PHP Object Injection in Playroom <= 1.4.1 versions. |
CVE-2026-39433 | Medium | 6.5 | 2026-06-17 | Subscriber Arbitrary Content Deletion in WPAMS < 49.5.3 versions. |
CVE-2026-2604 | Medium | 5.6 | 2026-06-17 | A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craf… |
CVE-2026-28587 | Medium | 5.5 | 2026-06-17 | In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive information due to a missing permission check. This could lead to local… |
CVE-2026-28576 | Medium | 5.5 | 2026-06-17 | In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information disclosure with no add… |
CVE-2026-28575 | Medium | 5.5 | 2026-06-17 | In PackageInstaller.Session#transfer of frameworks/base/services/core/java/com/android/server/pm/PackageInstallerSession.java, there is a possible memory exhau… |
CVE-2026-27410 | Medium | 6.5 | 2026-06-17 | Unauthenticated Deserialization of untrusted data in Slimstat Analytics < 5.4.0 versions. |
CVE-2026-24610 | Medium | 4.3 | 2026-06-17 | Subscriber Broken Access Control in MetForm Pro <= 3.9.1 versions. |
CVE-2026-24575 | Medium | 4.3 | 2026-06-17 | Subscriber Broken Access Control in WishList Member X <= 3.29.0 versions. |
CVE-2026-12491 | Medium | 4.8 | 2026-06-17 | A flaw was found in vLLM, an open-source library for large language model inference. This vulnerability arises from improper handling of image metadata, specif… |
CVE-2026-12469 | Medium | 4.3 | 2026-06-17 | Uninitialized Use in GPU in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chro… |
CVE-2026-12463 | Medium | 4.7 | 2026-06-17 | Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to i… |
CVE-2026-12461 | Medium | 6.5 | 2026-06-17 | Out of bounds read in WebRTC in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to obtain potentially sensitive information from pro… |
CVE-2026-12460 | Medium | 4.2 | 2026-06-17 | Insufficient policy enforcement in File System Access in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer proce… |
CVE-2026-12459 | Medium | 6.1 | 2026-06-17 | Inappropriate implementation in Serial in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a craf… |
CVE-2026-12457 | Medium | 4.2 | 2026-06-17 | Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to bypas… |
CVE-2026-12456 | Medium | 4.2 | 2026-06-17 | Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.155 allowed an attacker who convinced a user to install a malicious extension t… |
CVE-2026-12453 | Medium | 4.2 | 2026-06-17 | Insufficient validation of untrusted input in Input in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-12450 | Medium | 6.5 | 2026-06-17 | Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to obtain potentially sensitive information from proce… |
CVE-2026-12446 | Medium | 4.3 | 2026-06-17 | Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to leak cross-origin data via a crafted HTML page… |
CVE-2026-12444 | Medium | 5.5 | 2026-06-17 | Out of bounds read in Chromoting in Google Chrome on Windows prior to 149.0.7827.155 allowed a local attacker to obtain potentially sensitive information from… |
CVE-2026-12115 | Medium | 6.6 | 2026-06-17 | The Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and… |
CVE-2026-0064 | Medium | 5.5 | 2026-06-17 | In multiple places, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional… |
CVE-2025-69137 | Medium | 6.5 | 2026-06-17 | Subscriber Broken Access Control in Genemy <= 1.6.6 versions. |
CVE-2025-59872 | Medium | 4.3 | 2026-06-17 | HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the server is configured to execute code, then it may be possible to obtain comman… |
CVE-2025-48571 | Medium | 4.3 | 2026-06-17 | In multiple functions of btm_sec.cc, there is a possible way for an attacker to intercept SMS messages due to a logic error in the code. This could lead to rem… |