Medium-severity CVEs (page 7)
Page 7 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-96606 | Medium | 5.3 | 2026-09-23 | A security flaw has been discovered in LB-Link BL-CPE600EU 5.8.13. This vulnerability affects unknown code of the file Mifi_config.bin of the component Configu… |
CVE-2026-6925 | Medium | 5.3 | 2026-09-23 | IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request con… |
CVE-2026-6718 | Medium | 6.2 | 2026-09-23 | IBM Concert 1.0.0 through 3.0.0 is vulnerable to improper access control which allows unauthorized modification of application files. |
CVE-2026-96551 | Medium | 4.3 | 2026-09-23 | A vulnerability was determined in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Impacted is an unknown function of the file ssm_pro/src/m… |
CVE-2026-84724 | Medium | 6.6 | 2026-09-23 | An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint sto… |
CVE-2026-84721 | Medium | 6.4 | 2026-09-23 | A server-side request forgery flaw was found in the Ansible Automation Platform automation-controller email notification backend. The email backend passes the… |
CVE-2026-84720 | Medium | 6.5 | 2026-09-23 | A flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestor_artifacts database column, which stores the raw merged… |
CVE-2026-84718 | Medium | 4.3 | 2026-09-23 | A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X… |
CVE-2026-84717 | Medium | 5.3 | 2026-09-23 | A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature veri… |
CVE-2026-84716 | Medium | 6.6 | 2026-09-23 | A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads an ex… |
CVE-2026-84713 | Medium | 6.5 | 2026-09-23 | A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification_ configura… |
CVE-2026-84712 | Medium | 5.3 | 2026-09-23 | A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ (ApiV2PingView… |
CVE-2026-96548 | Medium | 5.6 | 2026-09-23 | A flaw has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects an unknown part of the file ssm_pro/src/main/resource… |
CVE-2026-96545 | Medium | 4.4 | 2026-09-23 | An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the fi… |
CVE-2026-95602 | Medium | 6.5 | 2026-09-23 | Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control… |
CVE-2026-95600 | Medium | 5.3 | 2026-09-23 | Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versions. |
CVE-2026-95592 | Medium | 5.3 | 2026-09-23 | Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions. |
CVE-2026-95586 | Medium | 6.5 | 2026-09-23 | Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions. |
CVE-2026-95530 | Medium | 6.5 | 2026-09-23 | Subscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG) Manager <= 11.4.1 versions. |
CVE-2026-95527 | Medium | 6.5 | 2026-09-23 | Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions. |
CVE-2026-95525 | Medium | 6.5 | 2026-09-23 | Subscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions. |
CVE-2026-95524 | Medium | 5.3 | 2026-09-23 | Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions. |
CVE-2026-95523 | Medium | 6.5 | 2026-09-23 | Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions. |
CVE-2026-95514 | Medium | 5.3 | 2026-09-23 | Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions. |
CVE-2026-94684 | Medium | 6.5 | 2026-09-23 | Contributor Cross Site Scripting (XSS) in Ocean Extra <= 2.6.1 versions. |
CVE-2026-94682 | Medium | 6.5 | 2026-09-23 | Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 versions. |
CVE-2026-94680 | Medium | 6.5 | 2026-09-23 | Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions. |
CVE-2026-94679 | Medium | 5.4 | 2026-09-23 | Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions. |
CVE-2026-94671 | Medium | 6.5 | 2026-09-23 | Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions. |
CVE-2026-94500 | Medium | 6.5 | 2026-09-23 | Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions. |
CVE-2026-94498 | Medium | 6.5 | 2026-09-23 | Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions. |
CVE-2026-94461 | Medium | 6.5 | 2026-09-23 | Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions. |
CVE-2026-94457 | Medium | 4.8 | 2026-09-23 | Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions. |
CVE-2026-94391 | Medium | 6.5 | 2026-09-23 | Contributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions. |
CVE-2026-94168 | Medium | 6.5 | 2026-09-23 | Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions. |
CVE-2026-94118 | Medium | 6.5 | 2026-09-23 | Contributor Cross Site Scripting (XSS) in Premium Blocks – Gutenberg Blocks for WordPress <= 2.3.17 versions. |
CVE-2026-94080 | Medium | 5.3 | 2026-09-23 | Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions. |
CVE-2026-94079 | Medium | 5.3 | 2026-09-23 | Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions. |
CVE-2026-93772 | Medium | 6.5 | 2026-09-23 | Subscriber Cross Site Scripting (XSS) in wpForo Forum <= 3.1.5 versions. |
CVE-2026-93623 | Medium | 5.3 | 2026-09-23 | Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions. |
CVE-2026-93620 | Medium | 6.5 | 2026-09-23 | Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions. |
CVE-2026-93618 | Medium | 6.5 | 2026-09-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetTricks allows Stored XSS. T… |
CVE-2026-93529 | Medium | 6.5 | 2026-09-23 | Contributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 versions. |
CVE-2026-93513 | Medium | 4.3 | 2026-09-23 | Contributor Insecure Direct Object References (IDOR) in SiteSkite <= 2.1.7 versions. |
CVE-2026-77421 | Medium | 6.5 | 2026-09-23 | JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-contro… |
CVE-2026-77420 | Medium | 5.5 | 2026-09-23 | JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String line) in reader/sr… |
CVE-2026-71462 | Medium | 4.1 | 2026-09-23 | StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths. 200 vs 400 response reveals existe… |
CVE-2026-71461 | Medium | 4.3 | 2026-09-23 | HostList.list() catches bare Exception and returns str(e) verbatim. Via host_filter, any authenticated user triggers Django FieldEr… |
CVE-2026-71460 | Medium | 4.3 | 2026-09-23 | /api/v2/config/ is protected only by IsAuthenticated. license_info (account_number, subscription_id, pool_id, sku, support_level, i… |
CVE-2026-71459 | Medium | 5.0 | 2026-09-23 | JobJobEventsChildrenSummary view has no model/parent_model. ModelAccessPermission.check_get_permissions() falls through (returns Tr… |
CVE-2026-71458 | Medium | 5.0 | 2026-09-23 | URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 shim only rewrites 4… |
CVE-2026-55632 | Medium | 4.3 | 2026-09-23 | GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal pipeline structure API used for autocompletion while editing pipeline, template, en… |
CVE-2026-88840 | Medium | 5.3 | 2026-09-23 | BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message. |
CVE-2026-88839 | Medium | 6.7 | 2026-09-23 | BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers. |
CVE-2026-88837 | Medium | 6.5 | 2026-09-23 | BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check. |
CVE-2026-88835 | Medium | 6.1 | 2026-09-23 | BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read. |
CVE-2026-88831 | Medium | 5.3 | 2026-09-23 | BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients. |
CVE-2026-86867 | Medium | 6.5 | 2026-09-23 | Cinnamon's Kotaemon (all versions up to and including v0.12.0) multi-user chat interface contains multiple vulnerabilities due to incorrect authorization and i… |
CVE-2026-96807 | Medium | 4.0 | 2026-09-23 | In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an arbit… |
CVE-2026-96655 | Medium | 4.3 | 2026-09-23 | Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' p… |
CVE-2026-96654 | Medium | 6.5 | 2026-09-23 | Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions a… |
CVE-2026-96652 | Medium | 4.3 | 2026-09-23 | Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' par… |
CVE-2026-96651 | Medium | 6.5 | 2026-09-23 | Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/system/age… |
CVE-2026-6669 | Medium | 5.9 | 2026-09-23 | Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicio… |
CVE-2026-96674 | Medium | 4.4 | 2026-09-23 | alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds… |
CVE-2026-96672 | Medium | 6.4 | 2026-09-23 | Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculation_formula values reference whitelisted methods before passing… |
CVE-2026-79306 | Medium | 6.5 | 2026-09-23 | CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote… |
CVE-2026-79304 | Medium | 6.5 | 2026-09-23 | CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attack… |
CVE-2026-6327 | Medium | 4.3 | 2026-09-23 | IBM Concert 1.0.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when writt… |
CVE-2026-3626 | Medium | 5.3 | 2026-09-23 | IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browse… |
CVE-2026-19267 | Medium | 6.2 | 2026-09-23 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to missing authentication on the Business Rules Manager commands REST endpoint (`Com… |
CVE-2026-19087 | Medium | 4.4 | 2026-09-23 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to achieve privilege escalation within the container due to improper… |
CVE-2026-18505 | Medium | 5.4 | 2026-09-23 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to open redirect in the PMP `HostHeaderFilter` (`HostHeaderFilter.java:151`). An una… |
CVE-2026-18180 | Medium | 6.5 | 2026-09-23 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to SQL injection. |
CVE-2026-96611 | Medium | 6.9 | 2026-09-23 | FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored… |
CVE-2026-96600 | Medium | 5.5 | 2026-09-23 | Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administ… |
CVE-2026-96599 | Medium | 5.9 | 2026-09-23 | Isotope eCommerce through 2.9.10 derives order identifiers from uniqid() instead of a cryptographically secure source, allowing unauthenticated attackers to gu… |
CVE-2026-96276 | Medium | 6.5 | 2026-09-23 | If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak build-init --writable-sdk --sdk-extensi… |
CVE-2026-92164 | Medium | 6.5 | 2026-09-23 | Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file… |
CVE-2026-88974 | Medium | 5.4 | 2026-09-23 | WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-… |
CVE-2026-73858 | Medium | 5.3 | 2026-09-23 | Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can… |
CVE-2026-73589 | Medium | 6.3 | 2026-09-23 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Weak Encoding for Password vulnerability. A… |
CVE-2026-73587 | Medium | 6.8 | 2026-09-23 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Certificate Validation vulnerability. An unauthenticated a… |
CVE-2026-73586 | Medium | 6.4 | 2026-09-23 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Insufficient Session Expiration vulnerability. A low privileged att… |
CVE-2026-71177 | Medium | 5.4 | 2026-09-23 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Rendered UI Layers or Frames vulnerability… |
CVE-2026-63002 | Medium | 4.8 | 2026-09-23 | REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the medi… |
CVE-2026-63001 | Medium | 4.8 | 2026-09-23 | REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a… |
CVE-2026-63000 | Medium | 6.4 | 2026-09-23 | REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php in… |
CVE-2026-62998 | Medium | 4.3 | 2026-09-23 | REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in redaxo/src/core/lib/list.php accepts the sort request parameter… |
CVE-2026-61834 | Medium | 4.3 | 2026-09-23 | scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate() reads inherited properties and assign() uses prototype-chain membership… |
CVE-2026-61413 | Medium | 6.8 | 2026-09-23 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Privilege Management vulnerability. A low privileged attac… |
CVE-2026-18179 | Medium | 6.5 | 2026-09-23 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to clear active chat sessions due to improper authorization. |
CVE-2026-84091 | Medium | 5.3 | 2026-09-23 | The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before… |
CVE-2026-77112 | Medium | 6.5 | 2026-09-23 | Server-Side request forgery (SSRF) vulnerability in Global IT Informatics Technology Services Inc. Weoll allows Server Side Request Forgery. This issue affect… |
CVE-2026-96446 | Medium | 4.2 | 2026-09-23 | A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none is used… |
CVE-2026-96445 | Medium | 6.8 | 2026-09-23 | A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates speci… |
CVE-2026-80444 | Medium | 5.4 | 2026-09-23 | URL redirection to untrusted site ('open redirect') vulnerability in Abis Technology Ltd. Co. AVESİS allows Input Data Manipulation. This issue affects AVESİS… |
CVE-2026-73581 | Medium | 6.5 | 2026-09-23 | Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate use… |
CVE-2026-96456 | Medium | 6.3 | 2026-09-23 | The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an a… |
CVE-2026-90950 | Medium | 5.3 | 2026-09-23 | The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handler when a form field is absent from the… |