Medium-severity CVEs (page 72)
Page 72 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-18663 | Medium | 5.9 | 2026-08-12 | A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function frees the parsed controls array on the Session Tracking critical-control rejection… |
CVE-2026-18652 | Medium | 6.5 | 2026-08-12 | Velociraptor allows reading Stacked result sets from the GUI. Velociraptor's multi-tenant design stores sub orgs within the datastore directory. The path requ… |
CVE-2025-41771 | Medium | 4.3 | 2026-08-12 | An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability a… |
CVE-2026-19217 | Medium | 5.4 | 2026-08-12 | The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could… |
CVE-2026-19073 | Medium | 5.3 | 2026-08-12 | The Order Sync with Zendesk for WooCommerce WordPress plugin before 2.2.3 does not perform any capability check on one of its REST API endpoints, and does not… |
CVE-2026-19052 | Medium | 4.3 | 2026-08-12 | The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is pu… |
CVE-2026-19050 | Medium | 6.4 | 2026-08-12 | The ProSolution WP Client WordPress plugin before 2.0.9 does not validate a user-supplied URL, and does not check the capability or nonce of the requester, bef… |
CVE-2026-18962 | Medium | 4.3 | 2026-08-12 | The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it process… |
CVE-2026-18943 | Medium | 6.5 | 2026-08-12 | The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allowing users with a role as low as subscri… |
CVE-2026-18046 | Medium | 4.3 | 2026-08-12 | The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on the REST route that stores it… |
CVE-2026-18035 | Medium | 5.3 | 2026-08-12 | The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allowing unauthenticated attackers to read… |
CVE-2026-17013 | Medium | 6.1 | 2026-08-12 | The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which cou… |
CVE-2026-16737 | Medium | 5.3 | 2026-08-12 | The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one… |
CVE-2026-16066 | Medium | 5.4 | 2026-08-12 | The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users wi… |
CVE-2026-15388 | Medium | 4.3 | 2026-08-12 | The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST rou… |
CVE-2026-15249 | Medium | 5.4 | 2026-08-12 | The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a… |
CVE-2026-14859 | Medium | 4.3 | 2026-08-12 | The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated user… |
CVE-2026-14858 | Medium | 4.3 | 2026-08-12 | The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subs… |
CVE-2026-14857 | Medium | 4.3 | 2026-08-12 | The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification… |
CVE-2026-13612 | Medium | 4.3 | 2026-08-12 | The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level user… |
CVE-2026-13177 | Medium | 4.3 | 2026-08-12 | The Eventin WordPress plugin before 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and abo… |
CVE-2026-13168 | Medium | 6.5 | 2026-08-12 | The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and abov… |
CVE-2026-12976 | Medium | 6.5 | 2026-08-12 | The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's… |
CVE-2026-12235 | Medium | 6.3 | 2026-08-12 | The Linkable Loadable Extensions (llext) subsystem mis-handles PLT/RELA relocation entries when linking a relocatable (partially-linked) ELF extension. In llex… |
CVE-2026-12233 | Medium | 5.9 | 2026-08-12 | The PSA Protected Storage credential backend (subsys/net/lib/tls_credentials/tls_credentials_trusted.c) declared its credential-store mutex as a plain zero-fil… |
CVE-2026-12232 | Medium | 6.1 | 2026-08-12 | The Intel ALH digital-audio-interface driver function dai_alh_get_properties() in drivers/dai/intel/alh/alh.c used a caller-supplied int stream_id with no rang… |
CVE-2025-15687 | Medium | 4.3 | 2026-08-12 | A security flaw has been discovered in Open5GS up to 2.7.6. Impacted is the function smf_gx_cca_cb of the component SMF Diameter Gx Credit-Control-Answer Handl… |
CVE-2026-9318 | Medium | 5.4 | 2026-08-12 | tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScr… |
CVE-2026-19588 | Medium | 6.5 | 2026-08-12 | Integer Overflow to Buffer Overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers. |
CVE-2026-19587 | Medium | 6.5 | 2026-08-12 | Uncontrolled Resource Consumption vulnerability in Samsung Open Source rlottie allows Excessive Allocation. |
CVE-2025-15686 | Medium | 4.3 | 2026-08-12 | A vulnerability has been found in Open5GS up to 2.7.6. Affected by this issue is the function fd_msg_sess_get of the component HSS Service. Such manipulation o… |
CVE-2025-15685 | Medium | 6.3 | 2026-08-12 | A flaw has been found in Open5GS up to 2.7.1. Affected by this vulnerability is an unknown functionality of the component freeDiameter. This manipulation cause… |
CVE-2025-15684 | Medium | 5.3 | 2026-08-12 | A vulnerability was detected in Open5GS up to 2.7.6. Affected is the function diam_log_func of the file lib/diameter/common/init.c of the component CER Handler… |
CVE-2026-64927 | Medium | 6.4 | 2026-08-12 | A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles… |
CVE-2024-14044 | Medium | 6.3 | 2026-08-12 | A vulnerability was identified in Open5GS up to 2.7.1. This issue affects the function pcrf_rx_aar_cb of the file src/pcrf/pcrf-rx-path.c of the component Diam… |
CVE-2024-14043 | Medium | 6.3 | 2026-08-12 | A vulnerability was determined in Open5GS up to 2.7.1. This vulnerability affects the function mme_s6a_subscription_data_from_avp of the file src/mme/mme-fd-pa… |
CVE-2026-73245 | Medium | 6.5 | 2026-08-11 | Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management… |
CVE-2026-66340 | Medium | 5.3 | 2026-08-11 | The Mira cloud authentication endpoints do not enforce per-account rate limiting, per-IP throttling, or account lockout after repeated failed login attempts. A… |
CVE-2026-66098 | Medium | 6.5 | 2026-08-11 | The Mira hormone monitor device firmware accepts a 0x01 write from any BLE central without authentication, causing the device to reboot into bootloader mode. A… |
CVE-2026-64934 | Medium | 4.3 | 2026-08-11 | The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version… |
CVE-2026-18710 | Medium | 6.5 | 2026-08-11 | A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log o… |
CVE-2026-66832 | Medium | 6.5 | 2026-08-11 | When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as a query string para… |
CVE-2026-66148 | Medium | 6.3 | 2026-08-11 | An authenticated command injection vulnerability was identified in GMS Command-Line Interface (CLI) 9.5.1 (Build 9510.1044) and earlier versions which allows l… |
CVE-2026-63134 | Medium | 5.4 | 2026-08-11 | Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` protects file extraction with libarchive's secure flags, but crea… |
CVE-2026-63133 | Medium | 6.5 | 2026-08-11 | Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` extracts uploaded archives with no limit on entry count, director… |
CVE-2026-48762 | Medium | 5.4 | 2026-08-11 | TypeBot is a chatbot builder tool. Prior to version 3.16.0, the OpenAI "Create Transcription" action handler fetches a user-supplied audio URL using `fetch()`… |
CVE-2026-29035 | Medium | 6.5 | 2026-08-11 | CivetWeb (commit 4a4f0c95) contains a heap and stack buffer overflow vulnerability in the read_websocket() function that allows unauthenticated remote attacker… |
CVE-2026-19579 | Medium | 5.4 | 2026-08-11 | Snipe-IT before 8.6.0 contains an authorization bypass (insecure direct object reference) in the asset checkout-request cancellation endpoint. The cancel_by_ad… |
CVE-2026-73282 | Medium | 4.8 | 2026-08-11 | In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent. |
CVE-2026-73244 | Medium | 5.3 | 2026-08-11 | kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/jav… |
CVE-2026-73243 | Medium | 5.8 | 2026-08-11 | kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated GET /addTask endpoint in kkFileView is omitted… |
CVE-2026-73235 | Medium | 6.1 | 2026-08-11 | FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constructed in src/Base/Reader.cpp by Base::XM… |
CVE-2026-73229 | Medium | 4.3 | 2026-08-11 | Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's rest_framework/renderers.py AdminRende… |
CVE-2026-73036 | Medium | 4.4 | 2026-08-11 | Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment that allows local attackers to… |
CVE-2026-71845 | Medium | 6.3 | 2026-08-11 | A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCX_TOKEN, a bearer credent… |
CVE-2026-71475 | Medium | 6.8 | 2026-08-11 | A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This oc… |
CVE-2026-71468 | Medium | 5.3 | 2026-08-11 | A flaw was found in acm-search-v2-api-rhel9. When the `getFederationConfig` function refreshes its cache, it improperly reuses a user's bearer token for all su… |
CVE-2026-70339 | Medium | 5.4 | 2026-08-11 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-66146 | Medium | 6.1 | 2026-08-11 | Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions that allow a remote attacker to execute… |
CVE-2024-14042 | Medium | 6.3 | 2026-08-11 | A vulnerability was found in Open5GS up to 2.7.1. This affects the function hss_ogs_diam_s6a_air_cb/hss_ogs_diam_s6a_ulr_cb of the file src/hss/hss-s6a-path.c… |
CVE-2026-73228 | Medium | 5.3 | 2026-08-11 | Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in rest_framework/request.py Request._p… |
CVE-2026-69117 | Medium | 6.5 | 2026-08-11 | NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django… |
CVE-2026-69115 | Medium | 6.5 | 2026-08-11 | OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitt… |
CVE-2026-18709 | Medium | 6.4 | 2026-08-11 | An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transa… |
CVE-2026-18708 | Medium | 6.4 | 2026-08-11 | An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed with… |
CVE-2026-18707 | Medium | 4.3 | 2026-08-11 | An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly… |
CVE-2026-18706 | Medium | 6.6 | 2026-08-11 | An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause… |
CVE-2026-18705 | Medium | 6.5 | 2026-08-11 | An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different… |
CVE-2026-18704 | Medium | 6.5 | 2026-08-11 | An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections… |
CVE-2026-18703 | Medium | 4.2 | 2026-08-11 | An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authe… |
CVE-2026-18702 | Medium | 6.4 | 2026-08-11 | An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the ent… |
CVE-2026-18701 | Medium | 6.5 | 2026-08-11 | An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate unexpectedly by su… |
CVE-2026-18700 | Medium | 6.5 | 2026-08-11 | An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the… |
CVE-2026-18699 | Medium | 6.5 | 2026-08-11 | An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly b… |
CVE-2026-18698 | Medium | 5.4 | 2026-08-11 | An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that… |
CVE-2026-18696 | Medium | 6.5 | 2026-08-11 | An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data-definition operati… |
CVE-2026-18695 | Medium | 6.5 | 2026-08-11 | An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticated user with write… |
CVE-2026-73216 | Medium | 6.5 | 2026-08-11 | Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, shutdown_client_connection() in src/server/ns_turn_server.c prematurely c… |
CVE-2026-72712 | Medium | 6.5 | 2026-08-11 | Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted pa… |
CVE-2026-69113 | Medium | 5.4 | 2026-08-11 | Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any priva… |
CVE-2026-65680 | Medium | 6.7 | 2026-08-11 | Improper link resolution before file access ('link following') in Microsoft OneDrive allows an authorized attacker to elevate privileges locally. |
CVE-2026-48790 | Medium | 5.5 | 2026-08-11 | Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to `settings.js… |
CVE-2026-48411 | Medium | 6.5 | 2026-08-11 | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker with high privileges could l… |
CVE-2026-20901 | Medium | 5.3 | 2026-08-11 | Improper input validation for some Intel(R) Xeon(R) processors within firmware may allow an escalation of privilege. Startup code and smm adversary with a priv… |
CVE-2026-73084 | Medium | 6.1 | 2026-08-11 | Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query… |
CVE-2026-72971 | Medium | 5.5 | 2026-08-11 | Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to p… |
CVE-2026-71390 | Medium | 4.0 | 2026-08-11 | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage th… |
CVE-2026-71389 | Medium | 6.2 | 2026-08-11 | CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attack… |
CVE-2026-70348 | Medium | 5.5 | 2026-08-11 | Improper link resolution before file access ('link following') in Windows Management Services allows an authorized attacker to deny service locally. |
CVE-2026-70330 | Medium | 6.7 | 2026-08-11 | Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally. |
CVE-2026-70328 | Medium | 6.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. |
CVE-2026-70327 | Medium | 6.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. |
CVE-2026-70325 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
CVE-2026-70323 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-70322 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
CVE-2026-70320 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
CVE-2026-70319 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-70318 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-70317 | Medium | 5.5 | 2026-08-11 | Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-70316 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |