Medium-severity CVEs (page 79)
Page 79 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-18976 | Medium | 6.3 | 2026-08-06 | A vulnerability was determined in NousResearch hermes-agent up to 0.16.0. This impacts the function get_tool_definitions of the file agent/agent_init.py of the… |
CVE-2026-18974 | Medium | 5.3 | 2026-08-06 | A vulnerability was found in heshengtao super-agent-party up to 0.4.1. This affects the function get_file_content of the file server.py of the component execut… |
CVE-2026-18968 | Medium | 4.3 | 2026-08-06 | A security vulnerability has been detected in ttttonyhe OBlog up to 3ca6a45a2fcc81f6086751d8af124658720e8f8f. This issue affects some unknown processing of the… |
CVE-2026-71318 | Medium | 4.8 | 2026-08-05 | Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level `as` prop to the /__nuxt_is… |
CVE-2026-71313 | Medium | 6.9 | 2026-08-05 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in… |
CVE-2026-71311 | Medium | 6.4 | 2026-08-05 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filen… |
CVE-2026-71310 | Medium | 5.9 | 2026-08-05 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper i… |
CVE-2026-18959 | Medium | 5.4 | 2026-08-05 | A flaw has been found in yushine InnoShop up to 0.8.2. Affected by this issue is the function FileManagerController::destroyFiles of the file innopacks/restapi… |
CVE-2026-70618 | Medium | 4.3 | 2026-08-05 | Spacebar Server before commit 51da17c contains a missing authorization vulnerability that allows any authenticated user to enumerate complete guild membership… |
CVE-2026-70616 | Medium | 6.5 | 2026-08-05 | boringproxy through 0.10.0 contains a resource exhaustion vulnerability that allows any authenticated user to permanently exhaust server file descriptors, goro… |
CVE-2026-66885 | Medium | 6.5 | 2026-08-05 | Cross-Site Request Forgery (CSRF) vulnerability in livebook-dev livebook allows an attacker to authenticate a victim's browser session under the attacker's own… |
CVE-2026-21766 | Medium | 5.4 | 2026-08-05 | The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials. Under certain very specific use cases… |
CVE-2026-18954 | Medium | 5.5 | 2026-08-05 | Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perf… |
CVE-2026-7869 | Medium | 5.4 | 2026-08-05 | IBM Langflow OSS 1.0.0 through 1.10.3 is vulnerable to Path Traversal in the Knowledge Bases API (`POST /api/v1/knowledge_bases`). This occurs because user-sup… |
CVE-2026-7658 | Medium | 6.5 | 2026-08-05 | IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate the username field, allowing attackers to inject path traversal sequences and bypass containme… |
CVE-2026-70612 | Medium | 5.4 | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, req… |
CVE-2026-63457 | Medium | 6.5 | 2026-08-05 | A potential denial of service vulnerability exists in HPE Integrated Lights-Out 6 (iLO 6) prior to v1.78. |
CVE-2026-10547 | Medium | 5.9 | 2026-08-05 | IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate ownership in the deprecated POST /api/v1/build/{flow_id}/vertices endpoint, allowing an authen… |
CVE-2026-7657 | Medium | 6.5 | 2026-08-05 | IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow server-side request forgery (SSRF) due to incomplete and ineffective SSRF protection enforcement. |
CVE-2026-70611 | Medium | 6.9 | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the… |
CVE-2026-70610 | Medium | 5.4 | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, obj… |
CVE-2026-70609 | Medium | 5.7 | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the… |
CVE-2026-70447 | Medium | 4.3 | 2026-08-05 | Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credent… |
CVE-2026-70446 | Medium | 4.3 | 2026-08-05 | Missing permission checks in Jenkins CodeSonar Plugin 3.6.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credential… |
CVE-2026-70445 | Medium | 4.3 | 2026-08-05 | Missing permission checks in Jenkins Sauce OnDemand Plugin 2.2.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of crede… |
CVE-2026-70444 | Medium | 4.3 | 2026-08-05 | A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers with Overall/Read permission to enumerate credent… |
CVE-2026-70443 | Medium | 4.3 | 2026-08-05 | Jenkins Horreum Plugin 0.16.162.v33b_4a_a_b_5f828 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configu… |
CVE-2026-70442 | Medium | 4.3 | 2026-08-05 | Jenkins Google Chat Notification Plugin 166.ve6b_de280f2e8 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Ite… |
CVE-2026-70441 | Medium | 5.4 | 2026-08-05 | Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build report pages, resulting in a stored cross-site sc… |
CVE-2026-70440 | Medium | 5.4 | 2026-08-05 | Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controlled field values in a JavaScript context, resulting in a sto… |
CVE-2026-70439 | Medium | 6.5 | 2026-08-05 | Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers lacking appropriate permissions to invoke the conve… |
CVE-2026-70438 | Medium | 4.3 | 2026-08-05 | A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows attackers with Overall/Read permission to enumerate credenti… |
CVE-2026-70436 | Medium | 4.3 | 2026-08-05 | Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check (1.4.0 and earlier) or performs an improper permission check (1… |
CVE-2026-70435 | Medium | 4.2 | 2026-08-05 | A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified U… |
CVE-2026-70434 | Medium | 4.2 | 2026-08-05 | A cross-site request forgery (CSRF) vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers to connect to an attacker-specified URL usi… |
CVE-2026-70433 | Medium | 4.3 | 2026-08-05 | Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credenti… |
CVE-2026-70429 | Medium | 6.5 | 2026-08-05 | Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackers able to create n… |
CVE-2026-70428 | Medium | 4.3 | 2026-08-05 | Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with… |
CVE-2026-70427 | Medium | 4.3 | 2026-08-05 | Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of `.tar` and `.tar… |
CVE-2026-44605 | Medium | 5.5 | 2026-08-05 | A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted N… |
CVE-2026-10128 | Medium | 6.5 | 2026-08-05 | IBM Langflow OSS 1.0.0 through 1.10.3 allows authenticated users can exploit a built-in Langflow component to read arbitrary server environment variables, expo… |
CVE-2026-7646 | Medium | 6.5 | 2026-08-05 | IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other users' uploaded documents, the JWT signi… |
CVE-2026-70607 | Medium | 5.3 | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, som… |
CVE-2026-20311 | Medium | 6.3 | 2026-08-05 | A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, remote attacker with low privileges to cause a den… |
CVE-2026-20308 | Medium | 4.3 | 2026-08-05 | A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, remote attacker with low privileges to perform a d… |
CVE-2026-20294 | Medium | 6.5 | 2026-08-05 | A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to view sensitive informat… |
CVE-2026-20289 | Medium | 5.7 | 2026-08-05 | A vulnerability in the logging subsystem of Cisco RoomOS could allow an authenticated, local attacker with low privileges to access sensitive information. T… |
CVE-2026-20288 | Medium | 6.5 | 2026-08-05 | A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with Admin privileges to execute arbitrar… |
CVE-2026-20198 | Medium | 4.8 | 2026-08-05 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to conduct… |
CVE-2026-20028 | Medium | 5.0 | 2026-08-05 | A vulnerability in the network driver of Cisco Terminal Service (TS) Agent could allow an authenticated, remote attacker to bypass firewall rules that are asso… |
CVE-2026-18927 | Medium | 6.3 | 2026-08-05 | A vulnerability was determined in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. T… |
CVE-2026-70606 | Medium | 5.9 | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a cu… |
CVE-2026-70605 | Medium | 5.9 | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, whe… |
CVE-2026-70603 | Medium | 6.0 | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, she… |
CVE-2026-70602 | Medium | 6.6 | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, ext… |
CVE-2026-70599 | Medium | 5.9 | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, ser… |
CVE-2026-70597 | Medium | 6.3 | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the… |
CVE-2026-70596 | Medium | 4.3 | 2026-08-05 | Ghost is a Node.js content management system. From 4.9.0 until 6.54.1, an input validation issue allowed any staff user to create a post with content in featur… |
CVE-2026-70595 | Medium | 4.0 | 2026-08-05 | Ghost is a Node.js content management system. From 6.26.0 until 6.54.1, a validation issue allowed some functionality, such as Webmentions, to be abused by an… |
CVE-2026-53992 | Medium | 6.1 | 2026-08-05 | ProjectSend r2029 contains a reflected cross-site scripting vulnerability in thumbnails-regenerate.php that allows remote attackers to inject arbitrary HTML an… |
CVE-2026-50749 | Medium | 6.5 | 2026-08-05 | Improper Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Any authenticated user can reject arbitrary pending e… |
CVE-2026-49331 | Medium | 6.5 | 2026-08-05 | A flaw was found in openshift/oauth-proxy. On paths configured to bypass authentication (skip-auth-regex), the proxy forwards client-supplied identity headers… |
CVE-2026-48912 | Medium | 6.5 | 2026-08-05 | Improper Input Validation vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing ownership check in the avatar-cleanup l… |
CVE-2026-39924 | Medium | 6.8 | 2026-08-05 | Flarum before 1.8.16 contains an improper session invalidation vulnerability that allows attackers who hold a valid session token to retain full account access… |
CVE-2026-18531 | Medium | 5.3 | 2026-08-05 | IBM Maximo Application Suite 9.2, 9.1, and 9.0 could allow a remote attacker to tamper with session data due to the use of a weak HMAC session signing secret. |
CVE-2026-15656 | Medium | 4.3 | 2026-08-05 | IBM Maximo Application Suite 9.2, 9.1, and 9.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the c… |
CVE-2026-13477 | Medium | 4.7 | 2026-08-05 | IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 could allow an authenticated privileged user to execute arbitrary commands wi… |
CVE-2026-12762 | Medium | 5.3 | 2026-08-05 | IBM Cloud Pak For Business Automation 24.0.0, 24.0.1, 25.0.0, and 26.0.0 could allow a remote attacker to obtain sensitive information exposed in manifest file… |
CVE-2026-16100 | Medium | 6.5 | 2026-08-05 | A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operation… |
CVE-2026-16071 | Medium | 5.4 | 2026-08-05 | A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegat… |
CVE-2026-7456 | Medium | 6.5 | 2026-08-05 | The Udimi Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_disconnect()` function i… |
CVE-2026-71293 | Medium | 6.2 | 2026-08-05 | Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's r… |
CVE-2026-71286 | Medium | 6.1 | 2026-08-05 | The render-template component of ember-dynamic-render-template (addon/components/render-template.js) passes its property directly into Ember/Glimmer's compileT… |
CVE-2026-71283 | Medium | 4.9 | 2026-08-05 | Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), calls tarfile.extractall(temp_path) on an admin-uplo… |
CVE-2026-71282 | Medium | 6.5 | 2026-08-05 | ChirpStack's SQLite-backend device tag filtering (chirpstack/src/storage/device.rs, in both get_count and list) interpolates the user-supplied tag KEY directly… |
CVE-2026-71275 | Medium | 5.4 | 2026-08-05 | OpenBK7231T's http_fn_ota_exec() (src/httpserver/http_fns.c) reflects the `host` query parameter directly into an HTML response via hprintf255(request, "<h3>OT… |
CVE-2026-71273 | Medium | 6.5 | 2026-08-05 | OpenBK7231T's /cfg_wifi_set endpoint (src/httpserver/http_fns.c) accepts configuration changes via a plain GET request with no CSRF token. If the parameter is… |
CVE-2026-71260 | Medium | 6.5 | 2026-08-05 | ESPHome through 2026.7.0-dev discloses plaintext passwords via its web_server component. In WebServer::text_json_ (esphome/components/web_server/web_server.cpp… |
CVE-2026-71227 | Medium | 5.1 | 2026-08-05 | A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output (AIO) interface. By reusing an AIO-enabled… |
CVE-2026-71225 | Medium | 6.5 | 2026-08-05 | A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs (over 64 KiB) in stateful modes such as Counter (CTR) or Cip… |
CVE-2026-0516 | Medium | 6.5 | 2026-08-05 | A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS could allow a remote attacker to manipulate the Host header and redirec… |
CVE-2026-71251 | Medium | 6.5 | 2026-08-05 | Akaunting's shared download route (app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/{id}/download behind only generic auth middleware) f… |
CVE-2026-71250 | Medium | 4.3 | 2026-08-05 | Firefly III's webhook URL validator (IsValidWebhookUrl.php) filters most private/reserved IPv4 ranges but contains an explicit early-return that allows any res… |
CVE-2026-71249 | Medium | 6.1 | 2026-08-05 | 299Ko's public contact form (plugin/contact/controllers/ContactController.php, home) sets raw POST field values (name, firstname, email, message) into the page… |
CVE-2026-71247 | Medium | 6.5 | 2026-08-05 | Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging t… |
CVE-2026-71246 | Medium | 4.3 | 2026-08-05 | Pixelfed's SearchController (behind the auth middleware) accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchServ… |
CVE-2026-71244 | Medium | 6.5 | 2026-08-05 | Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, account_type… |
CVE-2026-71240 | Medium | 4.3 | 2026-08-05 | DjangoCRM's toggle_default_sorting view is the only route in common/urls.py that is not wrapped in login_required or staff_member_required, and it redirects to… |
CVE-2026-14574 | Medium | 6.5 | 2026-08-05 | In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core` recursively merges preference values witho… |
CVE-2026-14304 | Medium | 5.5 | 2026-08-05 | In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based application miChecker versi… |
CVE-2026-15452 | Medium | 4.7 | 2026-08-05 | The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Query Strin… |
CVE-2026-7726 | Medium | 6.5 | 2026-08-05 | The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the `Layouts_WPB_Remote::template_sync… |
CVE-2026-7441 | Medium | 6.4 | 2026-08-05 | The Simple Yearly Archive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `posttype` attribute of the `SimpleYearlyArchive` shortcode… |
CVE-2026-7105 | Medium | 4.3 | 2026-08-05 | The Xpro Addons plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on the `get_menu_content_editor()` functi… |
CVE-2026-71212 | Medium | 4.4 | 2026-08-05 | xidown (a yt-dlp/ffmpeg GUI wrapper) builds its yt-dlp command-line invocation (xidown/core/scanner.py and downloader.py) by appending the user-provided or sca… |
CVE-2026-71210 | Medium | 5.3 | 2026-08-05 | Mealie's AsyncSafeTransport SSRF guard (mealie/pkgs/safehttp/transport.py) resolves a target hostname once, checks the resolved IP against private-range rules… |
CVE-2026-71208 | Medium | 6.5 | 2026-08-05 | KubeSphere's cluster-controller reconciliation (pkg/utils/clusterclient/clusterclient.go, addCluster) processes every Cluster custom resource's connection conf… |
CVE-2026-71205 | Medium | 6.5 | 2026-08-05 | changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-at… |
CVE-2026-71204 | Medium | 6.2 | 2026-08-05 | changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored application settings via .u… |
CVE-2026-71203 | Medium | 5.3 | 2026-08-05 | changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource regi… |