Medium-severity CVEs (page 8)
Page 8 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-94079 | Medium | 5.3 | 2026-09-23 | Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions. |
CVE-2026-93772 | Medium | 6.5 | 2026-09-23 | Subscriber Cross Site Scripting (XSS) in wpForo Forum <= 3.1.5 versions. |
CVE-2026-93623 | Medium | 5.3 | 2026-09-23 | Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions. |
CVE-2026-93620 | Medium | 6.5 | 2026-09-23 | Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions. |
CVE-2026-93618 | Medium | 6.5 | 2026-09-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetTricks allows Stored XSS. T… |
CVE-2026-93529 | Medium | 6.5 | 2026-09-23 | Contributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 versions. |
CVE-2026-93513 | Medium | 4.3 | 2026-09-23 | Contributor Insecure Direct Object References (IDOR) in SiteSkite <= 2.1.7 versions. |
CVE-2026-77421 | Medium | 6.5 | 2026-09-23 | JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-contro… |
CVE-2026-77420 | Medium | 5.5 | 2026-09-23 | JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String line) in reader/sr… |
CVE-2026-71462 | Medium | 4.1 | 2026-09-23 | StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths. 200 vs 400 response reveals existe… |
CVE-2026-71461 | Medium | 4.3 | 2026-09-23 | HostList.list() catches bare Exception and returns str(e) verbatim. Via host_filter, any authenticated user triggers Django FieldEr… |
CVE-2026-71460 | Medium | 4.3 | 2026-09-23 | /api/v2/config/ is protected only by IsAuthenticated. license_info (account_number, subscription_id, pool_id, sku, support_level, i… |
CVE-2026-71459 | Medium | 5.0 | 2026-09-23 | JobJobEventsChildrenSummary view has no model/parent_model. ModelAccessPermission.check_get_permissions() falls through (returns Tr… |
CVE-2026-71458 | Medium | 5.0 | 2026-09-23 | URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 shim only rewrites 4… |
CVE-2026-55632 | Medium | 4.3 | 2026-09-23 | GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal pipeline structure API used for autocompletion while editing pipeline, template, en… |
CVE-2026-88840 | Medium | 5.3 | 2026-09-23 | BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message. |
CVE-2026-88839 | Medium | 6.7 | 2026-09-23 | BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers. |
CVE-2026-88837 | Medium | 6.5 | 2026-09-23 | BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check. |
CVE-2026-88835 | Medium | 6.1 | 2026-09-23 | BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read. |
CVE-2026-88831 | Medium | 5.3 | 2026-09-23 | BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients. |
CVE-2026-86867 | Medium | 6.5 | 2026-09-23 | Cinnamon's Kotaemon (all versions up to and including v0.12.0) multi-user chat interface contains multiple vulnerabilities due to incorrect authorization and i… |
CVE-2026-96807 | Medium | 4.0 | 2026-09-23 | In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an arbit… |
CVE-2026-96655 | Medium | 4.3 | 2026-09-23 | Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' p… |
CVE-2026-96654 | Medium | 6.5 | 2026-09-23 | Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions a… |
CVE-2026-96652 | Medium | 4.3 | 2026-09-23 | Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' par… |
CVE-2026-96651 | Medium | 6.5 | 2026-09-23 | Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/system/age… |
CVE-2026-6669 | Medium | 5.9 | 2026-09-23 | Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicio… |
CVE-2026-96674 | Medium | 4.4 | 2026-09-23 | alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds… |
CVE-2026-96672 | Medium | 6.4 | 2026-09-23 | Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculation_formula values reference whitelisted methods before passing… |
CVE-2026-79306 | Medium | 6.5 | 2026-09-23 | CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote… |
CVE-2026-79304 | Medium | 6.5 | 2026-09-23 | CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attack… |
CVE-2026-6327 | Medium | 4.3 | 2026-09-23 | IBM Concert 1.0.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when writt… |
CVE-2026-3626 | Medium | 5.3 | 2026-09-23 | IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browse… |
CVE-2026-19267 | Medium | 6.2 | 2026-09-23 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to missing authentication on the Business Rules Manager commands REST endpoint (`Com… |
CVE-2026-19087 | Medium | 4.4 | 2026-09-23 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to achieve privilege escalation within the container due to improper… |
CVE-2026-18505 | Medium | 5.4 | 2026-09-23 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to open redirect in the PMP `HostHeaderFilter` (`HostHeaderFilter.java:151`). An una… |
CVE-2026-18180 | Medium | 6.5 | 2026-09-23 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to SQL injection. |
CVE-2026-96611 | Medium | 6.9 | 2026-09-23 | FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored… |
CVE-2026-96600 | Medium | 5.5 | 2026-09-23 | Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administ… |
CVE-2026-96599 | Medium | 5.9 | 2026-09-23 | Isotope eCommerce through 2.9.10 derives order identifiers from uniqid() instead of a cryptographically secure source, allowing unauthenticated attackers to gu… |
CVE-2026-96276 | Medium | 6.5 | 2026-09-23 | If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak build-init --writable-sdk --sdk-extensi… |
CVE-2026-92164 | Medium | 6.5 | 2026-09-23 | Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file… |
CVE-2026-88974 | Medium | 5.4 | 2026-09-23 | WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-… |
CVE-2026-73858 | Medium | 5.3 | 2026-09-23 | Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can… |
CVE-2026-73589 | Medium | 6.3 | 2026-09-23 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Weak Encoding for Password vulnerability. A… |
CVE-2026-73587 | Medium | 6.8 | 2026-09-23 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Certificate Validation vulnerability. An unauthenticated a… |
CVE-2026-73586 | Medium | 6.4 | 2026-09-23 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Insufficient Session Expiration vulnerability. A low privileged att… |
CVE-2026-71177 | Medium | 5.4 | 2026-09-23 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Rendered UI Layers or Frames vulnerability… |
CVE-2026-63002 | Medium | 4.8 | 2026-09-23 | REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the medi… |
CVE-2026-63001 | Medium | 4.8 | 2026-09-23 | REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a… |
CVE-2026-63000 | Medium | 6.4 | 2026-09-23 | REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php in… |
CVE-2026-62998 | Medium | 4.3 | 2026-09-23 | REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in redaxo/src/core/lib/list.php accepts the sort request parameter… |
CVE-2026-61834 | Medium | 4.3 | 2026-09-23 | scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate() reads inherited properties and assign() uses prototype-chain membership… |
CVE-2026-61413 | Medium | 6.8 | 2026-09-23 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Privilege Management vulnerability. A low privileged attac… |
CVE-2026-18179 | Medium | 6.5 | 2026-09-23 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to clear active chat sessions due to improper authorization. |
CVE-2026-84091 | Medium | 5.3 | 2026-09-23 | The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before… |
CVE-2026-77112 | Medium | 6.5 | 2026-09-23 | Server-Side request forgery (SSRF) vulnerability in Global IT Informatics Technology Services Inc. Weoll allows Server Side Request Forgery. This issue affect… |
CVE-2026-96446 | Medium | 4.2 | 2026-09-23 | A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none is used… |
CVE-2026-96445 | Medium | 6.8 | 2026-09-23 | A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates speci… |
CVE-2026-80444 | Medium | 5.4 | 2026-09-23 | URL redirection to untrusted site ('open redirect') vulnerability in Abis Technology Ltd. Co. AVESİS allows Input Data Manipulation. This issue affects AVESİS… |
CVE-2026-73581 | Medium | 6.5 | 2026-09-23 | Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate use… |
CVE-2026-96456 | Medium | 6.3 | 2026-09-23 | The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an a… |
CVE-2026-90950 | Medium | 5.3 | 2026-09-23 | The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handler when a form field is absent from the… |
CVE-2026-87978 | Medium | 5.3 | 2026-09-23 | The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated… |
CVE-2026-87071 | Medium | 5.3 | 2026-09-23 | The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, and does not exclude the keys WordPre… |
CVE-2026-87070 | Medium | 5.3 | 2026-09-23 | The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding hea… |
CVE-2026-86612 | Medium | 5.6 | 2026-09-23 | The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table rows which, in a non-default configuratio… |
CVE-2026-86604 | Medium | 4.8 | 2026-09-23 | The GTranslate WordPress plugin before 5.0.1 does not remove shortcodes from the content of outgoing emails before expanding them which, in a non-default confi… |
CVE-2026-86601 | Medium | 6.5 | 2026-09-23 | The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metad… |
CVE-2026-96443 | Medium | 6.5 | 2026-09-23 | Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE. |
CVE-2026-94251 | Medium | 6.5 | 2026-09-23 | A vulnerability in Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource This issue affects Apache Sling… |
CVE-2026-92001 | Medium | 6.1 | 2026-09-23 | Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS… |
CVE-2026-91999 | Medium | 6.1 | 2026-09-23 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS… |
CVE-2026-91928 | Medium | 6.1 | 2026-09-23 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS… |
CVE-2026-91852 | Medium | 6.1 | 2026-09-23 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS… |
CVE-2026-73192 | Medium | 6.1 | 2026-09-23 | An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the XSSAPI.getValidHref() in Apache S… |
CVE-2026-95625 | Medium | 5.9 | 2026-09-23 | The Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes. The update manifest -- which c… |
CVE-2026-91817 | Medium | 6.1 | 2026-09-23 | A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of wide strings in embedded PDF JavaScript. Insufficient validation… |
CVE-2026-91814 | Medium | 5.3 | 2026-09-23 | A signature validation vulnerability exists in Foxit PDF Editor/Reader’s handling of incrementally updated PDF documents. Changes to visible document content m… |
CVE-2026-91810 | Medium | 6.1 | 2026-09-23 | A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF image masks. Inconsistent image metadata may cause… |
CVE-2026-91808 | Medium | 6.1 | 2026-09-23 | A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor Reader’s handling of PDF image objects with inconsistent compression metadata. Insuffi… |
CVE-2026-91807 | Medium | 6.1 | 2026-09-23 | A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed image soft-mask data. Insufficient validation of the so… |
CVE-2026-91796 | Medium | 6.1 | 2026-09-23 | The interface of Foxit PDF Editor/Reader lacks the permission verification for secure reading mode, which allows specially crafted PDFs to trigger external SMB… |
CVE-2026-91788 | Medium | 4.7 | 2026-09-23 | When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perform the attribute authorization checks required by the specification. As a resu… |
CVE-2026-6831 | Medium | 6.5 | 2026-09-23 | The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 2.0.9. This is due to the plug… |
CVE-2026-5924 | Medium | 6.4 | 2026-09-23 | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps block's 'customStyle' attribute in all vers… |
CVE-2026-93511 | Medium | 5.3 | 2026-09-23 | The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowi… |
CVE-2026-93510 | Medium | 4.3 | 2026-09-23 | The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim… |
CVE-2026-91073 | Medium | 6.8 | 2026-09-23 | The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputting it in a page, allowing authenticated… |
CVE-2026-91025 | Medium | 4.3 | 2026-09-23 | The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific… |
CVE-2026-91024 | Medium | 6.8 | 2026-09-23 | The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL… |
CVE-2026-90985 | Medium | 5.3 | 2026-09-23 | The WPC Smart Compare for WooCommerce WordPress plugin before 6.6.1 does not apply WordPress's post-password protection when returning product content through… |
CVE-2026-89331 | Medium | 5.3 | 2026-09-23 | The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature, allowing unauthe… |
CVE-2026-88997 | Medium | 6.8 | 2026-09-23 | The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute i… |
CVE-2026-88929 | Medium | 5.3 | 2026-09-23 | The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin before 7.5.2 does not check whether a product is published before returning its det… |
CVE-2026-87981 | Medium | 4.7 | 2026-09-23 | The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway con… |
CVE-2026-87979 | Medium | 5.3 | 2026-09-23 | The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unaut… |
CVE-2026-86842 | Medium | 6.8 | 2026-09-23 | The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users… |
CVE-2026-86785 | Medium | 5.3 | 2026-09-23 | The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its REST API endpoints, allowing unauthenticat… |
CVE-2026-86783 | Medium | 5.3 | 2026-09-23 | The Post Grid Gutenberg Blocks WordPress plugin before 5.0.41 does not perform an authorization or post-visibility check on a REST API route that returns the… |