Medium-severity CVEs (page 8)
Page 8 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-24329 | Medium | 4.9 | 2026-08-11 | A flaw was found in wildfly-core. A remote user authenticated as an administrative user can inject a malformed payload into the Inet Address field through the… |
CVE-2026-66779 | Medium | 6.3 | 2026-08-11 | Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP, an authenticated attacker could generate a malicious link and make… |
CVE-2026-66778 | Medium | 5.3 | 2026-08-11 | SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components. An unauthenticated attacker could send a… |
CVE-2026-66777 | Medium | 5.9 | 2026-08-11 | SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend destinations. Due to the complexity of the required co… |
CVE-2026-66776 | Medium | 5.9 | 2026-08-11 | SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low p… |
CVE-2026-66775 | Medium | 4.3 | 2026-08-11 | SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious… |
CVE-2026-66773 | Medium | 5.9 | 2026-08-11 | A malicious or compromised OData service could disclose sensitive authentication information and inject untrusted data into the application, which may leads to… |
CVE-2026-66772 | Medium | 4.3 | 2026-08-11 | SAP BusinessObjects Business Intelligence Platform (Admin Tools) does not perform sufficient authorization check on certain administrative functionality. An a… |
CVE-2026-66771 | Medium | 6.1 | 2026-08-11 | SAPUI5 allows a key user with content adaptation privileges to inject malicious script content into persisted application changes. When another user subsequent… |
CVE-2026-66770 | Medium | 6.3 | 2026-08-11 | Due to an SQL Injection vulnerability in SAP Social intelligence, an authenticated attacker could directly inject an SQL DDL (Data Definition Language) string… |
CVE-2026-66764 | Medium | 4.3 | 2026-08-11 | Reprocess Bank Statement Items in SAP S/4HANA does not perform the necessary authorization checks for authenticated users, allowing them to use rules that have… |
CVE-2026-66761 | Medium | 4.3 | 2026-08-11 | SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consum… |
CVE-2026-66760 | Medium | 6.4 | 2026-08-11 | SAP Approuter does not correctly validate client certificates in certain callback flows. An attacker with low privileges, holding a certificate from the same t… |
CVE-2026-58248 | Medium | 6.5 | 2026-08-11 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence) allows a low-privileged attacker to upload a specially crafted spreadsheet file containin… |
CVE-2026-58247 | Medium | 5.3 | 2026-08-11 | SAP ABAP Platform allows an unauthenticated user to send a specially crafted request to an internal component. This could disclose limited, non-sensitive data… |
CVE-2026-58244 | Medium | 4.3 | 2026-08-11 | SAP Manufacturing Integration and Intelligence (MII) does not perform necessary authorization check on certain application function, allowing a low-privileged… |
CVE-2026-58241 | Medium | 4.2 | 2026-08-11 | SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard) allows a low-privileged user to modify configuration tabl… |
CVE-2026-58238 | Medium | 5.9 | 2026-08-11 | SAP Approuter does not sufficiently handle certain requests under specific conditions. An unauthenticated attacker could send specially crafted input that caus… |
CVE-2026-58237 | Medium | 5.9 | 2026-08-11 | WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality. An attacker with low privileges could exploit this to acc… |
CVE-2026-58236 | Medium | 5.5 | 2026-08-11 | SAP NetWeaver Application Server ABAP and ABAP Platform allow an attacker with high privileges to bypass missing security controls on an internal code path lea… |
CVE-2026-58235 | Medium | 6.3 | 2026-08-11 | SAP NetWeaver Application Server Java (Adobe Document Service) uses outdated open source cryptographic and data transfer libraries that contain known vulnerabi… |
CVE-2026-40130 | Medium | 5.3 | 2026-08-11 | SAP SAPSPrint Service has memory corruption vulnerabilities in the handling of certain commands. An unauthenticated attacker could send specially crafted reque… |
CVE-2026-72919 | Medium | 4.3 | 2026-08-10 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the c… |
CVE-2026-72918 | Medium | 5.4 | 2026-08-10 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the s… |
CVE-2026-72917 | Medium | 5.9 | 2026-08-10 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's… |
CVE-2026-6426 | Medium | 4.4 | 2026-08-10 | A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by th… |
CVE-2026-73035 | Medium | 4.3 | 2026-08-10 | npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitra… |
CVE-2026-73033 | Medium | 6.5 | 2026-08-10 | Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission() method in src/integrity.lib.php… |
CVE-2026-72912 | Medium | 4.3 | 2026-08-10 | CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can ex… |
CVE-2026-72908 | Medium | 6.5 | 2026-08-10 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the get_tax_template function in erpnext/accounts/doctype/t… |
CVE-2026-72907 | Medium | 6.5 | 2026-08-10 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the add_ac function in erpnext/accounts/utils.py accepts th… |
CVE-2026-72906 | Medium | 4.3 | 2026-08-10 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the send_auto_email function in erpnext/accounts/doctype/pr… |
CVE-2026-72743 | Medium | 5.4 | 2026-08-10 | SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE out… |
CVE-2026-18942 | Medium | 5.5 | 2026-08-10 | A flaw was found in the Feast operator. A malicious tenant could inject arbitrary code into their feature repository. This code would be executed by an automat… |
CVE-2026-16456 | Medium | 6.5 | 2026-08-10 | A flaw was found in the `odh-model-controller`. An authenticated user with permissions to create custom resources can exploit a vulnerability in the `loadSecre… |
CVE-2026-72873 | Medium | 6.5 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, application.one in apps/dokploy/server/api/routers/application.ts returns prov… |
CVE-2026-69116 | Medium | 6.1 | 2026-08-10 | FlyEnv before 4.18.0 fails to sanitize HTML from markdown rendering and AI chat content passed to Vue v-html directives. Attackers can inject malicious scripts… |
CVE-2026-69114 | Medium | 6.5 | 2026-08-10 | Spacebar Server before commit 8d126f4 contains a cross-channel message deletion vulnerability in the single-delete and bulk-delete message handlers that fail t… |
CVE-2026-44401 | Medium | 4.8 | 2026-08-10 | Typemill CMS version 2.x contains a persistent cross-site scripting vulnerability in the Markdown parser extension that allows authenticated users with theme-c… |
CVE-2026-71969 | Medium | 6.7 | 2026-08-10 | OP-TEE OS through 4.10.0, fixed in commit 7b8b494, contains a buffer underwrite vulnerability in the RSA NOPAD encrypt and decrypt operations within the mbedTL… |
CVE-2026-71968 | Medium | 6.7 | 2026-08-10 | OP-TEE OS through 4.10.0, fixed in commit 8794043, contains a use-after-free vulnerability in the Trusted Application loader that allows attackers with the abi… |
CVE-2026-71967 | Medium | 5.5 | 2026-08-10 | OP-TEE OS through 4.10.0, fixed in commit 0aadfc2, contains a null pointer dereference vulnerability in the Widevine pseudo-TA open_session handler that allows… |
CVE-2026-71964 | Medium | 6.5 | 2026-08-10 | CyberPanel 2.4.3, fixed in commit eca0c3c, contains an arbitrary file read vulnerability in the file manager component that allows authenticated attackers to r… |
CVE-2026-68872 | Medium | 6.5 | 2026-08-10 | The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id throu… |
CVE-2026-68871 | Medium | 6.5 | 2026-08-10 | The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when t… |
CVE-2026-68870 | Medium | 5.3 | 2026-08-10 | The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connection or Variable id through the team-agnostic loo… |
CVE-2026-72900 | Medium | 6.5 | 2026-08-10 | Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database. |
CVE-2026-72739 | Medium | 6.5 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the createCommand() function constructs shell commands by interpolating compos… |
CVE-2026-72732 | Medium | 4.3 | 2026-08-10 | Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse_templates endpoint exposed hidden tag names… |
CVE-2026-70622 | Medium | 6.5 | 2026-08-10 | tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::append_dir_all() function that allows attackers to read files outs… |
CVE-2026-72728 | Medium | 6.3 | 2026-08-10 | Discourse is an open-source discussion platform. Prior to 2026.1.7, an authenticated user could submit specially formed URLs that bypassed the Onebox allowlist… |
CVE-2026-71577 | Medium | 6.3 | 2026-08-10 | A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communica… |
CVE-2026-63623 | Medium | 5.5 | 2026-08-10 | A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by… |
CVE-2026-56619 | Medium | 5.4 | 2026-08-10 | HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS) due to insufficient validation and output encoding of user-controlled input. |
CVE-2026-12624 | Medium | 4.3 | 2026-08-10 | Vault’s ACL policy engine did not consistently enforce a wildcard (glob) deny rule against LIST requests made with a trailing slash on the denied path. This ma… |
CVE-2026-72726 | Medium | 6.5 | 2026-08-10 | Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an authenticated user could eavesdrop on private AI bot c… |
CVE-2026-72725 | Medium | 5.4 | 2026-08-10 | Discourse is an open-source discussion platform. Prior to 2026.1.6, the staff action log model rendered unescaped previous and new value fields that could inje… |
CVE-2026-72724 | Medium | 4.3 | 2026-08-10 | Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/chat/onebox_handler.rb resolves Chat::Th… |
CVE-2026-72723 | Medium | 5.3 | 2026-08-10 | Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, SiteSerializer.anonymous_default_navigation_menu_tags ser… |
CVE-2026-72722 | Medium | 4.3 | 2026-08-10 | Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, TopicLink.extract_from, TopicLink.ensure_entry_for, and T… |
CVE-2026-72721 | Medium | 5.3 | 2026-08-10 | Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Onebox::DomainChecker.is_blocked? compares hostnames and… |
CVE-2026-72720 | Medium | 6.4 | 2026-08-10 | Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse has HTML injection in PrettyText.forma… |
CVE-2026-72719 | Medium | 6.7 | 2026-08-10 | Chatwoot is a customer engagement suite. Prior to 4.9.0, Chatwoot allowed authenticated account administrators to transfer Portals, Automation Rules, Macros, a… |
CVE-2026-56620 | Medium | 4.3 | 2026-08-10 | HCL BigFix Mobile is vulnerable to information disclosure due to improper handling of exceptions and verbose error reporting. |
CVE-2026-71959 | Medium | 5.8 | 2026-08-10 | Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /collect request body, allowing any authe… |
CVE-2026-63105 | Medium | 5.4 | 2026-08-10 | ReadyEcommerce before 4.5.2 contains a stored cross-site scripting (XSS) vulnerability that allows authenticated customers to inject malicious HTML payloads th… |
CVE-2026-16742 | Medium | 6.7 | 2026-08-10 | systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user |
CVE-2026-15060 | Medium | 4.7 | 2026-08-10 | When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged use… |
CVE-2026-15059 | Medium | 5.5 | 2026-08-10 | Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation. |
CVE-2026-6373 | Medium | 6.5 | 2026-08-10 | Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allows Web Application Fingerprinting. This… |
CVE-2026-19278 | Medium | 6.8 | 2026-08-10 | A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine (M2M) token exchange. When an administrator configures M2M role mappings, the system uses… |
CVE-2026-59088 | Medium | 5.5 | 2026-08-10 | A flaw was found in GIMP. A signed integer overflow vulnerability exists in the `file-fli` plugin when processing FLI image files. This occurs due to an incorr… |
CVE-2026-72588 | Medium | 5.3 | 2026-08-10 | A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address… |
CVE-2026-72587 | Medium | 6.1 | 2026-08-10 | A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache b… |
CVE-2026-72585 | Medium | 6.5 | 2026-08-10 | An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points (receivers) without the required… |
CVE-2026-72583 | Medium | 5.4 | 2026-08-10 | A stored cross-site scripting (XSS) vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated user to upload an SVG file containing mal… |
CVE-2026-72576 | Medium | 5.4 | 2026-08-10 | A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript… |
CVE-2026-72574 | Medium | 6.1 | 2026-08-10 | A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS asset… |
CVE-2026-72570 | Medium | 5.4 | 2026-08-10 | A stored cross-site scripting (XSS) vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web int… |
CVE-2026-66642 | Medium | 5.4 | 2026-08-10 | Cross-Site Request Forgery (CSRF) vulnerability in WP Umbrella allows Cross Site Request Forgery. This issue affects WP Umbrella: from 2.24.2 through 2.26.2. |
CVE-2026-65945 | Medium | 6.5 | 2026-08-10 | Logs contain replayable JWT tokens in Apache Ranger versions <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue. |
CVE-2026-19404 | Medium | 6.5 | 2026-08-10 | A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, all… |
CVE-2026-66411 | Medium | 5.3 | 2026-08-10 | DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications. An unauthenticated attacker may connect and ope… |
CVE-2026-66410 | Medium | 4.8 | 2026-08-10 | Android and iOS apps ECOVACS PRO App improperly validate server certificates. Communication may be retrieved and/or altered. |
CVE-2026-66409 | Medium | 5.3 | 2026-08-10 | DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password may be analyzed and obtained to connect t… |
CVE-2026-66408 | Medium | 4.6 | 2026-08-10 | The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords. Physical access to an affected product may allow to obtain the pas… |
CVE-2026-66406 | Medium | 4.8 | 2026-08-10 | DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle attack may allow to obtain and/or alter c… |
CVE-2026-66404 | Medium | 6.5 | 2026-08-10 | DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activity logs stored on the affected products… |
CVE-2026-57279 | Medium | 6.8 | 2026-08-10 | Cybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of a us… |
CVE-2026-19077 | Medium | 6.5 | 2026-08-10 | The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user who… |
CVE-2026-19075 | Medium | 5.0 | 2026-08-10 | All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by `?vdl=<post_id>` on any `aiovg_videos` post (`public/video.php`… |
CVE-2026-19074 | Medium | 5.3 | 2026-08-10 | The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 (<= 3.4.2) is vulnerable to unauthenticated sensiti… |
CVE-2026-18960 | Medium | 5.4 | 2026-08-10 | The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an appl… |
CVE-2026-18934 | Medium | 5.5 | 2026-08-10 | The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the req… |
CVE-2026-18666 | Medium | 4.3 | 2026-08-10 | The Library Management System WordPress plugin before 3.6.7 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing… |
CVE-2026-18200 | Medium | 4.3 | 2026-08-10 | The FoodBoxBooker WordPress plugin before 1.0.8 does not verify that the user account being updated belongs to the user making the request, allowing authentica… |
CVE-2026-17023 | Medium | 4.8 | 2026-08-10 | The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar autho… |
CVE-2026-17021 | Medium | 5.3 | 2026-08-10 | The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verif… |
CVE-2026-17020 | Medium | 4.3 | 2026-08-10 | The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, req… |
CVE-2026-17019 | Medium | 6.1 | 2026-08-10 | The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can u… |