Medium-severity CVEs (page 82)
Page 82 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-59648 | Medium | 5.3 | 2026-08-03 | In Bouncy Castle for Java before 1.85, OpenPGP Argon2 S2K honours attacker-chosen memory and passes. This issue also affects Bouncy Castle for Java LTS before… |
CVE-2026-59647 | Medium | 5.3 | 2026-08-03 | In Bouncy Castle for Java before 1.85, CRMF/CMP password-MAC honours unbounded iteration count. This issue also affects Bouncy Castle for Java LTS before 2.73… |
CVE-2026-59641 | Medium | 5.3 | 2026-08-03 | In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation. This issue also affects Bouncy Castle for Java… |
CVE-2026-59640 | Medium | 5.3 | 2026-08-03 | In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check oracle active on symmetric/session-key paths. This issue also affects Bouncy Castle for Java LTS… |
CVE-2026-59638 | Medium | 6.5 | 2026-08-03 | In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle f… |
CVE-2026-68583 | Medium | 5.4 | 2026-08-02 | luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inj… |
CVE-2026-68582 | Medium | 6.5 | 2026-08-02 | Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/… |
CVE-2025-71401 | Medium | 5.9 | 2026-08-02 | better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unset). An attacker a… |
CVE-2026-12231 | Medium | 6.4 | 2026-08-02 | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ exad_infobox_image’ parameter in all versions up… |
CVE-2026-18573 | Medium | 6.5 | 2026-08-02 | A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows. The issue occurs when a rea… |
CVE-2026-18572 | Medium | 6.5 | 2026-08-02 | Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access du… |
CVE-2026-18571 | Medium | 6.6 | 2026-08-02 | A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a sub-administrator… |
CVE-2026-18570 | Medium | 5.4 | 2026-08-02 | A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. This component is responsible for enforcing security… |
CVE-2026-16292 | Medium | 5.4 | 2026-08-02 | The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation on one of its file-metadata update actions, allowing an attack… |
CVE-2026-16291 | Medium | 4.3 | 2026-08-02 | The ProfileGrid WordPress plugin before 5.9.9.8 does not verify that a notification belongs to the requesting user before deleting it, allowing any authentica… |
CVE-2026-16273 | Medium | 4.6 | 2026-08-02 | The Narrative Publisher WordPress plugin through 1.0.7 does not restrict write access to a REST-exposed post meta field or escape it when rendering, allowing u… |
CVE-2026-16064 | Medium | 5.4 | 2026-08-02 | The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing… |
CVE-2026-16063 | Medium | 5.4 | 2026-08-02 | The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not sanitise or escape event timeline content submitted by users with post-editin… |
CVE-2026-16062 | Medium | 6.6 | 2026-08-02 | The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not prevent the deserialization of user-controlled input in some of its event con… |
CVE-2026-16042 | Medium | 4.3 | 2026-08-02 | The LWS Optimize WordPress plugin before 3.4 does not perform a capability check on its cache-clearing actions, allowing any authenticated user, including Sub… |
CVE-2026-15385 | Medium | 5.4 | 2026-08-02 | The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item set… |
CVE-2026-15248 | Medium | 5.5 | 2026-08-02 | The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied attachment before deleting it, allowing users with… |
CVE-2026-14938 | Medium | 4.3 | 2026-08-02 | The FluentBoards WordPress plugin before 1.95.3 does not verify that the items selected for a board import operation belong to a board the requesting user is… |
CVE-2026-14864 | Medium | 5.4 | 2026-08-02 | The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its shortcodes, allowing users with the Cont… |
CVE-2026-14841 | Medium | 6.1 | 2026-08-02 | The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before reflecting it into an HTML attribute in an u… |
CVE-2026-14817 | Medium | 6.8 | 2026-08-02 | The Element Pack Addons for Elementor WordPress plugin before 8.7.13 does not sanitize option values passed through certain data attributes before a bundled f… |
CVE-2026-13389 | Medium | 6.5 | 2026-08-02 | The webtoffee-cookie-consent WordPress plugin before 3.5.3 does not perform authorization checks on several of its REST API routes, allowing unauthenticated at… |
CVE-2026-11872 | Medium | 4.3 | 2026-08-02 | The Clever Mega Menu for Visual Composer WordPress plugin through 1.0.1 does not perform a nonce or capability check in an AJAX action that updates navigation… |
CVE-2025-15675 | Medium | 4.8 | 2026-08-02 | The Charitable WordPress plugin before 1.8.5.3 does not sanitise and escape one of its campaign image text fields before outputting it in an HTML attribute, a… |
CVE-2026-9335 | Medium | 6.5 | 2026-08-02 | A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The… |
CVE-2026-67355 | Medium | 5.9 | 2026-08-01 | guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as ho… |
CVE-2026-67354 | Medium | 5.9 | 2026-08-01 | guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When the optional allow_redirects.referer setti… |
CVE-2026-67353 | Medium | 5.3 | 2026-08-01 | guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no siz… |
CVE-2026-67344 | Medium | 4.3 | 2026-08-01 | ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL opera… |
CVE-2026-67339 | Medium | 5.3 | 2026-08-01 | guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. Attackers can capture proxy… |
CVE-2026-67338 | Medium | 6.1 | 2026-08-01 | JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata… |
CVE-2026-67337 | Medium | 6.5 | 2026-08-01 | better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is enabled. Attackers with valid primary cr… |
CVE-2026-67335 | Medium | 5.3 | 2026-08-01 | better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored nonce when using cookie-backed state storage without PKCE. Atta… |
CVE-2026-67332 | Medium | 6.4 | 2026-08-01 | @better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing clients to request tokens for unrelate… |
CVE-2026-67318 | Medium | 5.3 | 2026-08-01 | axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVe… |
CVE-2026-67314 | Medium | 6.5 | 2026-08-01 | axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolve… |
CVE-2026-67311 | Medium | 6.8 | 2026-08-01 | Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against th… |
CVE-2026-67310 | Medium | 5.4 | 2026-08-01 | OpenRemote (org.openremote:openremote) versions <= 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResou… |
CVE-2026-67307 | Medium | 6.3 | 2026-08-01 | Wazuh 5.0.0-beta1 (fixed in 5.0.0-beta3) does not validate or override the cluster_name and cluster_node fields in inventory-sync Start FlatBuffer messages, wh… |
CVE-2026-67306 | Medium | 5.4 | 2026-08-01 | FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder functions planar_decompress_plane_rle and… |
CVE-2026-67303 | Medium | 4.3 | 2026-08-01 | FreeRDP before 3.29.0 contains a reachable assertion (WINPR_ASSERT(OutputBufferLength == BytesReturned)) in serial_process_irp_device_control() in channels/ser… |
CVE-2026-67302 | Medium | 4.3 | 2026-08-01 | FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecam_dev_process_start_st… |
CVE-2026-67295 | Medium | 6.3 | 2026-08-01 | FreeRDP before 3.29.0 fails to properly validate server-supplied RDPDR paths in drive redirection, allowing attackers to access prefix-sibling paths outside th… |
CVE-2026-67294 | Medium | 5.9 | 2026-08-01 | FreeRDP before 3.29.0 improperly validates the Extended Key Usage (EKU) purpose of the peer certificate during client-side server TLS authentication. In x509_u… |
CVE-2026-67293 | Medium | 4.2 | 2026-08-01 | FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains an improper certificate hostname validation vulnerability. The TLS hostname matcher (tls_match_hos… |
CVE-2026-67292 | Medium | 6.5 | 2026-08-01 | FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport (libfreerdp/core/gateway/websocket.c). The client's Po… |
CVE-2026-2411 | Medium | 6.5 | 2026-08-01 | Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration whose permission is hard-coded to BT_GATT_PE… |
CVE-2026-10773 | Medium | 5.4 | 2026-08-01 | The DHCPv4 client helper net_dhcpv4_msg_type_name() in subsys/net/lib/dhcpv4/dhcpv4.c indexes a static 8-element const char * name table after a faulty bounds… |
CVE-2026-6453 | Medium | 6.5 | 2026-08-01 | The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitiza… |
CVE-2026-18435 | Medium | 6.4 | 2026-08-01 | The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'toggleIcon' Block Attribu… |
CVE-2026-18344 | Medium | 6.1 | 2026-08-01 | The Wp Responsive Thumbnail Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in versions up to, and excluding… |
CVE-2026-18062 | Medium | 6.4 | 2026-08-01 | The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Identity Block Inner Image… |
CVE-2026-18059 | Medium | 5.3 | 2026-08-01 | The PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includ… |
CVE-2026-17605 | Medium | 6.6 | 2026-08-01 | The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and includ… |
CVE-2026-17580 | Medium | 6.5 | 2026-08-01 | The Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin for WordPre… |
CVE-2026-17571 | Medium | 6.1 | 2026-08-01 | The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting… |
CVE-2026-17555 | Medium | 4.9 | 2026-08-01 | The WPvivid Backup & Migration plugin for WordPress is vulnerable to SQL Injection via the export_data parameter in versions up to, and including, 0.9.131. Thi… |
CVE-2026-16685 | Medium | 6.4 | 2026-08-01 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' Shortcode Attribute in all versions up to, and including, 3.3… |
CVE-2026-16684 | Medium | 6.4 | 2026-08-01 | The Easy Property Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'facebook' User Contact Method in all versions up to, and incl… |
CVE-2026-16614 | Medium | 4.9 | 2026-08-01 | The GSheetConnector – CF7 Google Sheets Connector with Real-Time Sync plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all… |
CVE-2026-16091 | Medium | 6.4 | 2026-08-01 | The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripti… |
CVE-2026-16090 | Medium | 6.4 | 2026-08-01 | The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripti… |
CVE-2026-16087 | Medium | 6.5 | 2026-08-01 | The Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin for WordPress is vulnerable to second-order SQL Injection via 'messages[][id]' Parameter in… |
CVE-2026-15951 | Medium | 4.9 | 2026-08-01 | The Icegram Mailer plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter in versions up to, and including, 1.0.12. This is due to insu… |
CVE-2026-15950 | Medium | 6.4 | 2026-08-01 | The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2026-15662 | Medium | 6.4 | 2026-08-01 | The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bg_color' paramete… |
CVE-2026-15649 | Medium | 6.4 | 2026-08-01 | The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to… |
CVE-2026-15645 | Medium | 6.4 | 2026-08-01 | The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'nav' Shortcode Attribute in all versions… |
CVE-2026-15644 | Medium | 6.4 | 2026-08-01 | The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all version… |
CVE-2026-15601 | Medium | 4.9 | 2026-08-01 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal (Zip Slip) in all versions up to, and incl… |
CVE-2026-15018 | Medium | 5.3 | 2026-08-01 | The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to… |
CVE-2026-13458 | Medium | 6.4 | 2026-08-01 | The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes in all versions up to, and in… |
CVE-2026-11995 | Medium | 5.3 | 2026-08-01 | The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to authorization bypass i… |
CVE-2026-10782 | Medium | 4.3 | 2026-08-01 | The RealHomes Memberships plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.9. This is due to the plugin not… |
CVE-2025-14073 | Medium | 5.3 | 2026-08-01 | The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versio… |
CVE-2026-2916 | Medium | 4.3 | 2026-08-01 | The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 via the `enqueue_scr… |
CVE-2025-14469 | Medium | 4.3 | 2026-08-01 | The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1. This is due to missing nonce valid… |
CVE-2026-15932 | Medium | 5.3 | 2026-08-01 | The Support Genix WordPress plugin before 1.4.48 does not prevent directory traversal in its ticket-attachment download route, allowing unauthenticated attack… |
CVE-2026-15262 | Medium | 5.4 | 2026-08-01 | The Admin Columns for ACF Fields WordPress plugin through 0.3.2 does not escape Advanced Custom Fields values before outputting them in the WordPress admin lis… |
CVE-2026-15234 | Medium | 5.4 | 2026-08-01 | The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize or validate a shortcode attribute before using it as an HTML tag name when rendering… |
CVE-2026-14840 | Medium | 5.3 | 2026-08-01 | The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when en… |
CVE-2026-14822 | Medium | 5.3 | 2026-08-01 | The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, all… |
CVE-2026-14561 | Medium | 6.5 | 2026-08-01 | The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid ve… |
CVE-2026-14315 | Medium | 6.5 | 2026-08-01 | The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.1 does not perform an authorization check on one of its AJAX actions, allowing unauthenticat… |
CVE-2026-14292 | Medium | 5.4 | 2026-08-01 | The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowin… |
CVE-2026-13729 | Medium | 4.3 | 2026-08-01 | The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing… |
CVE-2026-13604 | Medium | 5.3 | 2026-08-01 | The Pixelavo WordPress plugin before 1.5.4 registers an unauthenticated AJAX action, gated only by a nonce that it emits publicly on every front-end page, tha… |
CVE-2026-13329 | Medium | 6.5 | 2026-08-01 | The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capability check or nonce validation on an AJAX action that process… |
CVE-2026-12966 | Medium | 5.3 | 2026-08-01 | The Direct Payments for WooCommerce WordPress plugin before 2.5.3 does not verify that the requester owns the targeted WooCommerce order in several unauthenti… |
CVE-2026-12696 | Medium | 5.4 | 2026-08-01 | The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public pa… |
CVE-2025-15669 | Medium | 4.8 | 2026-08-01 | The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before rendering it on the public-facing form, al… |
CVE-2026-7623 | Medium | 6.4 | 2026-08-01 | The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headingWrappe… |
CVE-2026-15403 | Medium | 4.9 | 2026-08-01 | The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to blind SQL Injection via the 'field' parameter in all versions up to, and includin… |
CVE-2026-13362 | Medium | 6.4 | 2026-08-01 | The SendPulse Email Marketing Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via _sp_form_code Post Meta in all versions up to, a… |
CVE-2026-54909 | Medium | 5.3 | 2026-07-31 | pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in… |