Medium-severity CVEs (page 86)
Page 86 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-62363 | Medium | 5.0 | 2026-07-30 | ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, a heap buffer over-write can occu… |
CVE-2026-62343 | Medium | 4.7 | 2026-07-30 | ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 6.9.13-51 and 7.0.1-0 and above prior to 7… |
CVE-2026-15157 | Medium | 4.2 | 2026-07-29 | undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In und… |
CVE-2026-14643 | Medium | 5.9 | 2026-07-29 | undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici f… |
CVE-2026-67439 | Medium | 4.3 | 2026-07-29 | OliveTin gives safe and simple access to predefined shell commands from a web interface. Prior to 3000.17.0, the service/internal/api/api.go StartActionAndWait… |
CVE-2026-67438 | Medium | 6.6 | 2026-07-29 | OliveTin gives access to predefined shell commands from a web interface. From 3000.2.0 until 3000.17.0, the service/internal/executor/arguments.go checkShellAr… |
CVE-2026-65975 | Medium | 6.5 | 2026-07-29 | Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.88.0 up to but not including 1.107.1 and 2.0… |
CVE-2026-54249 | Medium | 6.8 | 2026-07-29 | Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.65.0 through 1.105.0, and 2.0.0b1 through 2.0.0b5, a client that… |
CVE-2026-46678 | Medium | 6.8 | 2026-07-29 | Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.56.0 through 1.98.0, when an application opts a URL into force_d… |
CVE-2026-16728 | Medium | 4.8 | 2026-07-29 | undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume… |
CVE-2026-13309 | Medium | 6.8 | 2026-07-29 | Autel MaxiCharger AC Elite Home NFC Stack-based Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers… |
CVE-2026-13307 | Medium | 6.8 | 2026-07-29 | Autel MaxiCharger AC Elite Home USB Heap-based Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers t… |
CVE-2026-13306 | Medium | 4.3 | 2026-07-29 | Autel MaxiCharger AC Elite Home USB Authentication Bypass Vulnerability. This vulnerability allows physically present attackers to bypass authentication on aff… |
CVE-2026-13305 | Medium | 6.4 | 2026-07-29 | Autel MaxiCharger AC Elite Home Software Update Improper Verification of Cryptographic Signature Arbitrary Code Execution Vulnerability. This vulnerability all… |
CVE-2025-65337 | Medium | 6.1 | 2026-07-29 | Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting (XSS) in pageEditMember.php via the address field. |
CVE-2026-6336 | Medium | 5.3 | 2026-07-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain co… |
CVE-2026-67430 | Medium | 5.3 | 2026-07-29 | MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the… |
CVE-2026-63119 | Medium | 6.2 | 2026-07-29 | MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StdioTransport and MCP::Client… |
CVE-2026-5492 | Medium | 6.5 | 2026-07-29 | DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected in… |
CVE-2026-5489 | Medium | 5.3 | 2026-07-29 | DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected in… |
CVE-2026-4672 | Medium | 4.3 | 2026-07-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain co… |
CVE-2026-3093 | Medium | 4.7 | 2026-07-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain co… |
CVE-2026-18266 | Medium | 5.4 | 2026-07-29 | Dify AI Workflow oauth_redirect_url Open Redirect Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected insta… |
CVE-2026-16553 | Medium | 5.4 | 2026-07-29 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain condi… |
CVE-2026-15831 | Medium | 4.3 | 2026-07-29 | GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allo… |
CVE-2026-15077 | Medium | 4.3 | 2026-07-29 | GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allo… |
CVE-2026-14351 | Medium | 4.3 | 2026-07-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain con… |
CVE-2026-14341 | Medium | 4.9 | 2026-07-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain co… |
CVE-2026-13113 | Medium | 6.5 | 2026-07-29 | GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain condi… |
CVE-2026-13346 | Medium | 6.5 | 2026-07-29 | pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wh… |
CVE-2026-59920 | Medium | 6.5 | 2026-07-29 | Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's STOMP encoder ( StompSubfram… |
CVE-2026-59919 | Medium | 5.5 | 2026-07-29 | Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's HAProxy encoder ( HAProxyMes… |
CVE-2026-59900 | Medium | 5.3 | 2026-07-29 | Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation… |
CVE-2026-54705 | Medium | 6.3 | 2026-07-29 | MathLive provides web components for math display and input. Prior to 0.110.0, MathLive fails to escape text-mode content in \text{} and \mbox{} commands in Bo… |
CVE-2026-13723 | Medium | 6.5 | 2026-07-29 | A vulnerability in the `zipx.Unzip` extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a U… |
CVE-2026-67194 | Medium | 6.5 | 2026-07-29 | Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH… |
CVE-2026-20316 | Medium | 5.3 | 2026-07-29 | A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an… |
CVE-2026-18257 | Medium | 5.6 | 2026-07-29 | Improper validity period check for root issuer certificate in CycloneCrypto cryptographic wrapper of S2OPC allows a certificate issued by this root issuer to b… |
CVE-2026-16729 | Medium | 4.8 | 2026-07-29 | undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9… |
CVE-2026-67193 | Medium | 5.3 | 2026-07-29 | Xlight FTP Server before 3.9.5 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the server's current GetTickCou… |
CVE-2026-54082 | Medium | 6.5 | 2026-07-29 | veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML Extern… |
CVE-2026-50558 | Medium | 5.9 | 2026-07-29 | Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download() implementation in penelope.py… |
CVE-2026-17550 | Medium | 5.5 | 2026-07-29 | A maliciously crafted DWG or DXF file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this… |
CVE-2026-16465 | Medium | 6.1 | 2026-07-29 | A maliciously crafted DWG or DXF file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this… |
CVE-2026-54663 | Medium | 6.1 | 2026-07-29 | swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts warmUpRemoteSchem… |
CVE-2026-67217 | Medium | 5.3 | 2026-07-29 | cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in cJSON_Utils.c. For a replace operation that is missing its value… |
CVE-2026-67216 | Medium | 5.9 | 2026-07-29 | cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared sub… |
CVE-2026-67214 | Medium | 5.9 | 2026-07-29 | nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). Wh… |
CVE-2026-67213 | Medium | 5.9 | 2026-07-29 | nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0… |
CVE-2026-66490 | Medium | 6.1 | 2026-07-29 | Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2 |
CVE-2026-66489 | Medium | 5.3 | 2026-07-29 | Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2 |
CVE-2026-66488 | Medium | 5.3 | 2026-07-29 | Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2 |
CVE-2026-66400 | Medium | 4.8 | 2026-07-29 | Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet() method fails to p… |
CVE-2026-18174 | Medium | 5.3 | 2026-07-29 | @fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header contains two or more comma separated en… |
CVE-2026-16751 | Medium | 6.5 | 2026-07-29 | Authorization Bypass in the emergency recovery approval component in Ente Technologies Ente Museum Server allows an authenticated attacker configured as a vict… |
CVE-2026-65946 | Medium | 6.1 | 2026-07-29 | Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI < 9.11.0 |
CVE-2026-65891 | Medium | 6.5 | 2026-07-29 | Joomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename function in Joomla Content Editor (JCE) < 2.20.2… |
CVE-2026-8791 | Medium | 6.4 | 2026-07-29 | The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `bookingWebsiteUrl` setting in all versions up to, and incl… |
CVE-2026-7436 | Medium | 6.4 | 2026-07-29 | The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the `wpcbm_best_seller`… |
CVE-2026-6089 | Medium | 4.9 | 2026-07-29 | The WP CTA plugin for WordPress is vulnerable to Server-Side Request Forgery via the 'sticky_s_media' parameter in imported JSON files in all versions up to, a… |
CVE-2026-5060 | Medium | 6.5 | 2026-07-29 | The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions… |
CVE-2026-56390 | Medium | 6.3 | 2026-07-29 | GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted witho… |
CVE-2026-4604 | Medium | 5.3 | 2026-07-29 | The Klubraum Membership Request plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `kr_mr_store_s… |
CVE-2026-65100 | Medium | 4.8 | 2026-07-29 | Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder o… |
CVE-2026-58185 | Medium | 5.9 | 2026-07-29 | The Apache Traffic Server intercept plugin has a use-after-free. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14… |
CVE-2026-58183 | Medium | 5.9 | 2026-07-29 | The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input. This issue affects Apache Traffic Server: from 8.0.0 through 8… |
CVE-2026-58160 | Medium | 6.5 | 2026-07-29 | Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9… |
CVE-2026-58158 | Medium | 5.9 | 2026-07-29 | Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects Apache Traffic Server: from 8.0.0 throug… |
CVE-2026-18207 | Medium | 6.5 | 2026-07-29 | A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique i… |
CVE-2026-18201 | Medium | 5.5 | 2026-07-29 | Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permis… |
CVE-2026-9720 | Medium | 4.3 | 2026-07-29 | The Facturación Electrónica Costa Rica plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is du… |
CVE-2026-65325 | Medium | 4.8 | 2026-07-29 | Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname. This issue affect… |
CVE-2026-58156 | Medium | 4.9 | 2026-07-29 | Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0 t… |
CVE-2026-58152 | Medium | 5.9 | 2026-07-29 | Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory. This issue affects Apache Traffic Server: from 8.0.0 through… |
CVE-2026-11973 | Medium | 4.9 | 2026-07-29 | The WP-Lister Lite for eBay plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8… |
CVE-2026-35226 | Medium | 6.5 | 2026-07-29 | An out‑of‑bounds write vulnerability in the CODESYS PROFINET Controller allows an unauthenticated attacker on the same network segment to send malformed PROFIN… |
CVE-2026-33930 | Medium | 5.9 | 2026-07-29 | Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, so an over-long Host header overfl… |
CVE-2026-18197 | Medium | 6.1 | 2026-07-29 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Link Library allows Cross-Site Scripting (XSS). This iss… |
CVE-2026-18192 | Medium | 6.5 | 2026-07-29 | VIN-DS783E-E6 developed by Vacron has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to exploit Relative Path Traversal to downl… |
CVE-2026-63242 | Medium | 4.3 | 2026-07-29 | A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to completed via the SCORM commit endpoint… |
CVE-2026-63240 | Medium | 4.3 | 2026-07-29 | An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course status endpoint without … |
CVE-2026-63239 | Medium | 5.4 | 2026-07-29 | A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive d… |
CVE-2026-63238 | Medium | 6.5 | 2026-07-29 | An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts, by supply… |
CVE-2026-63237 | Medium | 4.8 | 2026-07-29 | A TOTP two-factor authentication bypass vulnerability in Koollab LMS allowed an attacker to supply a client-controlled seed to generate a matching one-time pas… |
CVE-2026-14224 | Medium | 5.4 | 2026-07-29 | The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data update action belongs to the current u… |
CVE-2026-13692 | Medium | 5.3 | 2026-07-29 | The PayU CommercePro Plugin WordPress plugin before 3.9.0 does not verify the payment-gateway signature before applying order modifications, allowing unauthent… |
CVE-2026-13605 | Medium | 6.8 | 2026-07-29 | The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM… |
CVE-2026-11351 | Medium | 5.3 | 2026-07-29 | The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints, allowing unauthenticated user… |
CVE-2026-5626 | Medium | 4.3 | 2026-07-29 | The Survey Form Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_all_data() function in all… |
CVE-2026-15344 | Medium | 4.9 | 2026-07-29 | The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all versions up to, and including, 9.2.04.002… |
CVE-2026-17166 | Medium | 4.3 | 2026-07-29 | The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress is vulnerable to authorization bypass… |
CVE-2026-17162 | Medium | 6.4 | 2026-07-29 | The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'currentPostId' Block Attri… |
CVE-2026-17161 | Medium | 6.4 | 2026-07-29 | The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'filterMobileText' Block At… |
CVE-2026-15735 | Medium | 6.4 | 2026-07-29 | The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cf7anyapi_form_field' Post Meta in all versions up to, and i… |
CVE-2026-12939 | Medium | 6.4 | 2026-07-29 | The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the post_thumbnail (and newsletters_post_thu… |
CVE-2026-12938 | Medium | 6.4 | 2026-07-29 | The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' attribute of the [newsletters_post] shortcode in versio… |
CVE-2026-66064 | Medium | 5.3 | 2026-07-28 | goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using… |
CVE-2026-66063 | Medium | 6.5 | 2026-07-28 | goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part… |
CVE-2026-59921 | Medium | 5.7 | 2026-07-28 | Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multi… |
CVE-2026-59943 | Medium | 5.3 | 2026-07-28 | Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can u… |