Medium-severity CVEs (page 87)
Page 87 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-46740 | Medium | 5.3 | 2026-05-26 | Mojolicious::Plugin::Statsd versions through 0.04 for Perl allowed metric injections. The metric names and set values were not checked for newlines, colons or… |
CVE-2026-9603 | Medium | 6.5 | 2026-05-26 | A security vulnerability has been detected in SourceCodester eDoc Doctor Appointment System 1.0. This affects an unknown part of the file /admin/delete-session… |
CVE-2026-48710 | Medium | 6.5 | 2026-05-26 | Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `r… |
CVE-2026-44903 | Medium | 6.1 | 2026-05-26 | Prometheus is an open-source monitoring system and time series database. From 2.49.0 to before 3.5.3 and 3.11.3, in the Prometheus server's legacy web UI (enab… |
CVE-2026-44788 | Medium | 5.9 | 2026-05-26 | SharpCompress is a fully managed C# library to deal with many compression types and formats. In 0.47.4 and earlier, a path traversal vulnerability in IArchive… |
CVE-2026-44213 | Medium | 6.5 | 2026-05-26 | The OpenTelemetry.Exporter.Instana exports telemetry to Instana backend. Prior to 1.1.0, the OpenTelemetry.Exporter.Instana NuGet package does not validate HTT… |
CVE-2026-42015 | Medium | 5.3 | 2026-05-26 | A flaw was found in gnutls. An off-by-one error exists in the PKCS#12 bag element bounds check. This vulnerability allows an remote attacker to write past the… |
CVE-2025-46307 | Medium | 5.5 | 2026-05-26 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to access sensitive user data. |
CVE-2025-46280 | Medium | 5.5 | 2026-05-26 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Tahoe 26. An app may be able to cause unexpected system termina… |
CVE-2025-43451 | Medium | 5.5 | 2026-05-26 | A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Tahoe 26. An app may be able to access sensitive user data. |
CVE-2025-43290 | Medium | 5.5 | 2026-05-26 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be abl… |
CVE-2025-43289 | Medium | 5.5 | 2026-05-26 | A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. A malicious app may be able… |
CVE-2026-9583 | Medium | 4.3 | 2026-05-26 | A weakness has been identified in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This impacts an unknown function of the file /i… |
CVE-2026-9582 | Medium | 4.3 | 2026-05-26 | A security flaw has been discovered in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects an unknown function. Performi… |
CVE-2026-9581 | Medium | 6.3 | 2026-05-26 | A vulnerability was identified in JeecgBoot up to 3.9.1. The impacted element is an unknown function of the file /sys/comment/add. Such manipulation leads to i… |
CVE-2026-9579 | Medium | 6.3 | 2026-05-26 | A vulnerability was found in JeecgBoot up to 3.9.1. Impacted is the function user.getUsername of the file /sys/user/login/setting/userEdit of the component Sys… |
CVE-2026-47672 | Medium | 6.5 | 2026-05-26 | epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. In 1.2.4 and earlier, any network-reachable caller can write arbitrary… |
CVE-2026-44899 | Medium | 4.7 | 2026-05-26 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the Image directive plugin validates the :width: and :height: options with a re… |
CVE-2026-44898 | Medium | 6.1 | 2026-05-26 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_toc_ul() builds a <ul> table-of-contents tree from a list of (level, id… |
CVE-2026-44897 | Medium | 6.1 | 2026-05-26 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, HTMLRenderer.heading() builds the opening <hN> tag by string-concatenating the… |
CVE-2026-44896 | Medium | 6.1 | 2026-05-26 | Mistune is a Python Markdown parser with renderers and plugins. In 3.2.0 and earlier, in src/mistune/directives/image.py, the render_figure() function concaten… |
CVE-2026-44837 | Medium | 5.9 | 2026-05-26 | view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoi… |
CVE-2026-44836 | Medium | 6.5 | 2026-05-26 | view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the preview route derive… |
CVE-2026-44708 | Medium | 6.1 | 2026-05-26 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the mistune math plugin renders inline math ($...$) and block math ($$...$$) by… |
CVE-2026-44443 | Medium | 4.8 | 2026-05-26 | Lumiverse is a full-featured AI chat application. Prior to 0.9.7, consumeNonce() only checks that the module-level variable is set and unexpired. It does not v… |
CVE-2026-36239 | Medium | 4.3 | 2026-05-26 | PbootCMS v.3.2.11 contains a code injection vulnerability in its site configuration functionality |
CVE-2026-44833 | Medium | 5.9 | 2026-05-26 | Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious s… |
CVE-2026-44831 | Medium | 4.8 | 2026-05-26 | Snipe-IT is an IT asset/license management system. Prior to 8.4.1, users with component view access could be impacted by an unescaped notes column, resulting i… |
CVE-2026-44214 | Medium | 5.8 | 2026-05-26 | eventsource-encoder encodes events as well-formed EventSource/Server Sent Event (SSE) messages. Prior to 1.0.2, eventsource-encoder does not sanitize the event… |
CVE-2026-27331 | Medium | 6.3 | 2026-05-26 | Missing Authorization vulnerability in Magepeople inc. WpTravelly allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects… |
CVE-2026-25444 | Medium | 4.3 | 2026-05-26 | Missing Authorization vulnerability in Magepeople inc. WpBookingly allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects… |
CVE-2026-25426 | Medium | 5.3 | 2026-05-26 | Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2026-24520 | Medium | 4.3 | 2026-05-26 | Missing Authorization vulnerability in bPlugins Tiktok Feed allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Tiktok… |
CVE-2025-68709 | Medium | 5.2 | 2026-05-26 | SailingLab AppLock (aka com.alpha.applock) 4.3.8 for Android allows a local attacker to trigger arbitrary JavaScript execution via BrowserMainActivity, which a… |
CVE-2026-9568 | Medium | 5.0 | 2026-05-26 | A weakness has been identified in ThingsBoard up to 4.3.1.1. Affected by this vulnerability is the function getGatewayDockerComposeFile of the file /api/v1/pro… |
CVE-2026-9566 | Medium | 4.3 | 2026-05-26 | A vulnerability was identified in teableio teable up to 1.9.x. This impacts an unknown function of the file apps/nextjs-app/src/features/auth/pages/LoginPage.t… |
CVE-2026-7453 | Medium | 5.5 | 2026-05-26 | A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can cause a Stack Exhaustion vulnerability, leading to a denial-of-service condition. |
CVE-2026-7450 | Medium | 5.5 | 2026-05-26 | A maliciously crafted PAR file, when parsed through Autodesk 3ds Max, can force a NULL Pointer Dereference vulnerability. Successful exploitation may cause the… |
CVE-2026-48696 | Medium | 6.2 | 2026-05-26 | FastNetMon Community Edition through 1.2.9 has a buffer overflow, a different vulnerability than CVE-2026-48686 and CVE-2026-48689. |
CVE-2026-44749 | Medium | 4.3 | 2026-05-26 | The SAP Gateway allows attackers to inject content into error messages, potentially leading to disclosure of request artefacts (e.g., regex patterns) and revea… |
CVE-2026-44707 | Medium | 6.8 | 2026-05-26 | Chatwoot is a customer engagement suite. From 2.14.0 to before 4.13.0, a Pre-Account Takeover (Pre-ATO) vulnerability existed in Chatwoot's authentication flow… |
CVE-2026-41164 | Medium | 4.4 | 2026-05-26 | nuts-node is the reference implementation of the Nuts specification. Prior to 6.2.3 and 5.4.31, the v1 access token introspection endpoint (/auth/v1/introspect… |
CVE-2026-24201 | Medium | 5.8 | 2026-05-26 | NVIDIA vGPU software contains a vulnerability in the virtual GPU manager, where an attacker could cause an out-of-bound access. A successful exploit of this vu… |
CVE-2026-24199 | Medium | 4.7 | 2026-05-26 | NVIDIA Display Driver for Linux contains a vulnerability in a kernel module, where a user could cause a race condition by reordering compiler or processor memo… |
CVE-2026-24198 | Medium | 5.6 | 2026-05-26 | NVIDIA GPU Display Driver for Linux contains a vulnerability where an advanced attacker could use a race condition to leak sensitive memory, which might cause… |
CVE-2026-24197 | Medium | 6.5 | 2026-05-26 | NVIDIA Display Driver for Linux contains a vulnerability in the Multi-Instance GPU (MIG) partition management, where an insecure default initialization of memo… |
CVE-2026-24182 | Medium | 6.5 | 2026-05-26 | NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker could leak held driver locks. A successful exploit of this vulnerability… |
CVE-2025-33221 | Medium | 4.4 | 2026-05-26 | NVIDIA Display Driver for Windows and Linux contains a vulnerability in the kernel driver, where a user could cause an incorrect permission assignment for a cr… |
CVE-2026-9565 | Medium | 6.3 | 2026-05-26 | A vulnerability was determined in haojing8312 WorkClaw up to 0.6.4. This affects the function is_dangerous of the file apps/runtime/src-tauri/src/agent/tools/b… |
CVE-2026-8852 | Medium | 6.2 | 2026-05-26 | IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_fastcgi module. |
CVE-2026-48905 | Medium | 6.1 | 2026-05-26 | Lack of input filtering leads to an XSS vector in the HTML filter code. |
CVE-2026-48903 | Medium | 6.1 | 2026-05-26 | Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components. |
CVE-2026-48900 | Medium | 4.3 | 2026-05-26 | An improper access check allowed low privileged users to edit the task types of existing scheduler tasks. |
CVE-2026-48693 | Medium | 5.5 | 2026-05-26 | FastNetMon Community Edition through 1.2.9 is vulnerable to a local symlink attack via predictable file paths in /tmp. The statistics file path defaults to '/t… |
CVE-2026-47728 | Medium | 4.3 | 2026-05-26 | Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, Bugsink resolved sourcemaps and debug files by debug ID without scoping that lookup to the projec… |
CVE-2026-46431 | Medium | 4.3 | 2026-05-26 | Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server's Access-Control-Allow-Origin response header was hardcoded to the… |
CVE-2026-46430 | Medium | 4.3 | 2026-05-26 | Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server bound to 0.0.0.0:5553 on Linux/macOS by default because the platfo… |
CVE-2026-45836 | Medium | 5.5 | 2026-05-26 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Add the same NULL gu… |
CVE-2026-45835 | Medium | 5.5 | 2026-05-26 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Add the same NULL… |
CVE-2026-45834 | Medium | 5.5 | 2026-05-26 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Add the same NULL gu… |
CVE-2026-44723 | Medium | 5.0 | 2026-05-26 | Vowpal Wabbit is a machine learning system. The workflow .github/workflows/python_checks.yml embeds ${{ github.event.pull_request.title }} directly inside doub… |
CVE-2026-44502 | Medium | 4.3 | 2026-05-26 | Bugsink is a self-hosted error tracking tool. Prior to 2.1.3, Bugsink’s webhook URL validation could be (partially) bypassed because of a mismatch in URL parsi… |
CVE-2026-44314 | Medium | 4.3 | 2026-05-26 | Traccar is an open source GPS tracking system. Prior to 6.13.0, DeviceResource.uploadImage authorizes the target device only through Condition.Permission(User… |
CVE-2026-35220 | Medium | 4.3 | 2026-05-26 | Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of com_users. |
CVE-2026-30895 | Medium | 6.1 | 2026-05-26 | Lack of output escaping leads to a XSS vector in the readmore links for com_content. |
CVE-2026-30894 | Medium | 6.1 | 2026-05-26 | Lack of output escaping leads to a XSS vector in the content history component. |
CVE-2026-25901 | Medium | 6.1 | 2026-05-26 | Lack of output escaping leads to a XSS vector in the multilingual associations component. |
CVE-2026-25900 | Medium | 6.1 | 2026-05-26 | Lack of output escaping leads to a XSS vector in the feed modules. |
CVE-2025-36221 | Medium | 5.3 | 2026-05-26 | IBM Cloud Pak for Data System - Cyclops 11.3.0.2 through Interim Fix 002 IBM Cloud Pak for Data System uses default passwords default passwords from the manuf… |
CVE-2025-36220 | Medium | 4.3 | 2026-05-26 | IBM Cloud Pak for Data System - Cyclops 11.3.0.2 through Interim Fix 002 IBM Cloud Pak for Data System is vulnerable to SQL injection. A remote attacker could… |
CVE-2025-36148 | Medium | 5.4 | 2026-05-26 | IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4.0 through 3.2.4.15 IBM Financial Transaction Manager SWIFT is vulnerable to cross… |
CVE-2025-36145 | Medium | 5.4 | 2026-05-26 | IBM watsonx.data 2.2 through 2.3.1 IBM Lakehouse does not properly restrict inbound and outbound connections which could allow an attacker to transfer or modif… |
CVE-2025-36126 | Medium | 6.4 | 2026-05-26 | IBM Cognos Analytics 11.2.0, 12.0, and 12.1.0 and IBM Cognos Transformer 12.0, 11.2.4, and 12.1.0 is vulnerable to stored cross-site scripting (XSS) in Cognos… |
CVE-2025-14290 | Medium | 5.4 | 2026-05-26 | IBM webMethods Integration (on prem) -Integration Server 10.15 through IS_10.15_Core_Fix2611.1 to IS_11.1_Core_Fix10 IBM webMethods Integration is vulnerable t… |
CVE-2025-13755 | Medium | 5.5 | 2026-05-26 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes DB2 Connect Server) stores potentially sensitive information in… |
CVE-2026-48685 | Medium | 6.5 | 2026-05-26 | FastNetMon Community Edition through 1.2.9 has out-of-bounds memory access because it incorrectly parses BGP path attributes with the extended length flag set… |
CVE-2026-48684 | Medium | 6.5 | 2026-05-26 | FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read in the NetFlow v9 options template parser. In process_netflow_v9_options_template() (… |
CVE-2026-48683 | Medium | 6.5 | 2026-05-26 | FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read vulnerability in the NetFlow v9 data flowset processor. In src/netflow_plugin/netflow… |
CVE-2026-46620 | Medium | 6.5 | 2026-05-26 | e107 is a content management system (CMS). Prior to 2.3.5, e107 CMS does not properly enforce CSRF token validation on comment moderation actions. The problem… |
CVE-2026-43936 | Medium | 4.3 | 2026-05-26 | e107 is a content management system (CMS). Prior to 2.3.4, you can access the local environment by specifying the URL of the local environment from "Image/File… |
CVE-2026-43934 | Medium | 6.5 | 2026-05-26 | e107 is a content management system (CMS). Prior to 2.3.4, a Broken Access Control vulnerability exists in the application, allowing an unauthorized authentica… |
CVE-2026-40564 | Medium | 6.5 | 2026-05-26 | Files or Directories Accessible to External Parties, Server-Side Request Forgery (SSRF) vulnerability in Apache Flink Kubernetes Operator. The FlinkSessionJob… |
CVE-2026-38587 | Medium | 4.3 | 2026-05-26 | An Insecure Direct Object Reference (IDOR) vulnerability was discovered in ONLYOFFICE DocSpace before 3.2.1. The flaw exists in multiple REST API endpoints. Th… |
CVE-2026-41917 | Medium | 4.9 | 2026-05-26 | OpenKM 6.3.12 contains a local file inclusion vulnerability in the administrative scripting interface at /admin/Scripting that allows authenticated administrat… |
CVE-2026-41401 | Medium | 6.5 | 2026-05-26 | libyang before 5.2.6 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freei… |
CVE-2026-9542 | Medium | 6.3 | 2026-05-26 | A weakness has been identified in CodeAstro Leave Management System 1.0. The affected element is an unknown function of the file /admin/add_staff.php. Executin… |
CVE-2026-9541 | Medium | 5.3 | 2026-05-26 | A security flaw has been discovered in Squirrel up to 3.2. Impacted is the function ReadObject of the file squirrel/sqobject.cpp of the component Cnut File Han… |
CVE-2026-9540 | Medium | 5.3 | 2026-05-26 | A vulnerability was identified in vllm-project vllm 0.19.0. This issue affects some unknown processing of the component OpenAI-compatible Serving Path. Such ma… |
CVE-2026-8174 | Medium | 5.7 | 2026-05-26 | Zohocorp Zoho Mail wordpress plugin is vulnerable to Cross-Site request forgery (CSRF). This issue affects Zoho Mail wordpress plugin versions before 1.6.2. |
CVE-2026-48136 | Medium | 4.1 | 2026-05-26 | When Compliance is enabled on Check Point Multi-Domain Management, an authenticated administrator with read-write access to one Management Domain (CMA) can mod… |
CVE-2026-48135 | Medium | 5.3 | 2026-05-26 | A Check Point HTTP-based service can incorrectly handle malformed HTTP requests. The issue is related to HTTP request parsing and validation. |
CVE-2026-48134 | Medium | 5.6 | 2026-05-26 | When the DLP is active, the UserCheck Web Portal contains an input-handling issue in the UserChoice flow. Under specific conditions, an attacker who can access… |
CVE-2026-39642 | Medium | 5.3 | 2026-05-26 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in SpabRice Nyla allows Code Injection. This issue affects Nyla: f… |
CVE-2026-27427 | Medium | 6.5 | 2026-05-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup allows Stored XSS. This issue affe… |
CVE-2026-24638 | Medium | 4.3 | 2026-05-26 | Missing Authorization vulnerability in Webful Creations RepairBuddy allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affect… |
CVE-2026-24590 | Medium | 5.3 | 2026-05-26 | Missing Authorization vulnerability in VideoWhisper.Com Paid Videochat Turnkey Site allows Exploiting Incorrectly Configured Access Control Security Levels. T… |
CVE-2026-39655 | Medium | 5.3 | 2026-05-26 | Missing Authorization vulnerability in TeconceTheme Mayosis Core allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects M… |
CVE-2026-9534 | Medium | 6.3 | 2026-05-26 | A flaw has been found in Totolink CA750-PoE 6.2c.510. This affects the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of the component Setting Hand… |
CVE-2026-9533 | Medium | 6.3 | 2026-05-26 | A vulnerability was detected in Totolink CA750-PoE 6.2c.510. The impacted element is the function recvUpgradeNewFw of the file /cgi-bin/cstecgi.cgi of the comp… |
CVE-2026-9532 | Medium | 6.3 | 2026-05-26 | A security vulnerability has been detected in Totolink CA750-PoE 6.2c.510. The affected element is the function setUploadUserData of the file /cgi-bin/cstecgi… |