Medium-severity CVEs (page 88)
Page 88 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-43738 | Medium | 5.5 | 2026-07-27 | The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS… |
CVE-2026-43714 | Medium | 5.5 | 2026-07-27 | The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8… |
CVE-2026-43665 | Medium | 5.5 | 2026-07-27 | This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A local attacker may be able to… |
CVE-2026-28932 | Medium | 5.5 | 2026-07-27 | A logic issue existed resulting in memory corruption. This was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Son… |
CVE-2026-28900 | Medium | 5.5 | 2026-07-27 | A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5. A maliciousl… |
CVE-2026-28849 | Medium | 5.5 | 2026-07-27 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5. A maliciously crafted ZIP arc… |
CVE-2026-20672 | Medium | 5.5 | 2026-07-27 | An information disclosure issue was addressed with improved privacy controls. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26… |
CVE-2026-66018 | Medium | 6.5 | 2026-07-27 | Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository para… |
CVE-2026-65925 | Medium | 6.5 | 2026-07-27 | A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response. |
CVE-2026-65924 | Medium | 6.5 | 2026-07-27 | JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request Forgery (SSRF). An authenticated user - or, if a… |
CVE-2026-65923 | Medium | 6.8 | 2026-07-27 | A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under specific repository access conditions, to cause unintended… |
CVE-2026-65618 | Medium | 6.5 | 2026-07-27 | Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potent… |
CVE-2026-64649 | Medium | 6.5 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forw… |
CVE-2026-64648 | Medium | 5.4 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with… |
CVE-2026-66757 | Medium | 5.5 | 2026-07-27 | A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin allocates memory for a row table. The image header dim… |
CVE-2026-66031 | Medium | 5.4 | 2026-07-27 | Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary… |
CVE-2026-64647 | Medium | 5.4 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with… |
CVE-2026-64646 | Medium | 5.3 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.j… |
CVE-2026-10682 | Medium | 6.6 | 2026-07-27 | The userspace verifier z_vrfy_log_filter_set() for the log_filter_set syscall in subsys/logging/log_mgmt.c performed a signed comparison against the int16_t sr… |
CVE-2026-66030 | Medium | 5.4 | 2026-07-27 | Ekushey Project Manager CRM through version 5.0 ccontains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrar… |
CVE-2026-66029 | Medium | 5.4 | 2026-07-27 | Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary… |
CVE-2026-66028 | Medium | 6.7 | 2026-07-27 | Ekushey Project Manager CRM through version 5.0 contains a missing uniqueness constraint vulnerability that allows authenticated administrators to create dupli… |
CVE-2026-64645 | Medium | 6.1 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites() or redirect… |
CVE-2026-64644 | Medium | 5.3 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting Next.js… |
CVE-2026-64643 | Medium | 5.3 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications usin… |
CVE-2026-48052 | Medium | 5.4 | 2026-07-27 | Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an authenticated user who is a member of any organization can dele… |
CVE-2026-17570 | Medium | 4.3 | 2026-07-27 | Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credentia… |
CVE-2026-17569 | Medium | 4.3 | 2026-07-27 | Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored… |
CVE-2026-66391 | Medium | 6.5 | 2026-07-27 | Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0… |
CVE-2026-66390 | Medium | 6.1 | 2026-07-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9… |
CVE-2026-17531 | Medium | 5.0 | 2026-07-27 | A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality of the file server/src/routes/goals.ts… |
CVE-2026-66399 | Medium | 6.5 | 2026-07-27 | phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMembers() that allows administrators with only group-management p… |
CVE-2026-17574 | Medium | 5.5 | 2026-07-27 | HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type fi… |
CVE-2026-17573 | Medium | 5.5 | 2026-07-27 | A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause… |
CVE-2026-17572 | Medium | 5.5 | 2026-07-27 | Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service (cr… |
CVE-2026-17530 | Medium | 6.3 | 2026-07-27 | A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5. Affected by this vulnerability is the function _build_handoff_toolset of the file Astr… |
CVE-2026-17529 | Medium | 6.3 | 2026-07-27 | A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/core/astr_main_agent.py. The manipulati… |
CVE-2026-66477 | Medium | 5.3 | 2026-07-27 | Unauthenticated Broken Access Control in Gillion <= 4.13 versions. |
CVE-2026-66476 | Medium | 4.9 | 2026-07-27 | Administrator Arbitrary File Deletion in Easy Digital Downloads <= 3.6.9 versions. |
CVE-2026-66475 | Medium | 5.9 | 2026-07-27 | Shop manager Cross Site Scripting (XSS) in Checkout Field Editor for WooCommerce – Checkout Manager <= 3.0.5 versions. |
CVE-2026-66474 | Medium | 4.3 | 2026-07-27 | Unauthenticated Cross Site Request Forgery (CSRF) in Insert Headers and Footers Code – HT Script <= 1.1.8 versions. |
CVE-2026-66448 | Medium | 6.5 | 2026-07-27 | Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.3 versions. |
CVE-2026-66445 | Medium | 6.5 | 2026-07-27 | Contributor Cross Site Scripting (XSS) in Open User Map <= 1.4.46 versions. |
CVE-2026-66442 | Medium | 5.4 | 2026-07-27 | Subscriber Broken Access Control in YayPricing <= 3.5.6 versions. |
CVE-2026-66438 | Medium | 5.3 | 2026-07-27 | Unauthenticated Sensitive Data Exposure in Exclusive Addons Elementor <= 2.8.0 versions. |
CVE-2026-66437 | Medium | 4.9 | 2026-07-27 | Contributor Server Side Request Forgery (SSRF) in Feedzy <= 5.2.4 versions. |
CVE-2026-66434 | Medium | 6.5 | 2026-07-27 | Contributor Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.33 versions. |
CVE-2026-66433 | Medium | 6.5 | 2026-07-27 | Contributor Cross Site Scripting (XSS) in Location Weather <= 3.0.6 versions. |
CVE-2026-66428 | Medium | 4.3 | 2026-07-27 | Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions. |
CVE-2026-65568 | Medium | 5.0 | 2026-07-27 | Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions. |
CVE-2026-65567 | Medium | 5.3 | 2026-07-27 | Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions. |
CVE-2026-65564 | Medium | 5.3 | 2026-07-27 | Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress <= 2.97.6 versions. |
CVE-2026-65563 | Medium | 5.9 | 2026-07-27 | Author Cross Site Scripting (XSS) in Orbit Fox by ThemeIsle <= 3.0.7 versions. |
CVE-2026-65562 | Medium | 6.5 | 2026-07-27 | Contributor Cross Site Scripting (XSS) in BetterDocs <= 4.6.2 versions. |
CVE-2026-65561 | Medium | 6.5 | 2026-07-27 | Contributor Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.0 versions. |
CVE-2026-65558 | Medium | 5.4 | 2026-07-27 | Unauthenticated Server Side Request Forgery (SSRF) in AffiliateX <= 2.3.5 versions. |
CVE-2026-65557 | Medium | 5.9 | 2026-07-27 | Shop manager Cross Site Scripting (XSS) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions. |
CVE-2026-65436 | Medium | 6.8 | 2026-07-27 | Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions. |
CVE-2026-65435 | Medium | 6.5 | 2026-07-27 | Unauthenticated Broken Access Control in Thrive Leads Version <= 10.9.2 versions. |
CVE-2026-65434 | Medium | 6.5 | 2026-07-27 | Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce <= 2.16.1 versions. |
CVE-2026-65433 | Medium | 6.5 | 2026-07-27 | Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions. |
CVE-2026-59560 | Medium | 6.5 | 2026-07-27 | Subscriber Broken Access Control in FundEngine <= 1.7.8 versions. |
CVE-2026-59559 | Medium | 6.5 | 2026-07-27 | Subscriber Cross Site Scripting (XSS) in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions. |
CVE-2026-59557 | Medium | 6.5 | 2026-07-27 | Unauthenticated Broken Access Control in Events Made Easy <= 3.1.3 versions. |
CVE-2026-10819 | Medium | 6.5 | 2026-07-27 | Mattermost versions 11.6.x <= 11.6.5, 10.11.x <= 10.11.20, 11.8.x <= 11.8.1, 11.7.x <= 11.7.4 fail to limit the number of frames and enforce the file size cap… |
CVE-2026-10600 | Medium | 4.3 | 2026-07-27 | Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to bound the time and resource consumption of server-side do… |
CVE-2026-17514 | Medium | 5.3 | 2026-07-27 | A vulnerability was determined in ZJONSSON node-unzipper up to 0.12.3. Affected by this vulnerability is the function Extract of the file lib/extract.js. This… |
CVE-2026-15003 | Medium | 5.6 | 2026-07-27 | A flaw was found in the GNU Binutils (Binary Utilities) linker. This vulnerability, a heap-buffer-overflow read (CWE-125), occurs when the linker processes a s… |
CVE-2026-66053 | Medium | 5.9 | 2026-07-27 | Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users… |
CVE-2026-55970 | Medium | 6.5 | 2026-07-27 | Buffer Over-read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0… |
CVE-2026-17534 | Medium | 5.5 | 2026-07-27 | Kimi Code (@moonshot-ai/kimi-code) before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, with… |
CVE-2026-66412 | Medium | 6.5 | 2026-07-27 | Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assig… |
CVE-2026-14827 | Medium | 6.8 | 2026-07-27 | The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-faci… |
CVE-2026-14820 | Medium | 5.3 | 2026-07-27 | The Quiz and Survey Master (QSM) WordPress plugin before 11.1.3 does not implement rate limiting or standard failed-login auditing on its front-end credential… |
CVE-2026-14568 | Medium | 6.5 | 2026-07-27 | The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8 does not cor… |
CVE-2026-14236 | Medium | 4.7 | 2026-07-27 | The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it as the success and cancel redirect tar… |
CVE-2026-14203 | Medium | 4.8 | 2026-07-27 | The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allo… |
CVE-2026-14190 | Medium | 6.1 | 2026-07-27 | The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input in one of its unauthenticated AJAX han… |
CVE-2026-13400 | Medium | 6.1 | 2026-07-27 | Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a san… |
CVE-2026-13390 | Medium | 5.3 | 2026-07-27 | The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an… |
CVE-2026-12982 | Medium | 6.1 | 2026-07-27 | The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthentic… |
CVE-2026-10082 | Medium | 6.1 | 2026-07-27 | The Advanced Ads WordPress plugin before 2.0.23 does not sanitize and escape a shortcode parameter before outputting it in the page, allowing users with the C… |
CVE-2026-17501 | Medium | 5.3 | 2026-07-27 | A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file common/json-schema-to-grammar.cpp of the com… |
CVE-2026-17500 | Medium | 5.3 | 2026-07-27 | A vulnerability was detected in ggml-org llama.cpp d006858/e15efe0. This affects the function _visit_pattern of the file common/json-schema-to-grammar.cpp. The… |
CVE-2026-57978 | Medium | 5.4 | 2026-07-26 | Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-17459 | Medium | 4.3 | 2026-07-26 | A vulnerability was determined in perwendel spark up to 2.9.4. This vulnerability affects the function staticFiles.externalLocation of the file src/main/java/s… |
CVE-2026-17458 | Medium | 6.3 | 2026-07-26 | A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file src/browser/routes/agent.act.ts of the c… |
CVE-2026-17457 | Medium | 4.3 | 2026-07-26 | A vulnerability has been found in mf-yang openclaw-cn up to 0.2.1. Affected by this issue is the function assertBrowserNavigationAllowed of the file src/browse… |
CVE-2026-17434 | Medium | 6.3 | 2026-07-26 | A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-mod/request.ts of the compone… |
CVE-2026-17433 | Medium | 5.3 | 2026-07-26 | A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. This impacts the function createChatSdkBridge.setup of the file src/channels/chat-sdk-bridge.ts… |
CVE-2026-17432 | Medium | 5.0 | 2026-07-26 | A vulnerability was detected in NousResearch hermes-agent 2026.6.5. Affected by this vulnerability is an unknown functionality of the file hermes-agent/plugins… |
CVE-2026-10681 | Medium | 6.5 | 2026-07-25 | In Zephyr's userspace dynamic-objects subsystem, thread_idx_alloc() in kernel/userspace/userspace.c allocated a new thread permission index from the global _th… |
CVE-2026-64451 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in func_set_flag() func_set_flag() dereferences tr-… |
CVE-2026-64429 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: gpio: eic-sprd: use raw_spinlock_t in the irq startup path sprd_eic_irq_unmask() enables… |
CVE-2026-64428 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: gpio: sch: use raw_spinlock_t in the irq startup path sch_irq_unmask() enables the GPIO I… |
CVE-2026-64427 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: HID: logitech-dj: Fix maxfield check in DJ short report validation Commit b6a57912854e ("… |
CVE-2026-64426 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE NOP file-acquisition support… |
CVE-2026-64425 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item commit 10dc95939817 ("i… |
CVE-2026-64419 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() Reading the debugfs "c… |
CVE-2026-64417 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: mm: shrinker: fix NULL pointer dereference in debugfs shrinker_debugfs_add() creates both… |