Medium-severity CVEs (page 88)
Page 88 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-9531 | Medium | 6.3 | 2026-05-26 | A weakness has been identified in Totolink CA750-PoE 6.2c.510. Impacted is the function setUpgradeUboot of the file /cgi-bin/cstecgi.cgi of the component Setti… |
CVE-2026-9527 | Medium | 4.3 | 2026-05-26 | A vulnerability was determined in itsourcecode Electronic Judging System 1.0. This issue affects some unknown processing of the file /admin/judges.php. This ma… |
CVE-2026-9524 | Medium | 6.3 | 2026-05-26 | A flaw has been found in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected by this issue is the function execute of the component REST Endpoint. Executing… |
CVE-2026-9520 | Medium | 4.3 | 2026-05-26 | A weakness has been identified in blitz-js blitz up to 3.0.2 on GitHub. This impacts an unknown function of the file packages/generator/templates/app/src/app/a… |
CVE-2026-9519 | Medium | 4.3 | 2026-05-26 | A security flaw has been discovered in stonith404 pingvin-share up to 1.13.0. This affects the function getServerSideProps of the file frontend/src/pages/auth/… |
CVE-2026-9518 | Medium | 4.3 | 2026-05-26 | A vulnerability was identified in hemant6488 CodeIgniter-StudentManagementSystem. The impacted element is the function addStudent of the file view_students.php… |
CVE-2026-4795 | Medium | 6.5 | 2026-05-26 | A missing authorization vulnerability in Zyxel GS1200-5v3 firmware versions through 1.00(ACPS.2)C0, GS1200-8v3 firmware versions through 1.00(ACPT.2)C0, GS120… |
CVE-2026-9515 | Medium | 6.3 | 2026-05-26 | A vulnerability was detected in Totolink CA750-PoE 6.2c.510. The affected element is the function setUnloadUserData of the file /cgi-bin/cstecgi.cgi of the com… |
CVE-2026-9514 | Medium | 6.3 | 2026-05-25 | A security vulnerability has been detected in Totolink CA750-PoE 6.2c.510. Impacted is the function setNetworkDiag of the file /cgi-bin/cstecgi.cgi of the comp… |
CVE-2026-9513 | Medium | 6.3 | 2026-05-25 | A weakness has been identified in Totolink CA750-PoE 6.2c.510. This issue affects the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi of the componen… |
CVE-2026-9512 | Medium | 6.3 | 2026-05-25 | A security flaw has been discovered in Totolink CA750-PoE 6.2c.510. This vulnerability affects the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of… |
CVE-2026-45435 | Medium | 6.5 | 2026-05-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log allows DOM-Based XSS. This iss… |
CVE-2026-45217 | Medium | 6.5 | 2026-05-25 | Authentication Bypass Using an Alternate Path or Channel vulnerability in ThemeHigh Stripe Payment Gateway for WooCommerce allows Password Recovery Exploitatio… |
CVE-2026-42776 | Medium | 6.3 | 2026-05-25 | Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart allows Exploiting Incorrectly Configured Access Control Security Levels. This issue aff… |
CVE-2026-42763 | Medium | 6.5 | 2026-05-25 | Missing Authorization vulnerability in SePay team SePay Gateway allows Retrieve Embedded Sensitive Data. This issue affects SePay Gateway: from n/a through 1… |
CVE-2026-32389 | Medium | 5.4 | 2026-05-25 | Missing Authorization vulnerability in Linethemes NanoCare allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects NanoCar… |
CVE-2026-9511 | Medium | 6.3 | 2026-05-25 | A vulnerability was identified in Totolink CA750-PoE 6.2c.510. This affects the function setWebWlanIdx of the file /cgi-bin/cstecgi.cgi of the component Settin… |
CVE-2026-27398 | Medium | 5.3 | 2026-05-25 | Missing Authorization vulnerability in WP Chill RSVP and Event Management allows Exploiting Incorrectly Configured Access Control Security Levels. This issue… |
CVE-2026-27357 | Medium | 5.3 | 2026-05-25 | Missing Authorization vulnerability in Cornel Raiu WP Search Analytics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue aff… |
CVE-2026-27346 | Medium | 4.9 | 2026-05-25 | Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects B2BKi… |
CVE-2026-24592 | Medium | 5.3 | 2026-05-25 | Missing Authorization vulnerability in Lucian Apostol Auto Affiliate Links allows Exploiting Incorrectly Configured Access Control Security Levels. This issue… |
CVE-2026-24586 | Medium | 5.4 | 2026-05-25 | Missing Authorization vulnerability in Themeansar Newses allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Newses: f… |
CVE-2026-24582 | Medium | 4.3 | 2026-05-25 | Missing Authorization vulnerability in WPPOOL FlexTable allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects FlexTable… |
CVE-2026-24554 | Medium | 4.3 | 2026-05-25 | Cross-Site Request Forgery (CSRF) vulnerability in Convers Lab WPSubscription allows Cross Site Request Forgery. This issue affects WPSubscription: from n/a t… |
CVE-2026-24527 | Medium | 4.3 | 2026-05-25 | Missing Authorization vulnerability in Patterns in the cloud Autoship Cloud for WooCommerce Subscription Products allows Exploiting Incorrectly Configured Acce… |
CVE-2025-62745 | Medium | 6.5 | 2026-05-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Team Showcase allows Stored XSS. This issue… |
CVE-2026-9502 | Medium | 5.3 | 2026-05-25 | A vulnerability was identified in GNU LibreDWG up to 0.14. This affects the function decompress_R2004_section of the file src/decode.c of the component Dwgread… |
CVE-2026-9500 | Medium | 5.3 | 2026-05-25 | A vulnerability was found in GNU LibreDWG up to 0.14. The affected element is the function read_2004_compressed_section of the file src/decode.c of the compone… |
CVE-2026-48589 | Medium | 5.4 | 2026-05-25 | Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login. In affected versions, insufficient validat… |
CVE-2026-44598 | Medium | 5.4 | 2026-05-25 | With valid login credentials, URL Redirection to Untrusted Site ('Open Redirect'), Server-Side Request Forgery (SSRF) vulnerability in Apache Shiro. This i… |
CVE-2026-43828 | Medium | 6.5 | 2026-05-25 | Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to 2.1.0… |
CVE-2026-43827 | Medium | 6.5 | 2026-05-25 | Default configurations of Apache Shiro have a session fixation vulnerability. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are… |
CVE-2026-24597 | Medium | 4.3 | 2026-05-25 | Cross-Site Request Forgery (CSRF) vulnerability in WpDevArt Organization chart allows Cross Site Request Forgery. This issue affects Organization chart: from… |
CVE-2026-24574 | Medium | 6.5 | 2026-05-25 | Cross-Site Request Forgery (CSRF) vulnerability in Recorp Export WP Page to Static HTML/CSS allows Cross Site Request Forgery. This issue affects Export WP Pa… |
CVE-2026-24545 | Medium | 4.3 | 2026-05-25 | Missing Authorization vulnerability in Nikki Blight QR Redirector allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects… |
CVE-2026-9498 | Medium | 6.3 | 2026-05-25 | A vulnerability has been found in Dromara lamp-cloud up to 5.6.2. Impacted is the function GroovyClassLoader.parseClass of the component Message Template Handl… |
CVE-2026-9497 | Medium | 6.3 | 2026-05-25 | A flaw has been found in changmingxie tcc-transaction up to 2.1.0. This issue affects the function Fastjson.parseObject of the component Fastjson AutoType REST… |
CVE-2026-9486 | Medium | 4.3 | 2026-05-25 | A security flaw has been discovered in SourceCodester Student Grades Management System 1.0. This affects an unknown part. The manipulation results in cross-sit… |
CVE-2026-9484 | Medium | 6.3 | 2026-05-25 | A vulnerability was determined in SourceCodester Student Grades Management System 1.0. Affected by this vulnerability is the function getClassroomStudents/remo… |
CVE-2026-48849 | Medium | 4.4 | 2026-05-25 | In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored value could lead to stored XSS/HTML/CSS inj… |
CVE-2026-48846 | Medium | 6.5 | 2026-05-25 | In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail m… |
CVE-2026-48845 | Medium | 6.5 | 2026-05-25 | In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for URLs pointing to local/private destinati… |
CVE-2026-24546 | Medium | 5.3 | 2026-05-25 | Missing Authorization vulnerability in Ruben Garcia GamiPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Gami… |
CVE-2026-9483 | Medium | 6.3 | 2026-05-25 | A vulnerability was found in SourceCodester Student Grades Management System 1.0. Affected is an unknown function of the file grades.php. Performing a manipula… |
CVE-2026-9473 | Medium | 6.3 | 2026-05-25 | A vulnerability has been found in c-rick jimeng-mcp 1.10.0. Affected by this vulnerability is the function getFileContent/uploadCoverFile/generateImage/generat… |
CVE-2026-9472 | Medium | 6.3 | 2026-05-25 | A flaw has been found in dazeb markdown-downloader up to 3d4394b34b6c99d81af817623af55e3384df5a6a. Affected is the function download_markdown/list_downloaded_f… |
CVE-2026-27768 | Medium | 6.6 | 2026-05-25 | SQL Injection affecting the Access Manager role. |
CVE-2026-9468 | Medium | 6.3 | 2026-05-25 | A security flaw has been discovered in dazeb cline-mcp-memory-bank up to 55c81b9cf6c16700983c84dc4cdea3cafa19a75f. The affected element is the function handleI… |
CVE-2026-9467 | Medium | 4.3 | 2026-05-25 | A vulnerability was identified in debugmcp mcp-debugger up to 0.20.0. Impacted is the function handleGetSourceContext of the file src/server.ts. The manipulati… |
CVE-2026-9466 | Medium | 5.3 | 2026-05-25 | A vulnerability was determined in Tiandy Easy7 Integrated Management Platform 7.17.0. This issue affects some unknown processing of the file /rest/user/updateU… |
CVE-2026-42797 | Medium | 4.9 | 2026-05-25 | Exposure of Sensitive Information Through Data Queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can cr… |
CVE-2026-9464 | Medium | 4.7 | 2026-05-25 | A vulnerability has been found in YunaiV yudao-cloud 2026.03. This affects the function IotDataSinkHttpConfig of the file /admin-api/iot/data-sink/create of th… |
CVE-2026-9078 | Medium | 5.4 | 2026-05-25 | Firefox for iOS displayed specially crafted right-to-left (RTL) and internationalized domain names (IDNs) incorrectly in link preview UI surfaces. A crafted RT… |
CVE-2026-47076 | Medium | 6.5 | 2026-05-25 | Interpretation Conflict vulnerability in benoitc hackney allows Server Side Request Forgery. hackney_url:normalize/2 URL-decodes the host component after the U… |
CVE-2026-47070 | Medium | 6.1 | 2026-05-25 | Sensitive Data Exposure vulnerability in benoitc hackney allows Retrieve Embedded Sensitive Data. The HTTP/3 redirect handler in src/hackney_h3.erl passes the… |
CVE-2026-47069 | Medium | 5.3 | 2026-05-25 | Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Response Splitting. The hackney_cookie:setcookie/3 fu… |
CVE-2018-25378 | Medium | 6.2 | 2026-05-25 | Notebook Pro 2.0 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the… |
CVE-2018-25370 | Medium | 5.3 | 2026-05-25 | Admidio 3.3.5 contains a cross-site request forgery vulnerability that allows low-privilege users to increase their permissions by exploiting improper origin c… |
CVE-2018-25369 | Medium | 6.2 | 2026-05-25 | Visual Ping 0.8.0.0 contains a buffer overflow vulnerability in input field handling that allows local attackers to crash the application by supplying oversize… |
CVE-2018-25367 | Medium | 6.2 | 2026-05-25 | NASA openVSP 3.16.1 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in th… |
CVE-2018-25363 | Medium | 4.3 | 2026-05-25 | Twitter-Clone 1 contains a cross-site request forgery vulnerability that allows remote attackers to force victims to delete posts by crafting malicious HTML fo… |
CVE-2018-25361 | Medium | 6.8 | 2026-05-25 | Soroush IM Desktop App 0.17.0 contains an authentication bypass vulnerability that allows local attackers to remove passcodes by injecting pre-encrypted databa… |
CVE-2026-9451 | Medium | 6.3 | 2026-05-25 | A weakness has been identified in code-projects Employee Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /process… |
CVE-2026-9450 | Medium | 6.3 | 2026-05-25 | A security flaw has been discovered in code-projects Employee Management System 1.0. Affected is an unknown function of the file /psubmit.php. The manipulation… |
CVE-2026-9449 | Medium | 6.3 | 2026-05-25 | A vulnerability was identified in code-projects Employee Management System 1.0. This impacts an unknown function of the file /changepassemp.php. The manipulati… |
CVE-2026-9448 | Medium | 4.3 | 2026-05-25 | A vulnerability was determined in code-projects Employee Management System 1.0. This affects an unknown function of the file /applyleave.php. Executing a manip… |
CVE-2026-46745 | Medium | 5.3 | 2026-05-25 | Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or… |
CVE-2026-9446 | Medium | 4.7 | 2026-05-25 | A vulnerability has been found in SourceCodester Simple POS and Inventory System 1.0. The affected element is an unknown function of the file /admin/edit_custo… |
CVE-2026-9445 | Medium | 6.3 | 2026-05-25 | A flaw has been found in SourceCodester Simple POS and Inventory System 1.0. Impacted is an unknown function of the file /admin/addproduct.php of the component… |
CVE-2026-9444 | Medium | 4.7 | 2026-05-25 | A vulnerability was detected in SourceCodester Simple POS and Inventory System 1.0. This issue affects the function delete of the file /admin/deleteproduct.php… |
CVE-2026-9441 | Medium | 6.3 | 2026-05-25 | A security flaw has been discovered in Edimax BR-6478AC 1.23. Affected by this issue is the function formiNICbasic of the file /goform/formiNICbasic of the com… |
CVE-2026-5223 | Medium | 5.3 | 2026-05-25 | Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of a… |
CVE-2026-5222 | Medium | 6.5 | 2026-05-25 | Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple r… |
CVE-2026-9490 | Medium | 5.5 | 2026-05-25 | A security vulnerability has been identified in Acer Care Center where the ACCSvc service creates a Named Pipe with a weak Security Descriptor. This vulnerabil… |
CVE-2026-9440 | Medium | 6.3 | 2026-05-25 | A vulnerability was identified in Edimax BR-6478AC 1.23. Affected by this vulnerability is the function formAccept of the file /goform/formAccept of the compon… |
CVE-2026-9439 | Medium | 6.3 | 2026-05-25 | A vulnerability was determined in Edimax BR-6675nD 1.12. Affected is the function stainfo of the file /goform/stainfo. This manipulation of the argument interf… |
CVE-2026-9438 | Medium | 5.4 | 2026-05-25 | A vulnerability was found in yashpokharna2555 StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203. This impacts an unknown function of the file co… |
CVE-2026-9437 | Medium | 6.3 | 2026-05-25 | A vulnerability has been found in DTStack Taier 1.4.0. This affects the function Runtime.exec of the component REST API. The manipulation of the argument sqlTe… |
CVE-2026-4915 | Medium | 6.5 | 2026-05-25 | Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to filter nil elements from outgoing webhook attachment payl… |
CVE-2026-45249 | Medium | 6.1 | 2026-05-25 | A cross-site scripting (XSS) vulnerability exists in Apache ECharts in the Lines series tooltip rendering logic. This issue affects Apache ECharts: from be… |
CVE-2026-41863 | Medium | 6.5 | 2026-05-25 | Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk. This could allow a malic… |
CVE-2026-9424 | Medium | 6.3 | 2026-05-25 | A weakness has been identified in Edimax EW-7438RPn 1.31. The affected element is the function formWlanMP of the file /goform/formWlanMP of the component Conte… |
CVE-2026-9423 | Medium | 4.7 | 2026-05-25 | A security flaw has been discovered in Edimax BR-6675nD 1.12. Impacted is the function mp of the file /goform/mp of the component POST Request Handler. Perform… |
CVE-2026-9420 | Medium | 6.3 | 2026-05-25 | A vulnerability was found in KLiK SocialMediaWebsite 1.0. This affects an unknown part of the component HTTP GET Request Parameter Handler. The manipulation re… |
CVE-2026-9419 | Medium | 4.3 | 2026-05-25 | A vulnerability has been found in code-projects Employee Management System 1.0. Affected by this issue is some unknown functionality of the file /empproject.ph… |
CVE-2026-9418 | Medium | 4.3 | 2026-05-25 | A flaw has been found in code-projects Employee Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /changepassemp.ph… |
CVE-2026-9417 | Medium | 4.3 | 2026-05-25 | A vulnerability was detected in code-projects Employee Management System 1.0. Affected is an unknown function of the file /myprofileup.php. Performing a manipu… |
CVE-2026-9416 | Medium | 4.3 | 2026-05-25 | A security vulnerability has been detected in code-projects Employee Management System 1.0. This impacts an unknown function of the file /myprofile.php. Such m… |
CVE-2026-9415 | Medium | 4.3 | 2026-05-25 | A weakness has been identified in code-projects Employee Management System 1.0. This affects an unknown function of the file /eloginwel.php. This manipulation… |
CVE-2026-9413 | Medium | 4.3 | 2026-05-25 | A vulnerability was identified in SourceCodester Indian Invoicing System 1.0. The affected element is an unknown function of the file /Invoicing/category.php… |
CVE-2026-9412 | Medium | 6.3 | 2026-05-25 | A vulnerability was determined in SourceCodester Indian Invoicing System 1.0. Impacted is an unknown function of the component Backend Endpoint. Executing a ma… |
CVE-2026-9411 | Medium | 6.3 | 2026-05-25 | A vulnerability was found in SourceCodester Indian Invoicing System 1.0. This issue affects some unknown processing of the file /Invoicing/IGST_Invoice.php of… |
CVE-2026-9410 | Medium | 4.3 | 2026-05-25 | A vulnerability has been found in Sushmi-pal Invoice-System up to a0a3faa16dee2621b231ae227333f5761607283b. This vulnerability affects unknown code of the file… |
CVE-2026-9409 | Medium | 4.3 | 2026-05-25 | A flaw has been found in Sushmi-pal Invoice-System up to a0a3faa16dee2621b231ae227333f5761607283b. This affects an unknown part of the file /user of the compon… |
CVE-2026-9402 | Medium | 6.3 | 2026-05-24 | A vulnerability was found in Edimax BR-6675nD 1.12. The affected element is the function formWlanMP of the file /goform/formWlanMP of the component POST Reques… |
CVE-2026-9400 | Medium | 6.3 | 2026-05-24 | A flaw has been found in Edimax BR-6675nD 1.12. This issue affects the function formUSBStorage of the file /goform/formUSBStorage of the component POST Request… |
CVE-2026-9379 | Medium | 6.3 | 2026-05-24 | A weakness has been identified in Edimax BR-6675nD 1.12. This impacts the function formWpsStart of the file /goform/formWpsStart of the component POST Request… |
CVE-2026-9378 | Medium | 6.3 | 2026-05-24 | A security flaw has been discovered in Edimax BR-6675nD 1.12. This affects the function formHwSet of the file /goform/formHwSet of the component POST Request H… |
CVE-2026-9376 | Medium | 6.3 | 2026-05-24 | A vulnerability was determined in JPress up to 1.0.3. The affected element is an unknown function of the file /ucenter/article/doWriteSave of the component UCe… |
CVE-2026-9374 | Medium | 6.3 | 2026-05-24 | A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. Impacted is the function FileUploadUtils.upload of the file /common/upload of the component C… |