Medium-severity CVEs (page 90)
Page 90 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-8238 | Medium | 5.3 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/message_page' endpoint returns the full content of any conversation messag… |
CVE-2026-8237 | Medium | 5.3 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to IDOR. The `/ccm/frontend/conversations/message_detail` endpoint returns the full content of any conversation mess… |
CVE-2026-8236 | Medium | 4.3 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate. The endpoint /ccm/system/dialogs/file/usage/{fID} accepts an in… |
CVE-2026-8139 | Medium | 5.4 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName because updateCollectionAliasExternal bypasses being sanitized. The Conc… |
CVE-2026-7890 | Medium | 6.4 | 2026-05-21 | In Concrete CMS 9.5.0 and below, the RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation enabling redirec… |
CVE-2026-7887 | Medium | 6.4 | 2026-05-21 | For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status. A user with uIsActive=0 (suspended, banned, terminated employee… |
CVE-2026-7886 | Medium | 4.3 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameter which can lead to file permission bypass. The `AddMe… |
CVE-2026-7882 | Medium | 4.3 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to unauthorized file deletion due to an Inverted CSRF token check in the DeleteFile controller. The code throws an… |
CVE-2026-7881 | Medium | 4.3 | 2026-05-21 | Concrete CMS 9.5.0 and below is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block via the exEntryID parameter. This IDOR lea… |
CVE-2026-7879 | Medium | 5.3 | 2026-05-21 | In Concrete CMS 9.5.0 and below, the submit_password() method in concrete/controllers/single_page/download_file.php allows unauthorized file access since down… |
CVE-2026-5091 | Medium | 5.1 | 2026-05-21 | Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks. These versions use Perl's built-in eq comparison. Discre… |
CVE-2026-4929 | Medium | 5.4 | 2026-05-21 | Simple Hierarchical Select (SHS) for Drupal 7 contains cross-site scripting risk due to improper output escaping of term-derived text. Confirmed affected paths… |
CVE-2026-4093 | Medium | 5.4 | 2026-05-21 | In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter rendering pipeline. Vector A (token display templates): When… |
CVE-2026-22678 | Medium | 5.4 | 2026-05-21 | Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module that al… |
CVE-2026-8205 | Medium | 5.3 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since action_get_events does not check canView on the calendar which r… |
CVE-2026-8204 | Medium | 5.3 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to authorization Bypass in the Calendar Event Frontend Dialog which can allow cross-calendar data disclosure. A publ… |
CVE-2026-8203 | Medium | 5.4 | 2026-05-21 | Concrete CMS 9.5.0 and below has Stored XSS on the height parameter. The controller does not validate or sanitize $height. Any user with editor privileges can… |
CVE-2026-8197 | Medium | 4.8 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name. The OAuth authorize template renders the integration name (admin-controlle… |
CVE-2026-8140 | Medium | 6.5 | 2026-05-21 | Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/install/download/<remoteId>. The download() method… |
CVE-2026-6826 | Medium | 5.3 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to unauthenticated file usage disclosure via missing permission check in the usage controller. Any unauthenticated… |
CVE-2026-4843 | Medium | 4.3 | 2026-05-21 | The GSheet For Woo Importer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the process_ajax_restore_actio… |
CVE-2026-48249 | Medium | 5.9 | 2026-05-21 | Open ISES Tickets before 3.44.2 disables TLS certificate verification in rm/incs/mobile_login.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setti… |
CVE-2026-48248 | Medium | 5.9 | 2026-05-21 | Open ISES Tickets before 3.44.2 disables TLS certificate verification in incs/login.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT… |
CVE-2026-48247 | Medium | 5.9 | 2026-05-21 | Open ISES Tickets before 3.44.2 disables TLS certificate verification in incs/functions.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CUR… |
CVE-2026-48246 | Medium | 5.9 | 2026-05-21 | Open ISES Tickets before 3.44.2 disables TLS certificate verification in ajax/reports.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_S… |
CVE-2026-48245 | Medium | 5.3 | 2026-05-21 | Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in tables.php that is committed to the public source repository. The key can be extracte… |
CVE-2026-48244 | Medium | 5.3 | 2026-05-21 | Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in settings.inc.php that is committed to the public source repository. The key can be ex… |
CVE-2026-48243 | Medium | 5.3 | 2026-05-21 | Open ISES Tickets before 3.44.2 embeds a hardcoded WhitePages reverse-phone API key in wp1.php that is committed to the public source repository. Any actor wit… |
CVE-2026-48230 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ticketsmdb_import.php that allows authenticated attackers to inject… |
CVE-2026-48229 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in routes_i.php that allows authenticated attackers to inject arbitrary… |
CVE-2026-48228 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in patient_w.php that allows authenticated attackers to inject arbitrar… |
CVE-2026-48227 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in patient.php that allows authenticated attackers to inject arbitrary… |
CVE-2026-48226 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in os_watch.php that allows authenticated attackers to inject arbitrary… |
CVE-2026-48225 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in landb.php that allows authenticated attackers to inject arbitrary Ja… |
CVE-2026-48224 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics214.php that allows authenticated attackers to inject arbitrary J… |
CVE-2026-48223 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics213rr.php that allows authenticated attackers to inject arbitrary… |
CVE-2026-48222 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics213.php that allows authenticated attackers to inject arbitrary J… |
CVE-2026-48221 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics205a.php that allows authenticated attackers to inject arbitrary… |
CVE-2026-48220 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics205.php that allows authenticated attackers to inject arbitrary J… |
CVE-2026-48219 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics202.php that allows authenticated attackers to inject arbitrary J… |
CVE-2026-48218 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in icons/buttons/landb.php that allows authenticated attackers to injec… |
CVE-2026-48217 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in delete_module.php that allows authenticated attackers to inject arbi… |
CVE-2026-48216 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in db_loader.php that allows authenticated attackers to inject arbitrar… |
CVE-2026-48215 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in circle.php that allows authenticated attackers to inject arbitrary J… |
CVE-2026-48214 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in add_nm.php that allows authenticated attackers to inject arbitrary J… |
CVE-2026-39593 | Medium | 6.5 | 2026-05-21 | Missing Authorization vulnerability in VillaTheme HAPPY allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects HAPPY: fro… |
CVE-2026-48213 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in add.php that allows authenticated attackers to inject arbitrary Java… |
CVE-2026-36189 | Medium | 6.2 | 2026-05-21 | Buffer Overflow vulnerability in Uncrustify Project Affected v.Uncrustify_d-0.82.0-132-bcc41cbdc and Fixed in commit 68e67b9a1435a1bb173b106fedb4a4f510972bdc a… |
CVE-2026-1816 | Medium | 6.3 | 2026-05-21 | Improper restriction of excessive authentication attempts vulnerability in Turkiye Electricity Transmission Corporation (TEİAŞ) Mobile Application allows Brute… |
CVE-2026-1815 | Medium | 5.7 | 2026-05-21 | Insufficient session expiration vulnerability in Turkiye Electricity Transmission Corporation (TEİAŞ) Mobile Application allows Session Hijacking. This issue… |
CVE-2026-34926 | Medium | 6.7 | 2026-05-21 | A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to i… |
CVE-2026-6841 | Medium | 6.1 | 2026-05-21 | Request Tracker is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the "Page" parameter in GET requests. An attacker can craft a URL tha… |
CVE-2026-43496 | Medium | 5.5 | 2026-05-21 | In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked When r… |
CVE-2026-0393 | Medium | 6.5 | 2026-05-21 | The affected product may expose credentials remotely between low privileged visualization users during concurrent login operations due to insufficient isolatio… |
CVE-2026-45254 | Medium | 6.5 | 2026-05-21 | In the case of the cap_net service, when a key present in the old limit was omitted from the new limit, the missing key was treated as "allow any" instead of b… |
CVE-2026-45252 | Medium | 5.5 | 2026-05-21 | When a fusefs file system implements extended attributes, the kernel may send a FUSE_LISTXATTR message to the userspace daemon to retrieve the list of extended… |
CVE-2026-42396 | Medium | 4.9 | 2026-05-21 | Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail |
CVE-2026-42002 | Medium | 5.9 | 2026-05-21 | Concurrency and locking defects in GSS-TSIG |
CVE-2026-42000 | Medium | 6.8 | 2026-05-21 | Insufficient Validation of Names During AXFR |
CVE-2026-41999 | Medium | 4.8 | 2026-05-21 | Incorrect Behaviour of Views with TCP PROXY Requests |
CVE-2026-5434 | Medium | 5.9 | 2026-05-21 | Honeywell Control Network Module (CNM) contains insertion of sensitive information into an unintended directory. An attacker could exploit this vulnerability t… |
CVE-2026-27393 | Medium | 5.3 | 2026-05-21 | Missing Authorization vulnerability in Tobias CF7 WOW Styler allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects CF7 W… |
CVE-2026-27349 | Medium | 4.3 | 2026-05-21 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPFunnels Team Mail Mint allows Retrieve Embedded Sensitive Data. … |
CVE-2026-22880 | Medium | 6.1 | 2026-05-21 | Mattermost Mobile Apps versions <=2.37 11.4 2.0.37 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to properly validate the SSO authentication callback origin which allow… |
CVE-2026-4055 | Medium | 4.3 | 2026-05-21 | Mattermost versions 11.5.x <= 11.5.1 fail to validate team-level run_create permission against the target team when creating a playbook run which allows an aut… |
CVE-2026-44076 | Medium | 6.7 | 2026-05-21 | Insufficient sanitization of volume paths in Netatalk 3.1.0 through 4.4.2 allows a local privileged user to inject OS commands and execute arbitrary code via a… |
CVE-2026-44073 | Medium | 5.0 | 2026-05-21 | Authentication modules in Netatalk 1.5.0 through 4.4.2 fail to check the return value of seteuid(), which may allow a remote authenticated attacker to retain e… |
CVE-2026-44067 | Medium | 4.2 | 2026-05-21 | A heap over-read in extended attribute (EA) header parsing in Netatalk 2.1.0 through 4.4.2 allows a remote authenticated attacker to obtain limited information… |
CVE-2026-44065 | Medium | 4.2 | 2026-05-21 | An off-by-two error in lp_write() in papd in Netatalk 2.0.0 through 4.4.2 allows an adjacent network attacker to modify limited data or cause a minor service d… |
CVE-2026-44063 | Medium | 4.2 | 2026-05-21 | An LDAP injection vulnerability in Netatalk 2.1.0 through 4.4.2 allows a remote authenticated attacker to manipulate LDAP queries and obtain limited informatio… |
CVE-2026-44061 | Medium | 5.9 | 2026-05-21 | Netatalk 1.5.0 through 4.4.2 uses DES-ECB for authentication with a timing side channel, which allows a remote attacker to recover authentication credentials v… |
CVE-2026-44059 | Medium | 4.5 | 2026-05-21 | A race condition in the privilege toggle mechanism in Netatalk 2.2.5 through 4.4.2 allows a local attacker to obtain limited information, modify limited data… |
CVE-2026-44056 | Medium | 6.4 | 2026-05-21 | A stack-based buffer overflow in desktop.c in Netatalk 1.3 through 4.2.2 allows a remote authenticated attacker to cause a denial of service, obtain limited in… |
CVE-2026-44054 | Medium | 6.5 | 2026-05-21 | Netatalk 2.0.0 through 4.4.2 generates AFP session tokens derived from predictable process IDs, which allows a remote authenticated attacker to cause a denial… |
CVE-2026-2734 | Medium | 6.5 | 2026-05-21 | In mlflow/mlflow versions up to 3.9.0, the `SearchModelVersions` REST API endpoint and the `mlflowSearchModelVersions` GraphQL query lack proper per-model auth… |
CVE-2026-1543 | Medium | 6.4 | 2026-05-21 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, and including, 3.15… |
CVE-2026-4811 | Medium | 4.9 | 2026-05-21 | The WPB Floating Menu & Categories for WordPress – Sticky Side Menu with Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Icon… |
CVE-2026-1881 | Medium | 4.3 | 2026-05-21 | The Broadstreet plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.52.2 via the get_sponsored_meta… |
CVE-2026-9149 | Medium | 6.5 | 2026-05-21 | A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size v… |
CVE-2026-9150 | Medium | 6.5 | 2026-05-20 | A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser when processing specially crafted Debian… |
CVE-2026-40102 | Medium | 6.5 | 2026-05-20 | Plane is an open-source project management tool. In versions 1.3.0 and below, SavedAnalyticEndpoint passes the user-controlled segment query parameter directly… |
CVE-2026-40094 | Medium | 4.3 | 2026-05-20 | nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In versions 1.3.0 and prior, network-libp2p discovery accepts signed PeerCo… |
CVE-2026-39960 | Medium | 5.4 | 2026-05-20 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and below contain flawed logic that causes improper escaping of a textarea custo… |
CVE-2026-9136 | Medium | 6.5 | 2026-05-20 | A vulnerability was identified in the ShadowAttribute proposal creation workflow. The add action accepted user-controlled ShadowAttribute request data without… |
CVE-2026-9124 | Medium | 5.3 | 2026-05-20 | Insufficient validation of untrusted input in Input in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer proc… |
CVE-2026-9122 | Medium | 6.5 | 2026-05-20 | Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote attacker to obtain potentially sensitive information from process me… |
CVE-2026-9116 | Medium | 4.3 | 2026-05-20 | Insufficient policy enforcement in ServiceWorker in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to leak cross-origin data via a crafted… |
CVE-2026-9115 | Medium | 4.3 | 2026-05-20 | Insufficient policy enforcement in Service Worker in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to bypass same origin policy via a craf… |
CVE-2026-9113 | Medium | 4.3 | 2026-05-20 | Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML… |
CVE-2026-9110 | Medium | 4.2 | 2026-05-20 | Inappropriate implementation in UI in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer process to pe… |
CVE-2026-47099 | Medium | 6.1 | 2026-05-20 | TeleJSON prior to 6.0.0 contains a DOM-based cross-site scripting vulnerability in the parse() function that allows attackers to execute arbitrary JavaScript b… |
CVE-2026-39311 | Medium | 6.8 | 2026-05-20 | Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Versions 0.102.1 and prior contain… |
CVE-2026-35016 | Medium | 4.6 | 2026-05-20 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in search.php that allows authenticated attackers to inject arbitrary J… |
CVE-2026-35015 | Medium | 4.6 | 2026-05-20 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in do_unit_mail.php that allows authenticated attackers to inject arbit… |
CVE-2026-35014 | Medium | 4.6 | 2026-05-20 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in routes_nm.php that allows authenticated attackers to inject arbitrar… |
CVE-2026-35013 | Medium | 4.6 | 2026-05-20 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in street_view.php that allows authenticated attackers to inject arbitr… |
CVE-2026-35012 | Medium | 4.6 | 2026-05-20 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in add_facnote.php that allows authenticated attackers to inject arbitr… |
CVE-2026-35011 | Medium | 4.6 | 2026-05-20 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in opena.php that allows authenticated attackers to inject arbitrary Ja… |
CVE-2026-35010 | Medium | 4.6 | 2026-05-20 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in patient_JF.php that allows authenticated attackers to inject arbitra… |
CVE-2026-35009 | Medium | 4.6 | 2026-05-20 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in add_note.php that allows authenticated attackers to inject arbitrary… |