Medium-severity CVEs (page 95)
Page 95 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-6472 | Medium | 5.4 | 2026-05-14 | Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use search_path to find user-defined types, including ext… |
CVE-2026-6008 | Medium | 6.8 | 2026-05-14 | Authorization bypass through User-Controlled key vulnerability in Im Park Information Technology, Electronics, Press, Publishing and Advertising, Education Ltd… |
CVE-2026-43644 | Medium | 5.4 | 2026-05-14 | podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body c… |
CVE-2026-45205 | Medium | 5.3 | 2026-05-14 | Uncontrolled Recursion vulnerability in Apache Commons. When processing an untrusted configuration file, Commons Configuration will throw a StackOverflowError… |
CVE-2026-6504 | Medium | 6.4 | 2026-05-14 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title_tag' parameter in all versions up to… |
CVE-2026-6206 | Medium | 5.3 | 2026-05-14 | The MW WP Form plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 5.1.2 via the _get_post_property_from_querystri… |
CVE-2026-6174 | Medium | 6.4 | 2026-05-14 | The CC Child Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'more' parameter in all versions up to, and including, 2.1.1 due t… |
CVE-2026-6145 | Medium | 5.3 | 2026-05-14 | The User Registration & Membership plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.1.5. This is due to the… |
CVE-2026-6670 | Medium | 6.5 | 2026-05-14 | The Media Sync plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.4.9 via the 'sub_dir' and 'media_items' parameters… |
CVE-2026-6252 | Medium | 6.4 | 2026-05-14 | The Meta Field Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' block attribute in all versions up to, and including… |
CVE-2026-6225 | Medium | 6.5 | 2026-05-14 | The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'pro… |
CVE-2026-5365 | Medium | 4.3 | 2026-05-14 | The LatePoint plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 5.3.2. This is due to missing nonce verifica… |
CVE-2026-5193 | Medium | 6.5 | 2026-05-14 | The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to privilege escalation in all versions up to, an… |
CVE-2026-3694 | Medium | 6.4 | 2026-05-14 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the bt_bb_button shortcode in all versions… |
CVE-2026-8280 | Medium | 6.5 | 2026-05-14 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have al… |
CVE-2026-8144 | Medium | 4.3 | 2026-05-14 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have a… |
CVE-2026-6417 | Medium | 6.1 | 2026-05-14 | The GLS Shipping for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'failed_orders' parameter in all versions up to… |
CVE-2026-6335 | Medium | 5.4 | 2026-05-14 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.3 that under certain conditions could have allowed an authenticat… |
CVE-2026-6063 | Medium | 4.3 | 2026-05-14 | GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that under certain… |
CVE-2026-5243 | Medium | 6.4 | 2026-05-14 | The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to stored cross-si… |
CVE-2026-4527 | Medium | 6.5 | 2026-05-14 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have… |
CVE-2026-4524 | Medium | 6.5 | 2026-05-14 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have… |
CVE-2026-3829 | Medium | 5.4 | 2026-05-14 | The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to unauthorized modification… |
CVE-2026-3607 | Medium | 4.3 | 2026-05-14 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have a… |
CVE-2026-3160 | Medium | 5.8 | 2026-05-14 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have a… |
CVE-2026-3074 | Medium | 4.3 | 2026-05-14 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have a… |
CVE-2026-3073 | Medium | 4.3 | 2026-05-14 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have a… |
CVE-2026-1338 | Medium | 4.3 | 2026-05-14 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have… |
CVE-2026-1322 | Medium | 6.8 | 2026-05-14 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have a… |
CVE-2026-1184 | Medium | 6.5 | 2026-05-14 | GitLab has remediated an issue in GitLab EE affecting all versions from 11.9 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allo… |
CVE-2025-15345 | Medium | 6.1 | 2026-05-14 | The MapGeo – Interactive Geo Maps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'map' parameter in the display-map shortcode in… |
CVE-2025-13874 | Medium | 4.3 | 2026-05-14 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have a… |
CVE-2025-12669 | Medium | 5.4 | 2026-05-14 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have… |
CVE-2026-7648 | Medium | 4.3 | 2026-05-14 | The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to payment bypass through user-controlled key in al… |
CVE-2026-7525 | Medium | 4.3 | 2026-05-14 | The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.9. This is due… |
CVE-2026-5361 | Medium | 6.4 | 2026-05-14 | The Envira Gallery Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API in versions up to and including 1.12.4. This is due… |
CVE-2026-5486 | Medium | 6.5 | 2026-05-14 | The Unlimited Elements for Elementor plugin for WordPress is vulnerable to SQL Injection via the 'data[filter_search]' parameter in the get_cat_addons AJAX act… |
CVE-2026-44919 | Medium | 4.3 | 2026-05-14 | In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:///dev/zero URL. |
CVE-2026-41281 | Medium | 4.8 | 2026-05-14 | Android App "あんしんフィルター for au" provided by KDDI CORPORATION contains Cleartext Transmission of Sensitive Information (CWE-319) vulnerability. A man-in-the-midd… |
CVE-2026-44448 | Medium | 5.9 | 2026-05-13 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.102.0 and 16.11.0, certain endpoints failed to enforce proper authorization ch… |
CVE-2026-44445 | Medium | 6.5 | 2026-05-13 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.12.0, an improper restriction of XML external entity (XXE) refere… |
CVE-2026-44441 | Medium | 5.0 | 2026-05-13 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.106.0 and 16.16.0, a malicious user could send a crafted request to an endpoin… |
CVE-2026-44440 | Medium | 6.5 | 2026-05-13 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.101.1 and 16.10.0, an Improper Limitation of a Pathname to a Restricted Direct… |
CVE-2026-44437 | Medium | 6.1 | 2026-05-13 | The Angular SSR is a server-rise rendering tool for Angular applications. From 19.0.0-next.0 to before 19.2.25, 20.3.25, 21.2.9, and 22.0.0-next.7, a vulnerabi… |
CVE-2026-44426 | Medium | 6.5 | 2026-05-13 | ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/namespaces/:tenant returns the full namespace object — including the members list (user IDs, e… |
CVE-2026-44425 | Medium | 5.4 | 2026-05-13 | ShellHub is a centralized SSH gateway. Prior to 0.24.2, the device list endpoint accepts user-controlled identifiers in the the name field of each filter prope… |
CVE-2026-44424 | Medium | 6.5 | 2026-05-13 | ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/devices/:uid returns the full device object whenever the caller is authenticated, without veri… |
CVE-2026-44423 | Medium | 6.5 | 2026-05-13 | ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/sessions/:uid returns the full session object for any authenticated caller, without scoping by… |
CVE-2026-44195 | Medium | 5.3 | 2026-05-13 | OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, a logic flaw in the OPNsense lockout_handler allows an unauthenticated attacker to… |
CVE-2026-45228 | Medium | 5.4 | 2026-05-13 | Quark Drive before 0.8.5 contains a stored cross-site scripting vulnerability in the System Configuration page where the template renders push_config key names… |
CVE-2026-45054 | Medium | 4.9 | 2026-05-13 | CubeCart is an ecommerce software solution. Prior to 6.7.0, the admin orders-transactions listing page (admin.php?_g=orders&node=transactions) builds a raw ORD… |
CVE-2026-44381 | Medium | 5.3 | 2026-05-13 | MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, a SQL injection vulnerability existed in the handling of user-controlled orde… |
CVE-2026-44379 | Medium | 5.3 | 2026-05-13 | MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, MISP Collections did not enforce RFC 4122 UUID validation on the uuid field… |
CVE-2026-44376 | Medium | 6.1 | 2026-05-13 | CubeCart is an ecommerce software solution. Prior to 6.7.0, an unauthenticated Reflected XSS vulnerability exists in the CubeCart v6.x search feature. Due to a… |
CVE-2026-44373 | Medium | 5.3 | 2026-05-13 | Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could bypass a proxy route rule by sending percent-encoded path traversal (..%… |
CVE-2026-44372 | Medium | 6.1 | 2026-05-13 | Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could turn a redirect route rule using wildcards rewrite into a cross-host red… |
CVE-2026-39428 | Medium | 4.8 | 2026-05-13 | CubeCart is an ecommerce software solution. Prior to 6.6.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in CubeCart v6.x. An attacker with adminis… |
CVE-2025-27852 | Medium | 5.0 | 2026-05-13 | The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a reflected cross site scripting (XSS) attack. This allows an attacker on the local… |
CVE-2026-42549 | Medium | 4.4 | 2026-05-13 | Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the make:controller CLI command calls mkdir(..., recursive: true) on a path built from the us… |
CVE-2026-33381 | Medium | 5.9 | 2026-05-13 | When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will… |
CVE-2026-33380 | Medium | 6.3 | 2026-05-13 | A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlEx… |
CVE-2026-33378 | Medium | 6.5 | 2026-05-13 | Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the im… |
CVE-2026-28383 | Medium | 6.5 | 2026-05-13 | A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An authenticated user… |
CVE-2026-28380 | Medium | 6.5 | 2026-05-13 | Any Editor could delete any snapshot, even if they have no access to read or write them. |
CVE-2026-28379 | Medium | 6.5 | 2026-05-13 | A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map ac… |
CVE-2026-28376 | Medium | 6.5 | 2026-05-13 | The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-o… |
CVE-2026-28374 | Medium | 4.3 | 2026-05-13 | Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations. |
CVE-2026-0243 | Medium | 6.5 | 2026-05-13 | A denial of service (DoS) vulnerability in Palo Alto Networks Prisma SD-WAN ION devices enables an unauthenticated attacker in a network adjacent to a Prisma S… |
CVE-2026-8496 | Medium | 6.1 | 2026-05-13 | A cross-site scripting (XSS) vulnerability exists in Alinto SOGo, version 5.12.7. A maliciously crafted ICS calendar invitation files allows arbitrary JavaScr… |
CVE-2026-44248 | Medium | 5.3 | 2026-05-13 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties section is parsed a… |
CVE-2026-42586 | Medium | 6.8 | 2026-05-13 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the Netty Redis codec encoder (RedisEncoder) wri… |
CVE-2026-42585 | Medium | 6.5 | 2026-05-13 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Enco… |
CVE-2026-42581 | Medium | 5.8 | 2026-05-13 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-L… |
CVE-2026-42580 | Medium | 6.5 | 2026-05-13 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int… |
CVE-2026-41255 | Medium | 6.1 | 2026-05-13 | CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, Access to the views via tokens or una… |
CVE-2026-33584 | Medium | 5.3 | 2026-05-13 | Exposed Keycloak management service in the Arqit Symmetric Key Agreement Platform enables unauthorized access to sensitive debug information such as metrics… |
CVE-2026-22677 | Medium | 6.5 | 2026-05-13 | Hermes WebUI prior to 0.51.44 contains a path traversal vulnerability in the session import endpoint that allows authenticated attackers to read arbitrary file… |
CVE-2026-0256 | Medium | 4.8 | 2026-05-13 | A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript… |
CVE-2026-0249 | Medium | 6.5 | 2026-05-13 | Multiple improper certificate validation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enables an attacker to intercept encrypted communications… |
CVE-2026-0248 | Medium | 5.9 | 2026-05-13 | An improper certificate validation vulnerability in the Prisma Access Agent® for Android and Chrome OS enables an attacker to perform a man-in-the-middle (MitM… |
CVE-2026-0245 | Medium | 5.5 | 2026-05-13 | Multiple information disclosure vulnerabilities in Prisma Access Agent® allow a local user to access sensitive configuration data and credentials. The Prism… |
CVE-2026-0239 | Medium | 6.5 | 2026-05-13 | An information disclosure vulnerability in the Chronosphere Chronocollector enables an unauthenticated attacker with network access to the collector service to… |
CVE-2026-0235 | Medium | 4.7 | 2026-05-13 | A race condition vulnerability in Palo Alto Networks Prisma® Browser enables a locally authenticated non-admin user to bypass certain access and data control p… |
CVE-2026-44581 | Medium | 4.7 | 2026-05-13 | Next.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 and 16.2.5, App Router applications that rely on CSP nonce… |
CVE-2026-44580 | Medium | 6.1 | 2026-05-13 | Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive script… |
CVE-2026-44003 | Medium | 5.3 | 2026-05-13 | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's code transformer has a performance optimization that skips AST analysis when the code does… |
CVE-2026-44002 | Medium | 5.8 | 2026-05-13 | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's CallSite wrapper class (intended as a safe wrapper for V8's native CallSite) blocks getThi… |
CVE-2026-44000 | Medium | 6.5 | 2026-05-13 | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox boundary violation in vm2 allows host object identity to cross into the sandbox throug… |
CVE-2026-44577 | Medium | 5.9 | 2026-05-13 | Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default ima… |
CVE-2026-44576 | Medium | 5.4 | 2026-05-13 | Next.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can… |
CVE-2026-2695 | Medium | 6.3 | 2026-05-13 | A command injection vulnerability was discovered in TeamViewer DEX Platform On-Premises (former 1E DEX Platform On-Premises) prior to version 9.2. Improper inp… |
CVE-2024-48519 | Medium | 6.2 | 2026-05-13 | Buffer Overflow vulnerability in Ardupilot rover commit v.c56439b045162058df0ff136afea3081fcd06d38 allows a local attacker to cause a denial of service via the… |
CVE-2026-8367 | Medium | 4.8 | 2026-05-13 | aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued… |
CVE-2026-45740 | Medium | 5.3 | 2026-05-13 | protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit while expandi… |
CVE-2026-45028 | Medium | 6.1 | 2026-05-13 | Astro is a web framework. Astro versions prior to 6.1.10 used AES-GCM encryption to protect the confidentiality and integrity of server island props and slots… |
CVE-2026-44665 | Medium | 6.1 | 2026-05-13 | fast-xml-builder builds XML from JSON. Prior to 1.1.7, when an input data has quotes in attribute values but process entities is not enabled, it breaks the att… |
CVE-2026-44664 | Medium | 6.1 | 2026-05-13 | fast-xml-builder builds XML from JSON. In 1.1.5, the fix for CVE-2026-41650 in fast-xml-parser sanitizes -- sequences in XML comment content using .replace(/--… |
CVE-2026-44479 | Medium | 5.5 | 2026-05-13 | Vercel’s AI Cloud is a unified platform for building modern applications. From 50.16.0 to 52.0.0, hen the Vercel CLI runs in non-interactive mode (--non-inter… |
CVE-2026-44467 | Medium | 6.8 | 2026-05-13 | The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. From 1.2581.0 to before 1.4304.0, Cla… |
CVE-2026-44458 | Medium | 4.3 | 2026-05-13 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, the JSX renderer escapes style attribute object values… |