Search
172,839 CVEs · Medium severity
CVEs (172,839, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 251–275 of 172,839 (capped at 500)
| CVE ID ↓ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-97239 | MEDIUM | 6.5 | 2026-09-30 | Subscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 versions. | |
| CVE-2026-97238 | MEDIUM | 5.5 | 2026-09-30 | Subscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions. | |
| CVE-2026-97236 | MEDIUM | 6.5 | 2026-09-30 | Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions. | |
| CVE-2026-97232 | MEDIUM | 6.3 | 2026-09-24 | A vulnerability was determined in volotat Anagnorisis up to 0.4.2. Affected by this vulnerability is the function get_file_content/save_file_content/move_files/start_stream… | |
| CVE-2026-9723 | MEDIUM | 4.3 | 2026-06-02 | The Google Plus One Bottom plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.0.2. This is due to missing or incorrect… | |
| CVE-2026-97227 | MEDIUM | Patched | 5.9 | 2026-09-27 | The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, relying on a nonc… |
| CVE-2026-97226 | MEDIUM | 6.3 | 2026-09-24 | A vulnerability has been found in DbGate up to 7.2.5/7.3.1-premium-beta.1. This impacts the function fs.readFile of the file packages/api/src/controllers/files.js of the co… | |
| CVE-2026-97225 | MEDIUM | 6.3 | 2026-09-24 | A flaw has been found in DbGate up to 7.2.5-beta.5. This affects an unknown function of the file packages/api/src/controllers/runners.js of the component JSON Runner. Execu… | |
| CVE-2026-97224 | MEDIUM | 4.3 | 2026-09-24 | A vulnerability was detected in Excalidraw up to 0.18.1. The impacted element is an unknown function of the file packages/excalidraw/data/restore.ts of the component Import… | |
| CVE-2026-97222 | MEDIUM | 5.5 | 2026-09-25 | A heap use-after-free flaw was found in Gnumeric. When a user opens a crafted Gnumeric workbook containing a malformed SheetObjectComponent element, the XML parser can dere… | |
| CVE-2026-9722 | MEDIUM | 4.3 | 2026-06-02 | The Laiser Tag plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.5. This is due to missing or incorrect nonce valid… | |
| CVE-2026-97219 | MEDIUM | Patched | 4.3 | 2026-10-02 | The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable acc… |
| CVE-2026-97212 | MEDIUM | 7.3 | 2026-10-02 | The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This impl… | |
| CVE-2026-9721 | MEDIUM | 4.3 | 2026-06-24 | The Book a Room Event Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9. This is due to missing or incorre… | |
| CVE-2026-97208 | MEDIUM | Patched | 4.9 | 2026-10-06 | The Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/{owner}/{repo}/push_mirrors`) checked only whether mirroring was enabled and not the `[mirror] DISABLE… |
| CVE-2026-9720 | MEDIUM | 4.3 | 2026-07-29 | The Facturación Electrónica Costa Rica plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing … | |
| CVE-2026-9719 | MEDIUM | 4.3 | 2026-06-06 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5… | |
| CVE-2026-97183 | MEDIUM | 4.3 | 2026-10-11 | The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticated user, such as a Subscriber, to… | |
| CVE-2026-97181 | MEDIUM | 5.3 | 2026-09-24 | GPM LIGHT developed by ezGlobal has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can directly access system logs. | |
| CVE-2026-9718 | MEDIUM | Patched | 6.5 | 2026-06-25 | CWE-617 Reachable Assertion vulnerability exists that could allow an authenticated attacker to trigger a denial-of-service condition, impacting system availability when a s… |
| CVE-2026-97179 | MEDIUM | 4.3 | 2026-09-24 | A security vulnerability has been detected in O2OA up to 9.5.3/10.0.2. This vulnerability affects the function list of the file o2server/x_base_core_project/src/main/java/c… | |
| CVE-2026-97177 | MEDIUM | 6.6 | 2026-09-24 | A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific passwo… | |
| CVE-2026-97176 | MEDIUM | 4.2 | 2026-09-24 | A flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. The issue occurs when a client specifically r… | |
| CVE-2026-97155 | MEDIUM | Patched | 6.5 | 2026-09-24 | Fabasoft Folio Client before 2026, a locally installed component that communicates with the Fabasoft browser extension via web messaging, does not restrict which web origin… |
| CVE-2026-97149 | MEDIUM | Patched | — | 2026-09-24 | In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and pat… |