Search
172,839 CVEs · Medium severity
CVEs (172,839, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 276–300 of 172,839 (capped at 500)
| CVE ID ↓ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-97146 | MEDIUM | Patched | — | 2026-10-07 | Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod. If the pod has the label 'app=yunikorn' the ch… |
| CVE-2026-9714 | MEDIUM | 6.4 | 2026-05-29 | The Simple Divi Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the [showmodule] shortcode in versions up to, and incl… | |
| CVE-2026-9708 | MEDIUM | Patched | 4.9 | 2026-07-13 | Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate that an assigned incoming webhook user has access to the target team or channel… |
| CVE-2026-97079 | MEDIUM | 4.3 | 2026-09-30 | Subscriber Insecure Direct Object References (IDOR) in Webba Booking <= 6.5.0 versions. | |
| CVE-2026-97078 | MEDIUM | 5.3 | 2026-09-30 | Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by Sprout Invoices <= 20.8.17 versions. | |
| CVE-2026-97075 | MEDIUM | Patched | 6.5 | 2026-10-09 | Missing Authorization vulnerability in WP Media WP Rocket wp-rocket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Rocket: fr… |
| CVE-2026-97074 | MEDIUM | 4.3 | 2026-09-30 | Subscriber Insecure Direct Object References (IDOR) in Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0 versions. | |
| CVE-2026-97071 | MEDIUM | 5.3 | 2026-10-05 | Incorrect Calculation vulnerability in VillaTheme CURCY woo-multi-currency allows Integer Attacks.This issue affects CURCY: from n/a through 2.2.17. | |
| CVE-2026-97070 | MEDIUM | — | 2026-10-05 | Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels… | |
| CVE-2026-97067 | MEDIUM | 6.5 | 2026-09-30 | Contributor Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.7 versions. | |
| CVE-2026-97066 | MEDIUM | 5.3 | 2026-09-30 | Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions. | |
| CVE-2026-97062 | MEDIUM | Patched | 5.4 | 2026-09-24 | Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to… |
| CVE-2026-97061 | MEDIUM | 4.3 | 2026-09-24 | Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the instan… | |
| CVE-2026-97056 | MEDIUM | Patched | 6.8 | 2026-09-24 | SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when configured to use the opaque session tokenizer (which was not the default before v0.143.0), do not rev… |
| CVE-2026-9705 | MEDIUM | Patched | 6.5 | 2026-06-25 | A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access Token (RAT), could exploit this vulnerabil… |
| CVE-2026-9704 | MEDIUM | 6.8 | 2026-05-27 | A flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized subject_token JSON Web Token (JWT) to the Tok… | |
| CVE-2026-97030 | MEDIUM | 6.1 | 2026-10-08 | A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keywo… | |
| CVE-2026-97029 | MEDIUM | 5.7 | 2026-09-29 | Flatpak's process ID namespace separation does not prevent a sandboxed app's kill(0, signal) or killpg(0, signal) calls from reaching processes outside the sandbox that sha… | |
| CVE-2026-97020 | MEDIUM | 6.4 | 2026-10-14 | The PO/MO Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'podata' parameter in all versions up to, and including, 1.4.2 due to insufficien… | |
| CVE-2026-97014 | MEDIUM | 5.5 | 2026-10-13 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | |
| CVE-2026-97005 | MEDIUM | 5.5 | 2026-10-13 | Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. | |
| CVE-2026-9699 | MEDIUM | 6.8 | 2026-06-26 | Mattermost Plugins versions <=11.6 10.18.11 11.3.6 11.6.5.0 fail to sanitize error responses from the OpenAI API before logging, which allows a user with access to server l… | |
| CVE-2026-9696 | MEDIUM | 6.4 | 2026-10-10 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'not_found' parameter in all versions up to, and including, 3.3.58 due to ins… | |
| CVE-2026-96948 | MEDIUM | Patched | 5.5 | 2026-10-13 | Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to disclose information locally. |
| CVE-2026-96944 | MEDIUM | Patched | 5.5 | 2026-10-13 | Insertion of sensitive information into externally-accessible file or directory in Windows Storage allows an authorized attacker to disclose information locally. |