Search
172,839 CVEs · Medium severity
CVEs (172,839, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 351–375 of 172,839 (capped at 500)
| CVE ID ↓ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-96777 | MEDIUM | 6.3 | 2026-09-24 | A vulnerability was determined in Forma LMS up to 4.1.43. This impacts the function UserselectorAdmController::getDataTask of the file /appCore/ajax.adm_server.php?r=adm/us… | |
| CVE-2026-96774 | MEDIUM | 5.3 | 2026-09-24 | A vulnerability was found in SPON Communications IP Network Audio Device XC-9603 1.2.3_20181106 Build 107. This affects the function loadCfg of the file /ini/sys_cfg.txt of… | |
| CVE-2026-96773 | MEDIUM | 4.3 | 2026-09-24 | A weakness has been identified in Intelliants Subrion CMS up to 4.2.1. This vulnerability affects the function iaUsers::authorize of the file front/login.php of the compone… | |
| CVE-2026-96772 | MEDIUM | 5.3 | 2026-09-24 | A security flaw has been discovered in Intelliants Subrion CMS up to 4.2.1. This affects an unknown part of the file /actions.json?action=assign-owner. The manipulation of … | |
| CVE-2026-9677 | MEDIUM | 4.8 | 2026-06-27 | The Shariff for WordPress Shariff for WordPress plugin through 1.0.11 does not sanitize or escape the shariff_infourl setting before outputting it in the frontend HTML via … | |
| CVE-2026-96766 | MEDIUM | 6.4 | 2026-09-25 | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'business_hours'… | |
| CVE-2026-96764 | MEDIUM | 4.3 | 2026-09-24 | A weakness has been identified in kvcache-ai mooncake up to 0.3.12/0.3.14-rc1. Impacted is the function MasterService::GetReplicaListByRegex of the component Regular Expres… | |
| CVE-2026-96763 | MEDIUM | 5.4 | 2026-09-24 | A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.post1/0.3.14-rc1. This issue affects the function ScopedSegmentAccess::MountSegment of the fi… | |
| CVE-2026-9676 | MEDIUM | Patched | 4.3 | 2026-06-29 | The F4 Post Tree WordPress plugin before 2.0.5 does not perform capability checks or CSRF/nonce verification on one of its AJAX actions, allowing authenticated users with S… |
| CVE-2026-96748 | MEDIUM | 6.5 | 2026-09-24 | PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a… | |
| CVE-2026-96747 | MEDIUM | 5.0 | 2026-09-24 | The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path r… | |
| CVE-2026-96746 | MEDIUM | 6.5 | 2026-09-24 | An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the responses of the h… | |
| CVE-2026-96745 | MEDIUM | 5.6 | 2026-09-24 | Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driv… | |
| CVE-2026-96743 | MEDIUM | 6.4 | 2026-10-10 | The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Field Value in all versions up to, and including, 1.4.1-R… | |
| CVE-2026-96740 | MEDIUM | 6.5 | 2026-09-28 | A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminC… | |
| CVE-2026-9674 | MEDIUM | Patched | 4.3 | 2026-05-27 | A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 662.vd2e0001f6b_b_d and earlier allows attackers to resume failed Multijob builds. |
| CVE-2026-96739 | MEDIUM | 4.3 | 2026-09-24 | A flaw has been found in SEMCMS up to 4.2. Affected by this issue is some unknown functionality of the file /Edit/php/upload_json.php of the component KindEditor Upload Int… | |
| CVE-2026-9673 | MEDIUM | Patched | 6.8 | 2026-05-28 | Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An attacker can i… |
| CVE-2026-96680 | MEDIUM | 4.3 | 2026-09-23 | A vulnerability was detected in ByteDance Coze Scraper Extension up to 2.0.2. Affected by this vulnerability is the function chrome.runtime.onMessageExternal.addListener of… | |
| CVE-2026-9668 | MEDIUM | 6.3 | 2026-08-26 | With legitimate user credentials in hand, attackers can construct malicious SQL statements to bypass authentication logic and execute arbitrary database queries directly. T… | |
| CVE-2026-96678 | MEDIUM | 6.3 | 2026-09-23 | A security vulnerability has been detected in weiqingwen spring-boot-forum up to 538eecc3c6b85fdf0768ab4e8354b48c0c17d94f. Affected is the function validate of the file src… | |
| CVE-2026-96676 | MEDIUM | 6.3 | 2026-09-23 | A vulnerability was identified in Fast FAC1900R 20190827_2.0.2. The impacted element is the function get_alias_name of the component uhttpd. Such manipulation leads to stac… | |
| CVE-2026-96674 | MEDIUM | 4.4 | 2026-09-23 | alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attac… | |
| CVE-2026-96672 | MEDIUM | Patched | 6.4 | 2026-09-23 | Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculation_formula values reference whitelisted methods before passing them to frapp… |
| CVE-2026-9667 | MEDIUM | Patched | 5.3 | 2026-09-10 | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) that could allow a remote, unauthenticated attacker to cause the server to… |