Search
35,912 CVEs · Medium severity
CVEs (35,912, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 376–400 of 35,912 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-113794 | MEDIUM | Patched | — | 2026-10-21 | pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, an attacker can craft an incomplete PDF that ends inside a standard cross-reference table, causing… |
| CVE-2026-113793 | MEDIUM | Patched | — | 2026-10-21 | pypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, removing an object from a crafted cyclic PDF tree, such as an outline item, can enter an infinite … |
| CVE-2026-113792 | MEDIUM | Patched | — | 2026-10-21 | pypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, calling PdfWriter.find_outline_item on a crafted PDF with a cyclic outline hierarchy can enter an … |
| CVE-2026-113791 | MEDIUM | Patched | — | 2026-10-21 | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing a content stream with many small operations, causing parsin… |
| CVE-2026-113790 | MEDIUM | Patched | — | 2026-10-21 | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing arrays or dictionaries with many elements, causing parsing … |
| CVE-2026-113789 | MEDIUM | Patched | — | 2026-10-21 | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF that causes large memory usage or long runtimes when an application re… |
| CVE-2026-113787 | MEDIUM | 6.1 | 2026-10-21 | odf-kit allows users to generate, fill, read, and convert OpenDocument Format files (.odt, .ods) in TypeScript and JavaScript. Starting in version 0.6.0 and prior to versio… | |
| CVE-2026-102485 | MEDIUM | Patched | 5.2 | 2026-10-21 | Out-of-bounds read in the Motorola Oncore refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the GPS receiver's serial data to crash ntpd or disclo… |
| CVE-2026-102484 | MEDIUM | Patched | 6.4 | 2026-10-21 | Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the Telephone JJY time source to corrupt memory or crash n… |
| CVE-2026-111837 | MEDIUM | 6.5 | 2026-10-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker Contest Gallery contest-gallery allows Stored XSS.Thi… | |
| CVE-2026-111835 | MEDIUM | 6.5 | 2026-10-21 | Missing Authorization vulnerability in bjorntech BjornTech Swish for WooCommerce woo-swish-e-commerce allows Exploiting Incorrectly Configured Access Control Security Level… | |
| CVE-2025-60497 | MEDIUM | Patched | 5.5 | 2026-10-21 | A segmentation violation in the GetESD function (/isomedia/track.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a cr… |
| CVE-2025-60492 | MEDIUM | Patched | 5.5 | 2026-10-21 | A stack overflow in the gf_bifs_dec_node function (/bifs/field_decode.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying… |
| CVE-2026-114437 | MEDIUM | Patched | 4.8 | 2026-10-21 | In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in … |
| CVE-2026-104947 | MEDIUM | — | 2026-10-21 | WarehousePG (WHPG) 7.2.1 through 7.6.0 is affected by a missing authorization vulnerability (CWE-862) in the built-in function gp_log_backend_memory_contexts(). Any authent… | |
| CVE-2024-7478 | MEDIUM | 5.8 | 2026-10-21 | When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempt… | |
| CVE-2024-6423 | MEDIUM | 4.0 | 2026-10-21 | The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be… | |
| CVE-2024-5139 | MEDIUM | 6.1 | 2026-10-21 | The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be … | |
| CVE-2024-4989 | MEDIUM | 5.4 | 2026-10-21 | The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability … | |
| CVE-2026-84727 | MEDIUM | 5.4 | 2026-10-21 | Use-after-free in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows a malicious RTMP peer to crash the process or potentially corru… | |
| CVE-2026-114407 | MEDIUM | Patched | 6.1 | 2026-10-21 | e107 CMS before 2.3.13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML by manipulating the author GET… |
| CVE-2026-114402 | MEDIUM | 4.3 | 2026-10-21 | Trudesk through 1.2.11 contains a path traversal and authorization bypass vulnerability in accountsController.uploadImage that allows authenticated users to overwrite other… | |
| CVE-2026-114401 | MEDIUM | 5.3 | 2026-10-21 | Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to PO… | |
| CVE-2026-114404 | MEDIUM | 6.1 | 2026-10-21 | PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into… | |
| CVE-2026-114398 | MEDIUM | 5.4 | 2026-10-21 | Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the upload… |