Search
172,839 CVEs · Medium severity
CVEs (172,839, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 401–425 of 172,839 (capped at 500)
| CVE ID ↓ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-96548 | MEDIUM | 5.6 | 2026-09-23 | A flaw has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects an unknown part of the file ssm_pro/src/main/resources/jdbc.proper… | |
| CVE-2026-96545 | MEDIUM | 4.4 | 2026-09-23 | An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-i… | |
| CVE-2026-96542 | MEDIUM | 5.0 | 2026-10-16 | Incorrect permission assignment (CWE-732) in the standalone installer for EA Javelin Anticheat (versions 1.0.14329371, 1.0.14547437, 1.0.14789537, and 1.0.14940698) on Wind… | |
| CVE-2026-96539 | MEDIUM | 5.6 | 2026-10-09 | Incorrect Privilege Assignment vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a thr… | |
| CVE-2026-96535 | MEDIUM | — | 2026-10-13 | Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL. This occurs due to a lack of sa… | |
| CVE-2026-96533 | MEDIUM | 5.8 | 2026-09-26 | The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-supplied URL before fetching it server-side and storing the response as a public file, allow… | |
| CVE-2026-96531 | MEDIUM | Patched | 6.8 | 2026-09-26 | The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element, allow… |
| CVE-2026-96530 | MEDIUM | Patched | 6.5 | 2026-10-07 | The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a dashboard widget, allowing … |
| CVE-2026-96518 | MEDIUM | 5.9 | 2026-10-09 | Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… | |
| CVE-2026-9651 | MEDIUM | Patched | 4.4 | 2026-06-25 | CWE-732 Incorrect Permission Assignment for Critical Resource vulnerability that could cause unauthorized disclosure of password hashes and potential account compromise whe… |
| CVE-2026-9646 | MEDIUM | 6.1 | 2026-05-28 | A reflected cross-site scripting issue exists in URL handling. | |
| CVE-2026-96456 | MEDIUM | 6.3 | 2026-09-23 | The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bl… | |
| CVE-2026-96450 | MEDIUM | 5.4 | 2026-09-30 | Contributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3 versions. | |
| CVE-2026-96449 | MEDIUM | 5.3 | 2026-10-15 | Missing Authorization vulnerability in WPExperts WP EasyPay wp-easy-pay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP EasyPa… | |
| CVE-2026-96448 | MEDIUM | 6.6 | 2026-09-25 | A flaw was found in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak, an identity and access management solution. The issue occurs when the system checks if… | |
| CVE-2026-96446 | MEDIUM | 4.2 | 2026-09-23 | A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none is used, which allows … | |
| CVE-2026-96445 | MEDIUM | 6.8 | 2026-09-23 | A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP head… | |
| CVE-2026-96443 | MEDIUM | 6.5 | 2026-09-23 | Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE. | |
| CVE-2026-9644 | MEDIUM | 6.4 | 2026-05-28 | The LiveSmart Video Chat Live Video Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'livesmart_widget' shortcode in all versions up … | |
| CVE-2026-96425 | MEDIUM | 5.5 | 2026-10-16 | Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus | |
| CVE-2026-96423 | MEDIUM | Patched | 5.5 | 2026-09-29 | X11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service |
| CVE-2026-96422 | MEDIUM | Patched | 5.5 | 2026-09-29 | Frame protocol metadissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service |
| CVE-2026-96421 | MEDIUM | Patched | 5.5 | 2026-09-29 | USB HID protocol dissector infinite loop and memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service |
| CVE-2026-96420 | MEDIUM | Patched | 4.7 | 2026-09-29 | Toshiba file parser crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service |
| CVE-2026-96419 | MEDIUM | Patched | 5.5 | 2026-09-29 | Profile import crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service and possible code execution |