Search
172,839 CVEs · Medium severity
CVEs (172,839, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 401–425 of 172,839 (capped at 500)
| CVE ID | Severity ↓ | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-114395 | MEDIUM | 4.3 | 2026-10-21 | Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomple… | |
| CVE-2026-114398 | MEDIUM | 5.4 | 2026-10-21 | Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the upload… | |
| CVE-2026-114388 | MEDIUM | Patched | 5.3 | 2026-10-21 | Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in GradebookController that allows unauthenticated users … |
| CVE-2026-114390 | MEDIUM | Patched | 5.3 | 2026-10-21 | Chamilo LMS from 2.0.0-alpha.1 before 2.0.0-RC.3 contains a missing authorization vulnerability in legacy AJAX handlers under public/main/inc/ajax/ that exposes user names … |
| CVE-2026-114389 | MEDIUM | Patched | 4.3 | 2026-10-21 | Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in AiController::openAnswerGrade that allows any authenticated user to obtai… |
| CVE-2026-114392 | MEDIUM | 5.3 | 2026-10-21 | Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET /api/v1/tickets/:uid. Att… | |
| CVE-2026-114393 | MEDIUM | 4.3 | 2026-10-21 | Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id … | |
| CVE-2026-114386 | MEDIUM | Patched | 4.8 | 2026-10-21 | Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.tool_calls_limit on nested tool calls dispatched from run_code in the CodeMode toolset. Users or prompt-injec… |
| CVE-2026-114245 | MEDIUM | 7.3 | 2026-10-21 | A weakness has been identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by th… | |
| CVE-2026-114120 | MEDIUM | Patched | 5.4 | 2026-10-21 | SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via… |
| CVE-2026-105923 | MEDIUM | — | 2026-10-21 | A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type. | |
| CVE-2026-96405 | MEDIUM | 5.3 | 2026-10-21 | NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompress… | |
| CVE-2026-14556 | MEDIUM | Patched | 5.4 | 2026-10-21 | The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing una… |
| CVE-2026-50106 | MEDIUM | 6.5 | 2026-10-21 | When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whos… | |
| CVE-2026-105256 | MEDIUM | Patched | 5.3 | 2026-10-21 | The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is charged for a booking against the amounts the service an… |
| CVE-2026-107447 | MEDIUM | Patched | 5.3 | 2026-10-21 | The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-sup… |
| CVE-2026-109125 | MEDIUM | 5.3 | 2026-10-21 | In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-threshold > 0' configurations (not a d… | |
| CVE-2026-101138 | MEDIUM | Patched | 5.3 | 2026-10-21 | The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages added to its page whitelist by manually entered URL pa… |
| CVE-2026-103301 | MEDIUM | Patched | 5.3 | 2026-10-21 | The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify the authenticity of incoming payment notifications, because the secret used to sign them is em… |
| CVE-2026-104641 | MEDIUM | Patched | 5.3 | 2026-10-21 | The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in it… |
| CVE-2026-17557 | MEDIUM | 6.5 | 2026-10-21 | A flaw was found in the `lm-evaluation-harness` component of Red Hat OpenShift AI. An authenticated user, able to submit an evaluation job, could exploit this by providing … | |
| CVE-2026-93856 | MEDIUM | 4.3 | 2026-10-21 | In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role m… | |
| CVE-2026-86611 | MEDIUM | Patched | 4.3 | 2026-10-21 | The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a l… |
| CVE-2026-87837 | MEDIUM | Patched | 5.3 | 2026-10-21 | The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing… |
| CVE-2026-87838 | MEDIUM | Patched | 6.5 | 2026-10-21 | The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin verification on one of its public REST endpoints, allowing unauth… |