Search
163,503 CVEs · Medium severity
CVEs (163,503, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 26–50 of 163,503 (capped at 500)
| CVE ID ↓ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-9859 | MEDIUM | Patched | 6.5 | 2026-08-17 | Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to enforce PermissionManageBoardRoles on the channelId field of the batch endpoint, which a… |
| CVE-2026-9857 | MEDIUM | 4.3 | 2026-07-10 | The Invoice123 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.0. This is due to the plugin not properly verifying that… | |
| CVE-2026-9838 | MEDIUM | 6.1 | 2026-07-10 | The ICS Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'htmltagtitle' parameter in all versions up to, and including, 12.0.9 due to i… | |
| CVE-2026-9831 | MEDIUM | 6.3 | 2026-05-29 | A race condition in the shared Extreme Platform ONE IAM Gateway API-key authentication path could, under specific high-concurrency traffic conditions, intermittently allow … | |
| CVE-2026-9829 | MEDIUM | 6.5 | 2026-06-06 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'compact_album_order_by' Shortcode Parameter i… | |
| CVE-2026-9824 | MEDIUM | Patched | 4.3 | 2026-07-13 | Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to check the manage_shared_channels permission in the /share-channel autocomplete handler, … |
| CVE-2026-9822 | MEDIUM | Patched | 6.5 | 2026-06-19 | The WP Hotel Booking WordPress plugin before 2.3.1 does not enforce capability checks in several of its AJAX handlers, allowing authenticated users with Subscriber-level ac… |
| CVE-2026-9815 | MEDIUM | 6.5 | 2026-06-18 | The MagicForm WordPress plugin through 0.1.3 does not properly validate the type of files uploaded through an unauthenticated AJAX action when a form's per-field extension … | |
| CVE-2026-9811 | MEDIUM | 5.4 | 2026-05-29 | A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7. When rendering selection menus for associating projects with system … | |
| CVE-2026-9807 | MEDIUM | Patched | 4.3 | 2026-05-28 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions c… |
| CVE-2026-9803 | MEDIUM | 5.3 | 2026-05-28 | A flaw was found in Keycloak's ClientRegistrationAuth component. A remote unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST reques… | |
| CVE-2026-9802 | MEDIUM | 6.8 | 2026-05-28 | A flaw was found in Keycloak. When revokeRefreshToken=true is enabled and persistent session storage is in use, a server restart can reset internal timing mechanisms. This … | |
| CVE-2026-9801 | MEDIUM | 4.9 | 2026-05-28 | A flaw was found in Keycloak. A remote attacker with high privileges, such as a realm administrator configuring a malicious Lightweight Directory Access Protocol (LDAP) ser… | |
| CVE-2026-9799 | MEDIUM | Patched | 4.6 | 2026-06-25 | A flaw was found in org.keycloak.authorization. An authenticated user with a granted User-Managed Access (UMA) permission ticket for one resource can exploit this by using … |
| CVE-2026-9798 | MEDIUM | 4.3 | 2026-05-28 | A flaw was found in Keycloak, an open-source identity and access management solution. When a user account is temporarily locked due to repeated failed login attempts, an at… | |
| CVE-2026-9796 | MEDIUM | 6.5 | 2026-05-28 | A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-ba… | |
| CVE-2026-9794 | MEDIUM | 5.3 | 2026-05-28 | A flaw was found in Keycloak. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted SOAP requests to the SAML ECP (Security Asserti… | |
| CVE-2026-9793 | MEDIUM | 5.9 | 2026-05-28 | A flaw was found in Keycloak. When a JSON Web Encryption (JWE) encrypted request object is submitted, Keycloak may incorrectly process unsigned claims if the decrypted cont… | |
| CVE-2026-9792 | MEDIUM | 6.5 | 2026-05-28 | A flaw was found in Keycloak's Client Policies, specifically within the `org.keycloak.protocol.oidc` component. When certain condition providers (client-type, client-roles,… | |
| CVE-2026-9791 | MEDIUM | 4.3 | 2026-05-28 | A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit this flaw by accessing user-facing APIs, such as the account API or by… | |
| CVE-2026-9775 | MEDIUM | Patched | 6.5 | 2026-06-24 | ATEN Unizon uploadSSL Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installati… |
| CVE-2026-9774 | MEDIUM | Patched | 6.5 | 2026-06-24 | ATEN Unizon updateLicense Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected instal… |
| CVE-2026-9770 | MEDIUM | Patched | 5.3 | 2026-07-15 | Kasa EC71 v4 and EC70 v4 firmware contains a static cryptographic private key stored in a read-only filesystem that is shared across devices. An attacker with access to th… |
| CVE-2026-9767 | MEDIUM | 6.5 | 2026-08-16 | The The School Management – Education & Learning ERP plugin for WordPress is vulnerable to generic SQL Injection via 'order[0][dir]' Parameter in all versions up to, and in… | |
| CVE-2026-9759 | MEDIUM | Patched | 5.5 | 2026-05-27 | ROHC protocol dissector crash in Wireshark 4.6.0 to 4.6.5 and 4.4.0 to 4.4.15 allows denial of service |