Search
172,839 CVEs · Medium severity
CVEs (172,839, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 476–500 of 172,839 (capped at 500)
| CVE ID ↓ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-9629 | MEDIUM | 6.4 | 2026-06-13 | The Canvas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' parameter in all versions up to, and including, 2.5.2 due to insufficient input s… | |
| CVE-2026-96281 | MEDIUM | 6.2 | 2026-09-27 | On a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing the app's remote ref via the unp… | |
| CVE-2026-96279 | MEDIUM | 6.5 | 2026-09-27 | A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing … | |
| CVE-2026-96276 | MEDIUM | 6.5 | 2026-09-23 | If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak build-init --writable-sdk --sdk-extension` with that… | |
| CVE-2026-96273 | MEDIUM | Patched | 5.5 | 2026-09-23 | Ghidra before 12.1.4 fails to validate the TYPE_COL byte in OptionsDB.createUnregisteredOption(), causing an ArrayIndexOutOfBoundsException that leaves domain objects perma… |
| CVE-2026-96268 | MEDIUM | 6.4 | 2026-10-01 | The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data' parameter in all versions up… | |
| CVE-2026-96260 | MEDIUM | Patched | 6.5 | 2026-09-22 | Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin req… |
| CVE-2026-9626 | MEDIUM | 6.4 | 2026-07-03 | The JSON API User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter of the post_comment API endpoint in versions up to, and incl… | |
| CVE-2026-96259 | MEDIUM | Patched | 5.5 | 2026-09-22 | Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to apply the internal-connection filter to OAuth endpoint requests, which… |
| CVE-2026-96258 | MEDIUM | 4.3 | 2026-09-23 | A vulnerability has been found in onSite internet GmbH Auktion NG Auktionssoftware up to 20260722. This affects an unknown part of the file /forgotpasswd.html of the compon… | |
| CVE-2026-96256 | MEDIUM | 6.4 | 2026-10-01 | The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Map block's '… | |
| CVE-2026-96247 | MEDIUM | Patched | 5.5 | 2026-10-13 | Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally. |
| CVE-2026-96238 | MEDIUM | 6.5 | 2026-10-13 | Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network. | |
| CVE-2026-96234 | MEDIUM | 5.3 | 2026-10-13 | Origin validation error in .NET allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-96229 | MEDIUM | 6.5 | 2026-10-13 | Permissive list of allowed inputs in .NET allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-96218 | MEDIUM | Patched | 5.5 | 2026-10-13 | Improper access control in Windows Update Stack allows an authorized attacker to perform tampering locally. |
| CVE-2026-96206 | MEDIUM | 6.5 | 2026-10-13 | Use of uninitialized resource in Windows Subsystem for Linux allows an authorized attacker to disclose information locally. | |
| CVE-2026-96204 | MEDIUM | 6.5 | 2026-10-13 | Server-side request forgery (ssrf) in Azure Arc allows an authorized attacker to elevate privileges over a network. | |
| CVE-2026-96200 | MEDIUM | Patched | 5.3 | 2026-10-01 | The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider, allowing u… |
| CVE-2026-9620 | MEDIUM | 6.4 | 2026-06-24 | The WP Latest Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted image src attributes in post content in versions up to, and including, 5.0… | |
| CVE-2026-9619 | MEDIUM | 4.3 | 2026-06-24 | The Reviews and Rating – Docplanner plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not pr… | |
| CVE-2026-96183 | MEDIUM | Patched | 5.5 | 2026-10-13 | Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to disclose information locally. |
| CVE-2026-9618 | MEDIUM | 4.3 | 2026-05-28 | The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) plugin for WordPress is vulnerable to Cross-Site Request Fo… | |
| CVE-2026-96173 | MEDIUM | Patched | 5.3 | 2026-10-01 | The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request… |
| CVE-2026-9617 | MEDIUM | Patched | 6.8 | 2026-05-27 | PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a table and placing malicious code inside a column identifier. If… |