Search
6,058 CVEs · Medium severity
CVEs (6,058, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 76–100 of 6,058 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-109934 | MEDIUM | Patched | 5.3 | 2026-10-23 | The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, trea… |
| CVE-2026-109933 | MEDIUM | Patched | 6.8 | 2026-10-23 | The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allo… |
| CVE-2026-86020 | MEDIUM | Patched | 4.6 | 2026-10-23 | Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in … |
| CVE-2026-86019 | MEDIUM | Patched | — | 2026-10-23 | Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated API users to bypass the configured ma… |
| CVE-2026-86018 | MEDIUM | Patched | — | 2026-10-23 | Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated users to bypass the configured maximu… |
| CVE-2026-59188 | MEDIUM | Patched | 5.4 | 2026-10-23 | Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.3, Part-DB-server sanitizes SVG files based solely on the user-contro… |
| CVE-2026-55835 | MEDIUM | Patched | — | 2026-10-23 | Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to version 1.39.4, an unauthenticated… |
| CVE-2026-90458 | MEDIUM | Patched | 5.4 | 2026-10-23 | OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service. |
| CVE-2026-89419 | MEDIUM | Patched | 5.0 | 2026-10-23 | OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific m… |
| CVE-2026-55600 | MEDIUM | Patched | — | 2026-10-23 | Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB renders BOM validation information messages using Twig's |… |
| CVE-2026-54631 | MEDIUM | Patched | 6.3 | 2026-10-23 | Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed… |
| CVE-2026-54615 | MEDIUM | Patched | — | 2026-10-23 | Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the "Extra" column… |
| CVE-2026-115638 | MEDIUM | 4.3 | 2026-10-23 | OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb. | |
| CVE-2026-115485 | MEDIUM | 6.3 | 2026-10-23 | A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing … | |
| CVE-2026-110491 | MEDIUM | 7.5 | 2026-10-22 | The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations. The affected service stops accepting new connect… | |
| CVE-2026-115424 | MEDIUM | 5.5 | 2026-10-22 | A flaw was found in the OpenShift client oc. When extracting container image layers with oc image extract, the application fails to properly sanitize symbolic and hard link… | |
| CVE-2026-115221 | MEDIUM | 5.4 | 2026-10-22 | A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to retrieve and revoke digital certificates assigned to other users or services. T… | |
| CVE-2026-114620 | MEDIUM | Patched | 5.4 | 2026-10-22 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticated, client-co… |
| CVE-2026-114619 | MEDIUM | Patched | 4.6 | 2026-10-22 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validate_authorization_request() checks the client-controlled… |
| CVE-2026-114618 | MEDIUM | Patched | 6.8 | 2026-10-22 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBearerGrant.get_audiences() returns an empty list, causin… |
| CVE-2026-114617 | MEDIUM | Patched | 4.2 | 2026-10-22 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDMixin.parse_id_token() reads the nonce_supported decision from the untruste… |
| CVE-2026-111100 | MEDIUM | 5.3 | 2026-10-22 | The ONVIF device service on the E3 responds to certain informational requests without requiring authentication. A remote, unauthenticated party can retrieve detailed device… | |
| CVE-2026-105265 | MEDIUM | 5.3 | 2026-10-22 | A vulnerability exists in the the time zone parameter and does not properly validate user input, which may allow an authenticated user to cause /etc/localtime to point to a… | |
| CVE-2026-114583 | MEDIUM | — | 2026-10-22 | tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intend… | |
| CVE-2026-115507 | MEDIUM | Patched | 3.5 | 2026-10-22 | Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and … |