Search
1,599 CVEs · Medium severity
CVEs (1,599, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 1,599 (capped at 500)
| CVE ID ↑ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2012-20003 | MEDIUM | Patched | 6.1 | 2026-10-20 | Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the … |
| CVE-2012-20004 | MEDIUM | Patched | 6.1 | 2026-10-20 | K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanit… |
| CVE-2012-20005 | MEDIUM | 6.1 | 2026-10-20 | SocialFit plugin for WordPress through 1.2.2 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the unsanit… | |
| CVE-2014-125131 | MEDIUM | 6.1 | 2026-10-20 | DedeCMS 5.6 and 5.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input to the adm… | |
| CVE-2014-125132 | MEDIUM | Patched | 6.1 | 2026-10-20 | Blogroll Fun plugin for WordPress before 0.8.5 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the '… |
| CVE-2016-20102 | MEDIUM | Patched | 6.1 | 2026-10-20 | JavaMelody before 1.60.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted values in the g… |
| CVE-2017-20288 | MEDIUM | 6.1 | 2026-10-22 | QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the installation_path par… | |
| CVE-2017-20290 | MEDIUM | Patched | 6.1 | 2026-10-22 | Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the email … |
| CVE-2020-37284 | MEDIUM | 6.1 | 2026-10-22 | Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the pattern parameter of… | |
| CVE-2020-37288 | MEDIUM | Patched | 3.7 | 2026-10-21 | Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing… |
| CVE-2020-37289 | MEDIUM | Patched | 3.7 | 2026-10-21 | Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals(), to be stored in uint256 variables without bounds checki… |
| CVE-2021-48019 | MEDIUM | Patched | 4.8 | 2026-10-21 | Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return da… |
| CVE-2023-38375 | MEDIUM | 6.1 | 2026-10-19 | IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alter… | |
| CVE-2023-54413 | MEDIUM | Patched | 6.1 | 2026-10-22 | WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by su… |
| CVE-2024-2323 | MEDIUM | 4.8 | 2026-10-20 | The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an … | |
| CVE-2024-4989 | MEDIUM | 5.4 | 2026-10-21 | The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability … | |
| CVE-2024-5139 | MEDIUM | 6.1 | 2026-10-21 | The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be … | |
| CVE-2024-58394 | MEDIUM | Patched | 6.1 | 2026-10-22 | Retool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to execute scripts by proxying malicious SVG files through /api/ima… |
| CVE-2024-58398 | MEDIUM | Patched | 4.3 | 2026-10-17 | Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is … |
| CVE-2024-6423 | MEDIUM | 4.0 | 2026-10-21 | The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be… | |
| CVE-2024-7478 | MEDIUM | 5.8 | 2026-10-21 | When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempt… | |
| CVE-2025-13173 | MEDIUM | 6.5 | 2026-10-19 | Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs when the sessio… | |
| CVE-2025-13591 | MEDIUM | 5.3 | 2026-10-19 | The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does not exist in the system, allowing attackers to differ… | |
| CVE-2025-30051 | MEDIUM | Patched | — | 2026-10-23 | The CGM CLININET application stores the production database login and password, as well as RabbitMQ broker credentials, in the SysIO.pl configuration file. Insecure file pe… |
| CVE-2025-30053 | MEDIUM | — | 2026-10-23 | The CGM CLININET application runs the cgm-updater process listening on an open network port without any authentication. The vulnerability was confirmed to affect versio… |