Search
1,599 CVEs · Medium severity
CVEs (1,599, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 1,599 (capped at 500)
| CVE ID ↓ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-97859 | MEDIUM | Patched | 6.5 | 2026-10-18 | Seven Gitea API routes under `/api/v1/users/{username}` (followers, following, following/{target}, starred, subscriptions, keys and gpg_keys) were registered without the `i… |
| CVE-2026-97400 | MEDIUM | — | 2026-10-20 | In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an… | |
| CVE-2026-97314 | MEDIUM | Patched | 6.5 | 2026-10-17 | The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthentica… |
| CVE-2026-96903 | MEDIUM | Patched | 4.3 | 2026-10-20 | The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authent… |
| CVE-2026-96902 | MEDIUM | Patched | 5.3 | 2026-10-20 | The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to re… |
| CVE-2026-96641 | MEDIUM | Patched | 6.5 | 2026-10-21 | Pillow is a Python imaging library. Prior to 13.0.0, PILfont text-width accumulation in src/_imaging.c checks positive glyph advances against INT_MAX but does not check neg… |
| CVE-2026-96638 | MEDIUM | Patched | 6.5 | 2026-10-21 | Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode() in src/PIL/BmpImagePlugin.py permits crafted RLE BMP delta escapes and absolute-mode run… |
| CVE-2026-96636 | MEDIUM | Patched | 6.5 | 2026-10-21 | Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek() and DcxImageFile.seek() reparse later MPO or DCX frames and replace self._size without rerunning Im… |
| CVE-2026-96582 | MEDIUM | 4.9 | 2026-10-20 | A HID report descriptor is a sequence of items, each declaring in its header how many data bytes follow. The USBX host walks that sequence by advancing over each header and… | |
| CVE-2026-96406 | MEDIUM | 4.9 | 2026-10-20 | A VideoStreaming interface reports the size of its whole class-specific descriptor block in the `wTotalLength` field of its input header. The USBX host recorded that figure… | |
| CVE-2026-96405 | MEDIUM | 5.3 | 2026-10-21 | NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompress… | |
| CVE-2026-96402 | MEDIUM | — | 2026-10-20 | A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, leaking adjacent heap contents to the application or f… | |
| CVE-2026-96398 | MEDIUM | 4.3 | 2026-10-22 | Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. | |
| CVE-2026-96390 | MEDIUM | 4.3 | 2026-10-22 | Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects Editoria11y Accessibility Ch… | |
| CVE-2026-96388 | MEDIUM | 5.4 | 2026-10-22 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affects Tawk.to - Live chat applicat… | |
| CVE-2026-96386 | MEDIUM | 6.5 | 2026-10-22 | Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1. | |
| CVE-2026-96385 | MEDIUM | 6.5 | 2026-10-22 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication Bypass. This issue affects … | |
| CVE-2026-96382 | MEDIUM | 4.6 | 2026-10-22 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Diba carousel slider allows Stored XSS. This issue affects Diba… | |
| CVE-2026-96380 | MEDIUM | 6.5 | 2026-10-22 | Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage Analyzer versions: from 1.0.0 to 1.0.2. | |
| CVE-2026-96378 | MEDIUM | 4.3 | 2026-10-22 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Commerce Decoupled Checkout allows Object Injection. This issue affec… | |
| CVE-2026-96377 | MEDIUM | 5.3 | 2026-10-22 | Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Allocation. This issue affects Combined image style versi… | |
| CVE-2026-96376 | MEDIUM | 6.4 | 2026-10-22 | Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Cloud allows OS Command Injection. This issue affects Clo… | |
| CVE-2026-96375 | MEDIUM | 4.8 | 2026-10-22 | Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1. | |
| CVE-2026-96374 | MEDIUM | 4.2 | 2026-10-22 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross Site Request Forgery. This issue affects Project Browser versions: from 0.0.0 to 2.0.… | |
| CVE-2026-96372 | MEDIUM | 5.4 | 2026-10-22 | Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. |