Search
6,058 CVEs · Medium severity
CVEs (6,058, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 6,058 (capped at 500)
| CVE ID | Severity | Patch | CVSS ↓ | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-82041 | MEDIUM | Patched | 9.9 | 2026-10-02 | UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(), the handler mapped to the /command/{hostname} STOMP … |
| CVE-2026-102780 | MEDIUM | Patched | 9.8 | 2026-10-05 | Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both … |
| CVE-2026-111809 | MEDIUM | Patched | 9.3 | 2026-10-21 | Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects Apache Traffic Server: from 8.0.0 thr… |
| CVE-2026-81535 | MEDIUM | Patched | 9.1 | 2026-10-07 | In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcp… |
| CVE-2026-89134 | MEDIUM | 9.1 | 2026-09-27 | A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint check. The CN-as-DNS fallbac… | |
| CVE-2026-112778 | MEDIUM | Patched | 8.8 | 2026-10-19 | Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references t… |
| CVE-2026-11731 | MEDIUM | 8.8 | 2026-10-13 | An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device’s management s… | |
| CVE-2026-11732 | MEDIUM | 8.8 | 2026-10-13 | An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker having n… | |
| CVE-2026-83742 | MEDIUM | Patched | 8.8 | 2026-10-07 | Unsigned integer underflow in wstrncat() in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows platforms allows an authenticated remote attacker to wr… |
| CVE-2026-100748 | MEDIUM | Patched | 8.8 | 2026-09-27 | Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0 |
| CVE-2026-115513 | MEDIUM | Patched | 8.7 | 2026-10-22 | OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a … |
| CVE-2026-103247 | MEDIUM | Patched | 8.5 | 2026-10-01 | n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow credential tamper guard. Attackers with editor access… |
| CVE-2026-101156 | MEDIUM | 8.4 | 2026-10-06 | A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The content may ex… | |
| CVE-2016-15060 | MEDIUM | 8.3 | 2026-10-14 | A vulnerability was found in PCMan FTP Server up to 2.0.7. This affects an unknown function of the component PORT Command Handler. The manipulation results in buffer overfl… | |
| CVE-2026-109519 | MEDIUM | 8.3 | 2026-10-13 | A vulnerability was detected in YouTransfer up to 0.0.7/1.0.6/1.1.0. Affected is an unknown function of the file /settings/template of the component Template Rendering. The… | |
| CVE-2026-108916 | MEDIUM | 8.3 | 2026-10-12 | A vulnerability was found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the file /goform/formAccept. Performing a manipulation of the argument submit… | |
| CVE-2026-108522 | MEDIUM | 8.3 | 2026-10-11 | A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file /api/auth/login of the component Login Endpoint. Performing a manip… | |
| CVE-2026-90906 | MEDIUM | Patched | 8.3 | 2026-09-29 | Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to XSS vulnerabilities in the link method of the HTML Helper. |
| CVE-2026-101188 | MEDIUM | 8.3 | 2026-09-28 | A security vulnerability has been detected in Netcore POWER13 2.0.240730.162638. This issue affects the function routerd.passwd_set of the file /ubus. Such manipulation lea… | |
| CVE-2026-97662 | MEDIUM | Patched | 8.2 | 2026-10-01 | An argument injection issue in the diff scan operation in AWS security-agent-mcp-server before version 0.2.0 might allow context-dependent threat actors to create, overwrit… |
| CVE-2026-104905 | MEDIUM | 8.1 | 2026-10-05 | FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to trigger unseria… | |
| CVE-2026-5048 | MEDIUM | Patched | 8.0 | 2026-10-08 | In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API inventories have a vulnerability that allows an authenticated attacker to inject mal… |
| CVE-2026-94579 | MEDIUM | Patched | 8.0 | 2026-10-08 | An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines during SSH session termination on Brocade Fabric OS versi… |
| CVE-2026-94576 | MEDIUM | Patched | 8.0 | 2026-10-08 | An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.… |
| CVE-2026-13599 | MEDIUM | 7.8 | 2026-10-22 | Missing authentication for critical function vulnerability in ABB Ability Edgenius. This issue affects Ability Edgenius: through 3.2.3.0. |