Search
14,262 CVEs · Medium severity
CVEs (14,262, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 14,262 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↑ | Description |
|---|---|---|---|---|---|
| CVE-2026-17432 | MEDIUM | 5.0 | 2026-07-26 | A vulnerability was detected in NousResearch hermes-agent 2026.6.5. Affected by this vulnerability is an unknown functionality of the file hermes-agent/plugins/platforms/si… | |
| CVE-2026-17433 | MEDIUM | 5.3 | 2026-07-26 | A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. This impacts the function createChatSdkBridge.setup of the file src/channels/chat-sdk-bridge.ts of the compo… | |
| CVE-2026-17434 | MEDIUM | 6.3 | 2026-07-26 | A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-mod/request.ts of the component add_mcp_se… | |
| CVE-2026-17457 | MEDIUM | 4.3 | 2026-07-26 | A vulnerability has been found in mf-yang openclaw-cn up to 0.2.1. Affected by this issue is the function assertBrowserNavigationAllowed of the file src/browser/navigation-… | |
| CVE-2026-17458 | MEDIUM | 6.3 | 2026-07-26 | A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file src/browser/routes/agent.act.ts of the component Brow… | |
| CVE-2026-17459 | MEDIUM | 4.3 | 2026-07-26 | A vulnerability was determined in perwendel spark up to 2.9.4. This vulnerability affects the function staticFiles.externalLocation of the file src/main/java/spark/resource… | |
| CVE-2026-57978 | MEDIUM | Patched | 5.4 | 2026-07-26 | Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2026-17500 | MEDIUM | 5.3 | 2026-07-27 | A vulnerability was detected in ggml-org llama.cpp d006858/e15efe0. This affects the function _visit_pattern of the file common/json-schema-to-grammar.cpp. The manipulation… | |
| CVE-2026-17501 | MEDIUM | 5.3 | 2026-07-27 | A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file common/json-schema-to-grammar.cpp of the component JSON-S… | |
| CVE-2026-10082 | MEDIUM | Patched | 6.1 | 2026-07-27 | The Advanced Ads WordPress plugin before 2.0.23 does not sanitize and escape a shortcode parameter before outputting it in the page, allowing users with the Contributor ro… |
| CVE-2026-12982 | MEDIUM | Patched | 6.1 | 2026-07-27 | The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX act… |
| CVE-2026-13390 | MEDIUM | Patched | 5.3 | 2026-07-27 | The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity ch… |
| CVE-2026-13400 | MEDIUM | Patched | 6.1 | 2026-07-27 | Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ord… |
| CVE-2026-14190 | MEDIUM | Patched | 6.1 | 2026-07-27 | The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before … |
| CVE-2026-14203 | MEDIUM | Patched | 4.8 | 2026-07-27 | The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users wi… |
| CVE-2026-14236 | MEDIUM | Patched | 4.7 | 2026-07-27 | The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it as the success and cancel redirect targets of a Str… |
| CVE-2026-14568 | MEDIUM | Patched | 6.5 | 2026-07-27 | The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8 does not correctly verify… |
| CVE-2026-14820 | MEDIUM | Patched | 5.3 | 2026-07-27 | The Quiz and Survey Master (QSM) WordPress plugin before 11.1.3 does not implement rate limiting or standard failed-login auditing on its front-end credential-check functi… |
| CVE-2026-14827 | MEDIUM | Patched | 6.8 | 2026-07-27 | The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing page, allo… |
| CVE-2026-66412 | MEDIUM | 6.5 | 2026-07-27 | Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by sup… | |
| CVE-2026-17534 | MEDIUM | Patched | 5.5 | 2026-07-27 | Kimi Code (@moonshot-ai/kimi-code) before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, without resolving… |
| CVE-2026-55970 | MEDIUM | Patched | 6.5 | 2026-07-27 | Buffer Over-read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which f… |
| CVE-2026-66053 | MEDIUM | Patched | 5.9 | 2026-07-27 | Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommend… |
| CVE-2026-15003 | MEDIUM | 5.6 | 2026-07-27 | A flaw was found in the GNU Binutils (Binary Utilities) linker. This vulnerability, a heap-buffer-overflow read (CWE-125), occurs when the linker processes a specially craf… | |
| CVE-2026-17514 | MEDIUM | 5.3 | 2026-07-27 | A vulnerability was determined in ZJONSSON node-unzipper up to 0.12.3. Affected by this vulnerability is the function Extract of the file lib/extract.js. This manipulation … |