MEDIUM Severity CVEs

Subscriber Cross Site Scripting (XSS) in ListingPro <= 2.9.11 versions.

Subscriber Server Side Request Forgery (SSRF) in utm.codes <= 1.9.0 versions.

Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions.

Mattermost versions 10.11.x <= 10.11.18, 11.6.x <= 11.6.3, 11.5.x <= 11.5.6 fail to validate attachment URLs against int

When used to deliver a signal to a specific thread, thr_kill2(2) called p_cansignal() to determine whether the operation

A heap overflow in the FSViewer.exe process of FastStone Image Viewer v8.3 allows attackers to cause a execute arbitrary

Unauthenticated Broken Access Control in SiteGround Email Marketing <= 1.7.5 versions.

Contributor Cross Site Scripting (XSS) in BNE Testimonials <= 2.0.8 versions.

Contributor Cross Site Scripting (XSS) in Image Carousel <= 1.0.0.41 versions.

Unauthenticated Insecure Direct Object References (IDOR) in BookPro <= 1.1.0 versions.

Unauthenticated Content Injection in Auros Core <= 5.3.1 versions.

Unauthenticated Broken Access Control in Donation Thermometer <= 2.2.7 versions.

Contributor Broken Access Control in Live Copy Paste for Elementor <= 1.5.3 versions.

Subscriber Broken Access Control in Restaurant Menu by MotoPress <= 2.4.11 versions.

Contributor Broken Access Control in Forget About Shortcode Buttons <= 2.1.3 versions.

In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags

In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details

In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying pr

In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment te

In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata

The Mattermost Go module github.com/mattermost/mattermost/server/public versions < v0.1.22 fail to validate path paramet

By sending a deeply nested ASN1 structure to a Apache Kerby client or service, it's possible to trigger a StackOverFlow

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim Strifler Exclu

A vulnerability in jupyter/nbconvert versions <= 7.17.0 allows for Cross-site Scripting (XSS) via unsanitized `text/vnd.

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom U

The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly verify ownership of every targeted post

The Printcart Web to Print Product Designer for WooCommerce WordPress plugin through 2.4.8 is vulnerable to path travers

Server-Side Request Forgery in the markdown_to_pdf action of Rapid7 InsightConnect Markdown Plugin on Linux in versions

A missing sanitisation vulnerability exists with user input in the stats-video.php script. The way URLs to this script w

A bypass to the admin‑only restriction of the XML‑RPC API in Revive Adserver 6.0.7. The API response for the ox.login me

A stored XSS vulnerabilities exists in the `maintenance-acl-check.php` and `maintenance-banners-check.php` tools of Revi

A missing sanitisation vulnerability of user input in the zone-include.php script exists in Revive Adserver 6.0.7 and ea

A bypass for CVE‑2026‑34913 exists with proper ownership validation that had not been applied to the reverse operation o

A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability

A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulne

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection

Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior have a predictable registration ID derive

A server-side request forgery (SSRF) flaw was found in KubeVirt's virt-api port-forward handler. When processing a port-

A flaw was found in KubeVirt's virt-handler network cache handling. The WriteToCachedFile function writes data to a laun

A flaw was found in the Pen Drive report generator. Cluster-sourced data is rendered into HTML reports without proper es

A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD and schema access but d

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a package import sign

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Tra

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have missing session_regen

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Open Red

The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's i

PKCS#12 MAC verification uses an attacker-controlled comparison length, weakening the integrity check on the MAC and all

When HAVE_ENCRYPT_THEN_MAC is configured, the implementation could fall back to MAC-then-Encrypt rather than enforcing E

TLS 1.3 post-handshake authentication (PHA) issue where a server could accept a client's Finished message without the cl