MEDIUM Severity CVEs

The Schedule Post Changes With PublishPress Future plugin for WordPress is vulnerable to Stored Cross-Site Scripting via

The Charts Ninja: Create Beautiful Graphs & Charts and Easily Add Them to Your Website plugin for WordPress is vulnerabl

The Subscribe To Comments Reloaded plugin for WordPress is vulnerable to unauthorized modification of data due to a leak

The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Sit

The Loco Translate plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.8.2 via

An issue was discovered in Nix before 2.34.7. Writing to arbitrary files can occur via "nix-prefetch-url --unpack" or "n

A flaw has been found in CodeCanyon Perfex CRM up to 3.4.1. This vulnerability affects the function AbstractKanban::appl

A vulnerability was detected in CodeCanyon Perfex CRM up to 3.4.1. This affects the function Clients::project of the fil

A security vulnerability has been detected in Open5GS up to 2.7.7. Affected by this issue is the function udm_nudm_uecm_

A weakness has been identified in Open5GS up to 2.7.7. Affected by this vulnerability is the function udm_state_operatio

A security flaw has been discovered in Open5GS up to 2.7.7. Affected is the function udm_nudr_dr_handle_subscription_aut

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, the GetSettings API handler (api/sett

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, an authenticated user can call GET /a

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, the /mcp-oauth/regis

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, the /chat WebSocket

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated use

Claude SDK for TypeScript provides access to the Claude API from server-side TypeScript or JavaScript applications. From

CImg Library is a C++ library for image processing. Prior to commit c3aacf5, the nb_colors field read from the BMP file

CImg Library is a C++ library for image processing. Prior to commit 4ca26bc, there is an integer overflow vulnerability

PlantUML Macro is a macro for rendering UML diagrams from simple textual schemes. Prior to version 2.4.1, the PlantUML M

Dify is an open-source LLM app development platform. Prior to version 1.13.1, using the method POST /api/files/upload, a

titra is an open source time tracking project. In version 0.99.52, the globalsettings Meteor publication returns all glo

goshs is a SimpleHTTPServer written in Go. Prior to version 2.0.2, the PUT upload handler (httpserver/updown.go) lacks t

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.

Note Mark is an open-source note-taking application. Prior to version 0.19.3, after a note-mark owner soft-deletes a pub

PPTAgent is an agentic framework for reflective PowerPoint generation. Prior to commit 418491a, there is an arbitrary fi

PPTAgent is an agentic framework for reflective PowerPoint generation. Prior to commit 418491a, PPTAgent is vulnerable t

Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a prototype pollution vulnerabilit

wCMS v.1.4 is vulnerable to Cross Site Scripting (XSS) when creating a new blog.

Memory corruption while processing IOCTL command when device is in power-save state.

Information Disclosure while processing IOCTL handler callbacks without verifying buffer size.

Memory corruption when dynamically changing the size of a previously allocated buffer while its contents are being modif

Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireles

Transient DOS when processing target power rate tables during channel configuration.

Missing input validation in the MP_REACH_NLRI component of FRRouting (FRR) stable/10.0 to stable/10.6 allows authenticat

An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXParser.cpp, ParseVectorDataA

HTTP response splitting vulnerability in multiple Apache HTTP Server modules with untrusted or compromised backend serve

A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated r

A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remot

An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp, FBXConverter:

An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXMeshGeometry.cpp, MeshGeomet

Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Serve

Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. This issue affects Apache HTTP Server: throu

Cross Site Scripting vulnerability in Pluck CMS before v.4.7.21dev allows a remote attacker to escalate privileges via t

A vulnerability was identified in SourceCodester Web-based Pharmacy Product Management System 1.0. Affected is an unknow

A vulnerability was determined in CodeAstro Online Classroom 1.0. This impacts an unknown function of the file /OnlineCl

A vulnerability was found in CodeAstro Online Classroom 1.0. This affects an unknown function of the file /OnlineClassro

A vulnerability has been found in CodeAstro Online Classroom 1.0. The impacted element is an unknown function of the fil

A flaw has been found in CodeAstro Online Classroom 1.0. The affected element is an unknown function of the file /Online