MEDIUM Severity CVEs

The Website LLMs.txt plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all version

The Website LLMs.txt plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all

The Responsive Blocks – Page Builder for Blocks & Patterns plugin for WordPress is vulnerable to unauthorized access in

Honor E APP is affected by information leak vulnerability, successful exploitation of this vulnerability may affect serv

The Responsive Blocks – Page Builder for Blocks & Patterns plugin for WordPress is vulnerable to Unauthenticated Open Em

The Plugin: CMS für Motorrad Werkstätten plugin for WordPress is vulnerable to SQL Injection via the 'arttype' parameter

** UNSUPPORTED WHEN ASSIGNED ** An improper encoding or escaping vulnerability in the CGI program of Zyxel WRE6505 v2 fi

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privile

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. In versi

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions

OpenClaw before 2026.3.31 contains a resource consumption vulnerability in Telegram audio preflight transcription that a

OpenClaw before 2026.3.31 contains an environment variable override vulnerability in host exec policy that fails to prop

OpenClaw versions 2026.3.22 before 2026.3.31 contain a signature verification bypass vulnerability in the Nostr DM ingre

OpenClaw before 2026.3.31 contains a trust-decline vulnerability that preserves attacker-discovered endpoints in remote

OpenClaw before 2026.4.2 fails to enforce write scopes on the POST /sessions/:sessionKey/kill endpoint in identity-beari

In OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they receive a crafted ICMPv6 Neighbor Dis

OpenClaw before 2026.4.2 accepts non-loopback cleartext ws:// gateway endpoints and transmits stored gateway credentials

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Cassandra export module (`g

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Glances web server exposes

The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to Stor

Dify is an open-source LLM app development platform. Prior to 1.13.1, the method `DELETE /console/api/installed-apps/<ap

HKUDS OpenHarness prior to PR #159 remediation contains a session key derivation vulnerability that allows authenticated

StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.13 and 12.0.0.6 are susceptible to a Information Di

Potential read out of bounds case with wolfSSHd on Windows while handling a terminal resize request. An authenticated us

The Image Source Control Lite – Show Image Credits and Captions plugin for WordPress is vulnerable to Stored Cross-Site

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the POS

In OpenXiangShan NEMU, insufficient Smstateen permission enforcement allows lower-privileged code to access IMSIC state

Cryptographic algorithm downgrade in the caching layer of Amazon AWS Encryption SDK for Python before version 3.3.1 and

A vulnerability in the SQL Box in the admin interface of OTRS leads to an uncontrolled resource consumption leading to a

OpenClaw versions 2026.4.7 before 2026.4.15 fail to enforce local-root containment on tool-result media paths, allowing

Cross Site Scripting vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in

A stack-use-after-return issue exists in the Arduino_Core_STM32 library prior to version 1.7.0. The pwm_start() function

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the ticket subject field that allows

GFI HelpDesk before 4.99.10 contains a stored cross-site scripting vulnerability in the Reports module where the title p

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the Troubleshooter module where the s

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the language management functionality

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the template group creation and editi

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Commun

Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release vers

python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2,

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 r

Dell PowerProtect Data Domain, versions 8.5 through 8.6 contain(s) an Improper Neutralization of Special Elements used i

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Commun

Dell PowerProtect Data Domain, versions 8.5 through 8.6 contain a command injection vulnerability. A high privileged att

A vulnerability exists in the Buffalo Link Station version 1.85-0.01 that allows unauthenticated or guest-level users to

A weakness has been identified in Pagekit CMS up to 1.0.18. This issue affects the function evaluate of the file app/mod

A vulnerability was identified in Z-BlogPHP 1.7.5. This affects the function App::UnPack of the file /zb_users/plugin/Ap

Junrar is an open source java RAR archive library. Prior to version 7.5.10, a path traversal vulnerability in `LocalFold

OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user with `manage_agendas`