Vvveb prior to 1.0.8.1 contains a stored cross-site scripting vulnerability that allows authenticated users with media u
Vexa is an open-source, self-hostable meeting bot API and meeting transcription API. Prior to 0.10.0-260419-1910, the Ve
OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campa
A vulnerability was determined in Qibo CMS 1.0. Affected by this issue is some unknown functionality of the file /index/
An improper access control vulnerability in the canonical-livepatch snap client prior to version 10.15.0 allows a local
Information exposure vulnerability has been identified in Apache Kafka. The NetworkClient component will output entire
Apache Doris MCP Server versions earlier than 0.6.1 are affected by an improper neutralization flaw in query context han
A vulnerability was detected in p2r3 convert up to 6998584ace3e11db66dff0b423612a5cf91de75b. Affected is the function Bu
A weakness has been identified in usememos memos up to 0.22.1. This affects the function memos_access_token of the file
Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic
A flaw has been found in phili67 Ecclesia CRM up to 8.0.0. This affects the function ValidateInput of the file /v2/query
A vulnerability was detected in Cockpit-HQ Cockpit up to 2.13.5. Affected by this issue is some unknown functionality of
In the Linux kernel, the following vulnerability has been resolved: net: skb: fix cross-cache free of KFENCE-allocated
Fudo Enterprise in versions from 5.5.0 through 5.6.2 allows low privileged users to access certain administrator-only re
A vulnerability was found in SonicCloudOrg sonic-server up to 2.0.0. The affected element is the function Upload of the
A flaw has been found in langgenius dify up to 1.13.3. This issue affects the function parse_openai_plugin_json_to_tool_
A vulnerability was detected in langgenius dify up to 0.6.9. This vulnerability affects the function get_api_tool_provid
A security vulnerability has been detected in TransformerOptimus SuperAGI up to 0.0.14. This affects the function extrac
ProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection. This affects use of -env-vars for multi-step tem
A security flaw has been discovered in TransformerOptimus SuperAGI up to 0.0.14. Affected by this vulnerability is the f
A vulnerability was identified in TransformerOptimus SuperAGI up to 0.0.14. Affected is the function delete_agent/stop_s
A vulnerability was determined in TransformerOptimus SuperAGI up to 0.0.14. This impacts the function get_agent_executio
A flaw has been found in liangliangyy DjangoBlog up to 2.1.0.0. The affected element is the function form_valid of the f
A vulnerability was detected in lm-sys fastchat up to 0.2.36. Impacted is the function add_text of the component Arena S
A security vulnerability has been detected in lm-sys fastchat up to 0.2.36. This issue affects the function api_generate
A vulnerability has been found in Lagom WHMCS Template up to 2.4.2. This impacts an unknown function of the component Da
A vulnerability was detected in langflow-ai langflow up to 1.8.3. The impacted element is the function get_client_ip/ins
A security vulnerability has been detected in langflow-ai langflow up to 1.8.3. The affected element is the function cre
SD-330AC and AMC Manager provided by silex technology, Inc. contain an improper neutralization of CRLF sequences ('CRLF
SD-330AC and AMC Manager provided by silex technology, Inc. contain a reflected cross-site scripting vulnerability. When
SD-330AC and AMC Manager provided by silex technology, Inc. contain a missing authentication for critical function issue
SD-330AC and AMC Manager provided by silex technology, Inc. contain a heap-based buffer overflow vulnerability in packet
SD-330AC and AMC Manager provided by silex technology, Inc. contain an issue with a sensitive information in resource no
SD-330AC and AMC Manager provided by silex technology, Inc. contain an issue with a use of a broken or risky cryptograph
SD-330AC and AMC Manager provided by silex technology, Inc. use a hard-coded cryptographic key. An administrative user m
SD-330AC and AMC Manager provided by silex technology, Inc. contain a missing authentication for critical function issue
A flaw has been found in ComfyUI up to 0.13.0. Affected is the function folder_paths.get_annotated_filepath of the file
A vulnerability was detected in ComfyUI up to 0.13.0. This impacts the function get_model_preview of the file app/model_
A security vulnerability has been detected in ComfyUI up to 0.13.0. This affects the function create_origin_only_middlew
A weakness has been identified in serge-chat serge up to 1.4TB. The impacted element is the function download_model/dele
A security flaw has been discovered in vibrantlabsai RAGAS up to 0.4.3. The affected element is the function _try_proces
A vulnerability was identified in TransformerOptimus SuperAGI up to 0.0.14. Impacted is the function get_budget/update_b
A vulnerability was determined in TransformerOptimus SuperAGI up to 0.0.14. This issue affects the function update_organ
A vulnerability was found in TransformerOptimus SuperAGI up to 0.0.14. This vulnerability affects the function update_us
A vulnerability has been found in TransformerOptimus SuperAGI up to 0.0.14. This affects the function delete_api_key/edi
A weakness has been identified in liangliangyy DjangoBlog up to 2.1.0.0. This impacts an unknown function of the file bl
A security flaw has been discovered in liangliangyy DjangoBlog up to 2.1.0.0. This affects an unknown function of the fi
A vulnerability was determined in liangliangyy DjangoBlog up to 2.1.0.0. The affected element is the function CommandHan
A vulnerability was detected in PHPEMS 11.0. This affects the function temppage of the file /app/exam/controller/exams.m
A security vulnerability has been detected in Collabora KodExplorer up to 4.52. Affected by this issue is some unknown f
Frequently Asked Questions
What does MEDIUM severity mean for CVEs?
CVSS 4.0–6.9 — moderate vulnerabilities that may require specific conditions or user interaction to exploit
How many medium severity CVEs exist?
There are 164,190 CVE records rated MEDIUM in our database. Of these, 101 are listed in CISA's Known Exploited Vulnerabilities catalog.
How should I prioritize medium severity vulnerabilities?
MEDIUM severity vulnerabilities should be addressed as part of regular patching cycles. Prioritize those with high EPSS scores or that affect critical systems. CyberStrike helps you assess real-world exploitability beyond CVSS scores.
Detect MEDIUM Vulnerabilities
CyberStrike scans your infrastructure and detects medium severity vulnerabilities in real time.
Get Started