MEDIUM Severity CVEs

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachmen

Shynet before 0.14.0 allows XSS in urldisplay and iconify template filters,

Shynet before 0.14.0 allows Host header injection in the password reset flow.

XSS vulnerability in cveInterface.js allows for inject HTML to be passed to display, as cveInterface trusts input from C

Multiple reflected cross-site scripting (XSS) vulnerabilities in the login.php endpoint of Interzen Consulting S.r.l Zen

A reflected cross-site scripting (XSS) vulnerability in the login_newpwd.php endpoint of Interzen Consulting S.r.l ZenSh

Bentley Systems iTwin Platform exposed a Cesium ion access token in the source of some web pages. An unauthenticated att

hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is a stored XSS vulnerability i

hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, the /enter page contains a DOM-based

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to version 1.66.1, Scoold contains an authenticated au

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior t

Ella Core is a 5G core designed for private networks. Prior to version 1.8.0, Ella Core panics when processing a NGAP ha

vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before version 0.18.0, L

A vulnerability was determined in Dataease SQLbot up to 1.6.0. This issue affects the function get_es_data_by_http of th

XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_ind

Open edX Platform enables the authoring and delivery of online learning at any scale. From the maple release to before t

Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's _external_data featur

Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's _subdirectory setting

OpenClaw versions prior to commit 8aceaf5 contain a preflight validation bypass vulnerability in shell-bleed protection

An integer overflow was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonom

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.6 and iPadOS 18

A security flaw has been discovered in Newgen OmniDocs up to 12.0.00. Affected by this issue is some unknown functionali

OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list i

Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack

ewe is a Gleam web server. Prior to version 3.0.6, the encode_headers function in src/ewe/internal/encoder.gleam directl

The leancrypto library is a cryptographic library that exclusively contains only PQC-resistant cryptographic algorithms.

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.24.10, in NanoMQ's webhook_inpr

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. From version 2.27

YesWiki is a wiki system written in PHP. Prior to version 4.6.0, a stored and blind XSS vulnerability exists in the form

Poetry is a dependency manager for Python. From version 1.4.0 to before version 2.3.3, a crafted wheel can contain ../ p

Postiz is an AI social media scheduling tool. Prior to version 2.21.4, the POST /webhooks/ endpoint for creating webhook

listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0,

SillyTavern is a locally installed user interface that allows users to interact with text generation large language mode

SillyTavern is a locally installed user interface that allows users to interact with text generation large language mode

A denial-of-service vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP request path parsing logic.

A stack-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within a configuration handling c

A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the asynchronous parsing of

A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP parsing loop when

A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C100/C101 v5, C520WS v2.6 in the HTTP POST bod

Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis True Image (

Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21 and 3.2.0 to before 3.2.6, Rack:

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis True Image (

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis True Image (

Rack is a modular Ruby web server interface. From version 3.2.0 to before version 3.2.6, Rack::Multipart::Parser unfolds

A vulnerability has been found in Trendnet TEW-657BRM 1.00.1. Affected by this issue is the function vpn_drop of the fil

A flaw has been found in Trendnet TEW-657BRM 1.00.1. Affected by this vulnerability is the function vpn_connect of the f

A vulnerability was detected in Trendnet TEW-657BRM 1.00.1. Affected is the function ping_test of the file /setup.cgi. P

A security vulnerability has been detected in Trendnet TEW-657BRM 1.00.1. This impacts the function Edit of the file /se

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0, there is an arbit

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Files#fail sets the Cont