MEDIUM Severity CVEs

A weakness has been identified in OpenAkita up to 1.24.3. This impacts the function run of the file src/openakita/tools/

A vulnerability was identified in Jcharis Machine-Learning-Web-Apps up to a6996b634d98ccec4701ac8934016e8175b60eb5. The

yauzl (aka Yet Another Unzip Library) version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timest

A vulnerability was determined in zyddnys manga-image-translator up to beta-0.3. The affected element is the function to

A vulnerability was found in 0xKoda WireMCP up to 7f45f8b2b4adeb76be8c6227eefb38533fdd6b1e. Impacted is the function ser

A vulnerability has been found in Woahai321 ListSync up to 0.6.6. This issue affects the function requests.post of the f

Incorrect security UI in PictureInPicture in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform U

Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass

Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass

Insufficient policy enforcement in PDF in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navig

Insufficient policy enforcement in Clipboard in Google Chrome prior to 146.0.7680.71 allowed a remote attacker who had c

Incorrect security UI in Downloads in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to perfo

Incorrect security UI in WebAppInstalls in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI

Insufficient policy enforcement in ChromeDriver in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to byp

Unsafe navigation in Navigation in Google Chrome on iOS prior to 146.0.7680.71 allowed a remote attacker to bypass navig

Insufficient policy enforcement in Extensions in Google Chrome prior to 146.0.7680.71 allowed an attacker who convinced

Incorrect security UI in PictureInPicture in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform U

Incorrect security UI in LookalikeChecks in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to

FastGPT is an AI Agent building platform. In 4.14.7 and earlier, FastGPT's Python Sandbox (fastgpt-sandbox) includes gua

A flaw has been found in xierongwkhd weimai-wetapp up to 5fe9e8225be4f73f2c5087f134aff657bdf1c6f2. This vulnerability af

A vulnerability was detected in xierongwkhd weimai-wetapp up to 5fe9e8225be4f73f2c5087f134aff657bdf1c6f2. This affects t

A security vulnerability has been detected in elecV2P up to 3.8.3. Affected by this issue is the function runJSFile of t

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.

ha-mcp is a Home Assistant MCP Server. Prior to 7.0.0, the ha-mcp OAuth consent form renders user-controlled parameters

ha-mcp is a Home Assistant MCP Server. Prior to 7.0.0, the ha-mcp OAuth consent form (beta feature) accepts a user-suppl

Copyparty is a portable file server. Prior to 1.20.12, there was a missing permission-check in the shares feature (the s

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the REST API crea

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the updateUserNot

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the POST /studioc

OliveTin gives access to predefined shell commands from a web interface. In 3000.10.2 and earlier, OliveTin’s live Event

During an internal security assessment, a potential vulnerability was discovered in Lenovo PC Manager that could allow a

An input validation vulnerability was reported in the LenovoProductivitySystemAddin used in Lenovo Vantage and Lenovo Ba

A potential divide by zero vulnerability was reported in the Lenovo Virtual Bus driver used in Smart Connect that could

A potential buffer overflow vulnerability was reported in the Lenovo Virtual Bus driver used in Smart Connect that could

An improper certificate validation vulnerability was reported in the Lenovo Filez application that could allow a user ca

A potential improper initialization vulnerability was reported in the BIOS of some ThinkPads that could allow a local pr

A weakness has been identified in OpenBMB XAgent 1.0.0. Affected by this vulnerability is the function workspace of the

A security flaw has been discovered in LockerProject Locker 0.0.0/0.0.1/0.1.0. Affected is the function authIsAwesome of

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-a

Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.1, Plunk's image upload endpoint accepted S

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.10, Shescape#escape() does not escape square-brac

Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 contains an unb

Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 has unbounded r

Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 contains a Serv

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.34

Dell Alienware Command Center (AWCC), versions prior to 6.12.24.0, contain an Improper Privilege Management vulnerabilit

Shopware is an open commerce platform. Prior to 6.7.8.1 and 6.6.10.15, the Store API login endpoint (POST /store-api/acc