MEDIUM Severity CVEs

Fleet is open source device management software. In versions prior to 4.80.1, a vulnerability in Fleet’s Android MDM Pub

Fleet is open source device management software. In versions prior to 4.80.1, Fleet generated device lock and wipe PINs

The EM Cost Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and includin

The Custom Logo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up

The WP Social Meta plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions

The TP2WP Importer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Watched domains' textarea

The Livemesh Addons for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `[labb_

Audiobookshelf is a self-hosted audiobook and podcast server. A stored cross-site scripting (XSS) vulnerability exists i

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

Packistry is a self-hosted Composer repository designed to handle PHP package distribution. Prior to version 0.13.0, Rep

Live Helper Chat is an open-source application that enables live support websites. In versions up to and including 4.52,

Copyparty is a portable file server. In versions prior to 1.20.9, an XSS allows for reflected cross-site scripting via U

OpenEMR is a free and open source electronic health records and medical practice management application. In versions up

Svelte performance oriented web framework. Prior to version 5.53.5, errors from `transformError` were not correctly esca

Svelte performance oriented web framework. Prior to version 5.53.5, the contents of `bind:innerText` and `bind:textConte

The Terraform Provider for Linode versions prior to v3.9.0 logged sensitive information including some passwords, StackS

Bitnami Sealed Secrets is vulnerable to a scope-widening attack during the secret rotation (/v1/rotate) flow. The rotati

ZITADEL is an open source identity management platform. Prior to versions 4.11.1 and 3.4.7, a vulnerability in Zitadel's

ZITADEL is an open source identity management platform. Zitadel Action V2 (introduced as early preview in 2.59.0, beta i

NetExec is a network execution tool. Prior to version 1.5.1, the module spider_plus improperly creates the output file a

ZITADEL is an open source identity management platform. Starting in version 2.31.0 and prior to versions 3.4.7 and 4.11.

Dottie provides nested object access and manipulation in JavaScript. Versions 2.0.4 through 2.0.6 contain an incomplete

Astro is a web framework. In versions 9.0.0 through 9.5.3, a bug in Astro's image pipeline allows bypassing `image.domai

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on

Mailpit is an email testing tool and API for developers. Prior to version 1.29.2, the Link Check API (/api/v1/message/{I

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-1

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-1

Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). In mcp

NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to versions 6.0.1638.0 and 6.5.1638.0,

NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to versions 6.0.1638.0 and 6.5.1638.0,

NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to versions 6.0.1638.0 and 6.5.1638.0,

A vulnerability has been found in fosrl Pangolin up to 1.15.4-s.3. This affects the function verifyRoleAccess/verifyApiK

n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user

The The Events Calendar plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function `Stream_EnsureCap

Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, a reflected HTML injection vulne

An issue has been discovered in GitLab CE/EE affecting all versions from 11.2 before 18.7.5, 18.8 before 18.8.5, and 18.

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a missing bounds check in `sma

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a buffer overread in `freerdp_

VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with privileges in vCenter to ac

GitLab has remediated an issue in GitLab EE affecting all versions from 17.11 before 18.7.5, 18.8 before 18.8.5, and 18.

GitLab has remediated an issue in GitLab CE/EE affecting versions from 18.9 before 18.9.1 that could have under certain

This vulnerability is caused by a CWE‑159: "Improper Handling of Invalid Use of Special Elements" weakness, which leads

FreeRDP is a free implementation of the Remote Desktop Protocol. Versions on the 2.x branch prior to to 2.11.8 and on th

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific da

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific da

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific da

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific da

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.0 before 18.7.5, 18.8 before 18.8.5, and 18

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.7 before 18.7.5, 18.8 before 18.8.5, and 1