MEDIUM Severity CVEs

A vulnerability has been found in Dromara UJCMS 101.2. This issue affects the function deleteDirectory of the file WebFi

A weakness has been identified in JeecgBoot 3.9.0. Affected by this vulnerability is an unknown functionality of the fil

A vulnerability was identified in SapneshNaik Student Management System up to f4b4f0928f0b5551a28ee81ae7e7fe47d9345318.

The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for Wor

A vulnerability was identified in Tenda A18 15.13.07.13. The affected element is the function webCgiGetUploadFile of the

The Conditional CAPTCHA WordPress plugin through 4.0.0 does not validate a parameter before redirecting the user to its

A vulnerability was detected in funadmin up to 7.1.0-rc4. This issue affects the function getMember of the file app/comm

A vulnerability was identified in funadmin up to 7.1.0-rc4. Affected by this vulnerability is the function getMember of

Lettermint Node.js SDK is the official Node.js SDK for Lettermint. In versions 1.5.0 and below, email properties (such a

The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to unauthorized los

OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, the ACP bridge accepts very large prompt text bloc

OpenClaw is a personal AI assistant. In versions 2026.2.13 and below of the OpenClaw CLI, the process cleanup uses syste

OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, skills/skill-creator/scripts/package_skill.py (a l

OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, the Discord moderation action handling (timeout, k

Ray is an AI compute engine. In versions 2.53.0 and below, thedashboard HTTP server blocks browser-origin POST/PUT but d

Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. In versions 2.1.0 thro

The weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for Wo

A vulnerability has been found in feng_ha_ha/megagao ssm-erp and production_ssm up to 4288d53bd35757b27f2d070057aefb2c07

Isso is a lightweight commenting server written in Python and JavaScript. In commits before 0afbfe0691ee237963e8fb0b2ee0

LinkAce is a self-hosted archive to collect website links. Versions 2.4.2 and below have a Stored Cross-site Scripting v

ASN.1 TypeScript ESM library, including codecs for Basic Encoding Rules (BER) and Distinguished Encoding Rules (DER). In

A flaw has been found in feng_ha_ha/megagao ssm-erp and production_ssm up to 4288d53bd35757b27f2d070057aefb2c07bdd097. T

A vulnerability was detected in Foswiki up to 2.1.10. The affected element is an unknown function of the component Chang

Pannellum is a lightweight, free, and open source panorama viewer for the web. In versions 3.5.0 through 2.5.6, the hot

Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session

Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Window

A denial-of-service vulnerability was identified in Moodle’s TeX formula editor. When rendering TeX content using mimete

A security vulnerability has been detected in feng_ha_ha/megagao ssm-erp and production_ssm up to 4288d53bd35757b27f2d07

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In versions 5.

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Versions 5.0.3

When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operat

OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Versions 1.1.2-a

GetSimple CMS is a content management system. All versions of GetSimple CMS are vulnerable to XSS through SVG file uploa

GetSimple CMS is a content management system. All versions of GetSimple CMS do not implement CSRF protection on the admi

RustDesk Client for Windows Transfer File Link Following Information Disclosure Vulnerability. This vulnerability allows

Deciso OPNsense diag_backup.php filename Command Injection Remote Code Execution Vulnerability. This vulnerability allow

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. F

svelte performance oriented web framework. Prior to 5.51.5, in server-side rendering, attribute spreading on elements (e

svelte performance oriented web framework. Prior to 5.51.5, when using <svelte:element this={tag}> in server-side render

svelte performance oriented web framework. Versions of svelte prior to 5.51.5 are vulnerable to cross-site scripting (XS

svelte performance oriented web framework. From 5.39.3, <=5.51.4, in certain circumstances, the server-side rendering ou

phpMoAdmin 1.1.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject ma

phpMoAdmin 1.1.5 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject

OrientDB 3.0.17 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious script

OrientDB 3.0.17 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malic

OrientDB 3.0.17 GA Community Edition contains cross-site request forgery vulnerabilities that allow attackers to perform

Foscam Video Management System 1.1.6.6 contains a buffer overflow vulnerability in the UID field that allows local attac

Sricam DeviceViewer 3.12.0.1 contains a password change security bypass vulnerability that allows authenticated users to

Leafkit is a templating language with Swift-inspired syntax. Prior to 1.4.1, htmlEscaped in leaf-kit will only escape ht

Liquid Prompt is an adaptive prompt for Bash and Zsh. Starting in commit cf3441250bb5d8b45f6f8b389fcdf427a99ac28a and pr