MEDIUM Severity CVEs

Craft is a platform for creating digital experiences. From 5.0.0-RC1 to 5.8.21, Craft has a stored XSS via Entry Type na

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, FileStore maps cache keys to fil

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, in litestar.middleware.allowed_h

FileRise is a self-hosted web file manager / WebDAV server. Prior to 3.3.0, an HTML Injection vulnerability allows an au

MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, the courses/<:course_

A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionServi

OpenProject is an open-source, web-based project management software. Prior to 17.0.2, users with the Manage Users permi

Dell Display and Peripheral Manager (Windows) versions prior to 2.2 contain an Improper Link Resolution Before File Acce

Crafted zones can lead to increased incoming network traffic.

Crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor.

Hitron HI3120 v7.2.4.5.2b1 allows stored XSS via the Parental Control option when creating a new filter. The device fail

Crafted delegations or IP fragments can poison cached delegations in Recursor.

A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Uni

Insecure Storage of Sensitive Information vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co.

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to

Insertion of Sensitive Information Into Sent Data vulnerability in Atlas Educational Software Industry Ltd. Co. K12net a

In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs

Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or mo

Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with cust

A vulnerability was found in D-Link DCS-931L up to 1.13.0. Impacted is the function doSystem of the file /setSystemAdmin

A vulnerability has been found in DouPHP up to 1.9. This issue affects some unknown processing of the file /admin/file.p

Authentication Bypass by Alternate Name vulnerability in Apache Shiro. This issue affects Apache Shiro: before 2.0.7.

Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.

The Python code being run by 'runPython' or 'runPythonAsync' is not isolated from the rest of the JS code, allowing any

The Pydantic-AI MCP Run Python tool configures the Deno sandbox with an overly permissive configuration that allows the

C&Cm@il developed by HGiga has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrar

Products provided by Oki Electric Industry Co., Ltd. and its OEM products (Ricoh Co., Ltd., Murata Machinery, Ltd.) regi

A vulnerability was determined in D-Link DCS-933L up to 1.14.11. This affects an unknown function of the file /setSystem

A flaw has been found in rachelos WeRSS we-mp-rss up to 1.4.8. Impacted is the function download_export_file of the file

The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potential

A security flaw has been discovered in code-projects Online Music Site 1.0. Affected by this issue is some unknown funct

A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product does not properl

A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product is vulnerable to

A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. Detailed messages are displayed

A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. The response header contains

A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. Since there are input fields

A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. The library version could be

A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product does not specify

A flaw has been found in D-Link DI-7100G C1 24.04.18D1. This affects the function start_proxy_client_email. Executing a

A vulnerability was detected in D-Link DI-7100G C1 24.04.18D1. Affected by this issue is the function set_jhttpd_info. P

A security vulnerability has been detected in Great Developers Certificate Generation System up to 97171bb0e5e22e52eacf4

A vulnerability was determined in PHPGurukul Hospital Management System 4.0. This impacts an unknown function of the fil

A vulnerability was found in r-huijts xcode-mcp-server up to f3419f00117aa9949e326f78cc940166c88f18cb. This affects the

A security vulnerability has been detected in code-projects Contact Management System 1.0. This issue affects some unkno

A vulnerability has been found in D-Link DWR-M921 1.1.50. This impacts an unknown function of the file /boafrm/formLtefo

A flaw has been found in D-Link DWR-M921 1.1.50. This affects the function sub_419920 of the file /boafrm/formLtefotaUpg

A vulnerability was detected in Totolink WA300 5.2cu.7112_B20190227. The impacted element is the function setAPNetwork o

A vulnerability was identified in D-Link DIR-600 up to 2.15WWb02. This vulnerability affects unknown code of the file ss

A vulnerability was determined in itsourcecode News Portal Project 1.0. This affects an unknown part of the file /admin/

A vulnerability has been found in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability i