MEDIUM Severity CVEs

WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malici

WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malici

Bludit versions before 3.13.1 contain an authenticated file download vulnerability in the Backup Plugin that allows logg

projectSend r1605 contains a stored cross-site scripting vulnerability that allows authenticated administrators to injec

Xenforo 2.2.13 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject m

ChurchCRM is an open-source church management system. Prior to version 6.0.0, the application stores user-supplied HTML/

ChurchCRM is an open-source church management system. In versions prior to 6.5.4, there is a Stored Cross-Site Scripting

ChurchCRM is an open-source church management system. Versions prior to 6.5.3 have a stored cross-site scripting vulnera

Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. In applications built with the Auth0-PHP SDK, the a

Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in SStream_concat

ChurchCRM is an open-source church management system. A stored cross-site scripting (XSS) vulnerability exists in Church

ChurchCRM is an open-source church management system. A privilege escalation vulnerability exists in ChurchCRM prior to

Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, Skipdata length is not bounds-checked, so a use

An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 before 24.2.8, and 25.1 before 25.1.6. Directories and fi

An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Authenticated users

Improper management of Content Security Policy in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lo

This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS T

A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4,

The issue was addressed with additional permissions checks. This issue is fixed in Safari 26.2, macOS Tahoe 26.2. An app

The issue was addressed with improved handling of caches. This issue is fixed in macOS Tahoe 26.2. An app may be able to

A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iP

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3,

The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.2 and i

The issue was addressed with improved handling of caches. This issue is fixed in macOS Tahoe 26.2. An app may be able to

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.2 and iPadOS 26.2. An app may

Missing cryptographic key commitment in the Amazon S3 Encryption Client for Go may allow a user with write access to the

Missing cryptographic key commitment in the Amazon S3 Encryption Client for Java may allow a user with write access to t

Missing cryptographic key commitment in the AWS SDK for Ruby may allow a user with write access to the S3 bucket to intr

Missing cryptographic key commitment in the AWS SDK for PHP may allow a user with write access to the S3 bucket to intro

A Buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd in Tenda AC10V4.0 V16.03.10.20 allows remot

Reflected cross-site scripting (XSS) in SLiMS (slims9_bulian) before 9.6.0 via improper handling of $_SERVER['PHP_SELF'

AVideo versions prior to 20.1 contain an open redirect vulnerability caused by insufficient validation of the siteRedire

AVideo versions prior to 20.1 are vulnerable to an open redirect flaw due to missing validation of the cancelUri paramet

AVideo versions prior to 20.1 are vulnerable to an insecure direct object reference (IDOR) that allows any authenticated

Missing cryptographic key commitment in the AWS SDK for C++ may allow a user with write access to the S3 bucket to intro

Missing cryptographic key commitment in the Amazon S3 Encryption Client for .NET may allow a user with write access to t

A Cross-Site Request Forgery (CSRF) in the page creation/editing function of RiteCMS v3.1.0 allows attackers to arbitrar

A reflected cross-site scripting (XSS) vulnerability in RiteCMS v3.1.0 allows attackers to execute arbitrary code in the

RiteCMS v3.1.0 was discovered to use insecure encryption to store passwords.

The Ultimate Member plugin for WordPress is vulnerable to Profile Privacy Setting Bypass in all versions up to, and incl

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to multiple Stored Cross-Site Scri

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin for W

Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6 fail to check WebSocket request field for p

A Cross-site scripting (XSS) vulnerability in Create/Update Item Kit(s) in Open Source Point of Sale v3.4.1 allows remot

The OTA firmware update mechanism in Netun Solutions HelpFlash IoT (firmware v18_178_221102_ASCII_PRO_1R5_50) uses hard-

In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) c

Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6 and Mattermost Calls versions <=1.10.0 fail