MEDIUM Severity CVEs

Improper conditions check for some Intel(R) PROSet/Wireless WiFi Software within Ring 2: Device Drivers may allow a deni

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI

A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with a

CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that

Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting partic

A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the

Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server proces

A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to han

SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swc_html_mi

The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore. To prevent users fr

Velociraptor's NTFS parsing library mishandles several out of bound and memory exhaustion bugs which may be triggered by

Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only

Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulne

Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakne

Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 interpolate environment variables and secre

Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey

Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The create()

n8n versions before 2.32.1 fail to enforce the Allowed HTTP Request Domains allowlist in multiple AI and LLM nodes when

Nuxt versions >= 4.4.7 and < 4.5.1, and >= 3.21.7 and < 3.21.10, contain an information disclosure vulnerability in the

A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.1). The affected application is v

A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.233.16-7862), Desigo PXC3 (All versions < V01.

A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). The project password feature in the affec

A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). Affected products use a static, hardcoded

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated sta

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated sta

A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete ar

A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the se

A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with

A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRF_PROTECTI

A stored cross-site scripting vulnerability in HortusFox 5.9 allows authenticated workspace members to inject persistent

A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows any self-registered customer

A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member to inject persisten

An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace membe

An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace mem

A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to in

The Windows installer deployed Npcap leaving its access restriction option at the insecure default value, so the driver

A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the `JSON_read()` function,

A flaw was found in claircore's RPM package scanner. Crafted RPM header data in a container layer can cause an unchecked

Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipu

Improper Validation of Specified Quantity in Input and Allocation of Resources Without Limits or Throttling vulnerabilit

A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the

The Signed Video Framework contained a  buffer overflow issue which could lead the application using this framework to

The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to priv

The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can only be exploited after

An ACAP configuration file lacks input validation, which could potentially lead to privilege escalation. This vulnerabil

The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to priv

Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of