MEDIUM Severity CVEs

Observable Timing Discrepancy vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive Web allows Cross-Doma

The web application allows an unauthenticated remote attacker to learn information about existing user accounts with the

Deserialization of Untrusted Data vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 2.0

A Insufficient Session Expiration vulnerability in the Liferay Portal 7.4.3.121 through 7.3.3.131, and Liferay DXP 2024.

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2024

An improper resource shutdown or release vulnerability has been identified in the Click Plus C2-03CPU-2 device running f

An improper resource shutdown or release vulnerability has been identified in the Click Plus C2-03CPU-2 device running f

An authorization bypass vulnerability has been discovered in the Click Plus C2-03CPU2 device firmware version 3.60. Thro

The use of a hard-coded cryptographic key was discovered in firmware version 3.60 of the Click Plus PLC. The vulnerabili

Cleartext storage of sensitive information was discovered in Click Programming Software version v3.60. The vulnerability

Improper input validation in Satellite Management Controller (SMC) may allow an attacker with privileges to manipulate R

Improper input validation in Satellite Management Controller (SMC) may allow an attacker with privileges to use certain

In Shenzhen C-Data Technology Co. FD602GW-DX-R410 (firmware v2.2.14), the web management interface contains an authentic

OS Command injection vulnerability in D-Link C1 2020-02-21. The sub_47F028 function in jhttpd contains a command injecti

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordPress allows S

Indian Bank IndSMART Android App 3.8.1 is vulnerable to Missing SSL Certificate Validation in NuWebViewActivity.

Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineS

An issue in PocketVJ CP PocketVJ-CP-v3 pvj 3.9.1 allows remote attackers to execute arbitrary code via the submit_size.p

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to v

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to v

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to v

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to v

Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. Th

OS Command injection vulnerability in Tenda AC9 1.0 was discovered to contain a command injection vulnerability via the

SQL Injection vulnerability in CSZ-CMS v.1.3.0 allows a remote attacker to execute arbitrary code via the execSqlFile fu

SQL Injection vulnerability in CSZ-CMS v.1.3.0 allows a remote attacker to execute arbitrary code via the execSqlFile fu

A reflected cross-site scripting (XSS) vulnerability exists in the account registration flow of WSO2 Identity Server due

Cross-site scripting (XSS) vulnerability in YzmCMS thru 7.3 via the referer header in the register page.

A cross-tenant authentication vulnerability exists in multiple WSO2 products due to improper cryptographic design in Ada

A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain

An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input valida

A stored cross-site scripting (XSS) vulnerability in the Admin Log Viewer of S-Cart <=10.0.3 allows a remote authenticat

An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper valida

An information disclosure vulnerability exists in multiple WSO2 products due to improper implementation of the enrich me

Authorization Bypass Through User-Controlled Key vulnerability in Anadolu Hayat Emeklilik Inc. AHE Mobile allows Privile

danny-avila/librechat is affected by an authorization bypass vulnerability due to improper access control checks. The `c

A vulnerability was identified in Campcodes Society Membership Information System 1.0. This issue affects some unknown p

A vulnerability was determined in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /m

A vulnerability was found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/Componente

A vulnerability has been found in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality o

The CleverControl employee monitoring software (v11.5.1041.6) fails to validate TLS server certificates during the insta

In the Linux kernel, the following vulnerability has been resolved: tracing/osnoise: Fix null-ptr-deref in bitmap_parse

In the Linux kernel, the following vulnerability has been resolved: bpf: Tell memcg to use allow_spinning=false path in

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix recursive semaphore deadlock in fiemap c

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix subvolume deletion lockup caused by inod

In the Linux kernel, the following vulnerability has been resolved: ceph: always call ceph_shift_unused_folios_left()

In the Linux kernel, the following vulnerability has been resolved: ceph: fix crash after fscrypt_encrypt_pagecache_blo

In the Linux kernel, the following vulnerability has been resolved: net: fec: Fix possible NPD in fec_enet_phy_reset_af

In the Linux kernel, the following vulnerability has been resolved: igb: Fix NULL pointer dereference in ethtool loopba

In the Linux kernel, the following vulnerability has been resolved: macsec: sync features on RTM_NEWLINK Syzkaller man