MEDIUM Severity CVEs

Cloudflare quiche was discovered to be vulnerable to an infinite loop when sending packets containing RETIRE_CONNECTION_

ERC (aka Emotion Recognition in Conversation) through 0.3 has insecure deserialization via a serialized object because j

In Agora Foundation Agora fall23-Alpha1 before 690ce56, there is XSS via a profile picture to server/controller/userCont

In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via tag in client/agora/public/js/editorManager.js.

In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via topicName in client/agora/public/js/editorManag

An issue in Ollama v0.1.33 allows attackers to delete arbitrary files via sending a crafted packet to the endpoint /api/

openjpeg v 2.5.0 was discovered to contain a NULL pointer dereference via the component /openjp2/dwt.c.

A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and th

An issue in 4C Strategies Exonaut before v22.4 allows attackers to execute a directory traversal.

EyouCMS 1.6.7 is vulnerable to Cross Site Scripting (XSS) in /login.php?m=admin&c=System&a=web&lang=cn.

An issue was discovered in Akamai Ghost, as used for the Akamai CDN platform before 2025-03-26. Under certain circumstan

Inappropriate implementation in Permissions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform

Insufficient validation of untrusted input in Core in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to

Inappropriate implementation in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinc

Inappropriate implementation in Filesystems in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform

Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who

Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. There is a Cro

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.

A maliciously crafted PSD file, when linked or imported into Autodesk 3ds Max, can force an Out-of-Bounds Read vulnerabi

Bottinelli Informatical Vedo Suite 2024.17 is vulnerable to Server-side Request Forgery (SSRF) in the /api_vedo/video/pr

A local file inclusion (LFI) vulnerability in Vedo Suite version 2024.17 allows remote authenticated attackers to read a

Vedo Suite 2024.17 is vulnerable to Incorrect Access Control, which allows remote attackers to obtain a valid high privi

A Cross-site scripting (XSS) vulnerability in /api_vedo/ in Vedo Suite version 2024.17 allows remote attackers to inject

A path traversal vulnerability in Vedo Suite 2024.17 allows remote authenticated attackers to read arbitrary filesystem

AutoConnect 1.4.2, an Arduino library, is vulnerable to a cross site scripting (xss) vulnerability. The AutoConnect web

An issue was discovered in 4C Strategies Exonaut 21.6. Passwords, stored in the database, are hashed without a salt.

4C Strategies Exonaut before v22.4 was discovered to contain an access control issue.

4C Strategies Exonaut before v21.6.2.1-1 was discovered to contain a Server-Side Request Forgery (SSRF).

4C Strategies Exonaut before v22.4 was discovered to contain insecure permissions.

A vulnerability, which was classified as critical, was found in SkyworkAI DeepResearchAgent up to 08eb7f8eb9505d0094d75b

A vulnerability, which was classified as critical, has been found in agno-agi agno up to 1.7.5. This issue affects the f

A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP Inje

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to modi

A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remot

A vulnerability in the meeting-join functionality of Cisco Webex Meetings could have allowed an unauthenticated, network

A reflected cross-site scripting (XSS) vulnerability in Sage DPW 2024_12_004 and earlier allows attackers to execute arb

An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the

The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potential

In Gatling Enterprise versions below 1.25.0, a low-privileged user that does not hold the role "admin" could perform a R

In Gatling Enterprise versions below 1.25.0, a user logging-out can still use his session token to continue using the ap

MCCMS v2.7.0 has an SSRF vulnerability located in the index() method of the sys\apps\controllers\api\Gf.php file, where

A vulnerability in QCMS version 6.0.5 allows authenticated users to read arbitrary files from the server due to insuffic

IBM Guardium Data Protection could allow a remote attacker to obtain sensitive information due to cleartext transmission

Lack of TLS validation when downloading a CSV file including mapping from IPs to countries used ONLY for displaying coun

The Mobile Access Portal's File Share application is vulnerable to a directory traversal attack, allowing an authenticat

NVIDIA Triton Inference Server for Windows and Linux and the Tensor RT backend contain a vulnerability where an attacker

NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker c

NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker c