MEDIUM Severity CVEs

Partner Software's Partner Software application and Partner Web application allows an authenticated user to add notes on

Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, Files does not have

Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, the File Move functi

LocalSend is an open-source app to securely share files and messages with nearby devices over local networks without nee

Cursor is a code editor built for programming with AI. In versions below 1.3, Mermaid (which is used to render diagrams)

Cursor is a code editor built for programming with AI. In versions below 1.3, an attacker can bypass the allow list in a

Alpine iLX-507 CarPlay Stack-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows physically pr

Alpine iLX-507 UPDM_wstpCBCUpdStart Command Injection Vulnerability. This vulnerability allows physically present attack

Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when con

Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused. Fixed in

Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within

Vault and Vault Enterprise’s (“Vault”) user lockout feature could be bypassed for Userpass and LDAP authentication metho

A stored Cross-Site Scripting (XSS) vulnerability exists in the qureydetails.php page of Institute-of-Current-Students 1

A SQL Injection vulnerability exists in the takeassessment2.php file of CloudClassroom-PHP-Project 1.0. The Q4 POST para

Asterisk is an open source private branch exchange and telephony toolkit. In versions up to and including 18.26.2, betwe

IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 12 is vulnerable to stored cross-site scripting. This vulnerability allows

Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allow

Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the

A stored cross-site scripting (XSS) vulnerability in The Language Sloth Web Application v1.0 allows attackers to execute

CSC Pay Mobile App 2.19.4 (fixed in version 2.20.0) contains a vulnerability allowing users to bypass payment authorizat

CRLF Injection vulnerability in Limesurvey v2.65.1+170522.  This vulnerability could allow a remote attacker to inject a

The Sina Extension for Elementor (Header Builder, Footer Builter, Theme Builder, Slider, Gallery, Form, Modal, Data Tabl

The BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Count

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPre

The SureForms WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the p

LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak.

In bootloader, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of

The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Advan

The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized acc

A vulnerability was found in code-projects Document Management System 1.0 and classified as critical. This issue affects

Quantum SuperLoader 3 V94.0 005E.0h devices allow attackers to access the hardcoded fa account because there are only 65

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the

NVIDIA Omniverse Launcher for Windows and Linux contains a vulnerability in the launcher logs, where a user could cause

php-jwt v6.11.0 was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key leng

A vulnerability was discovered in the storage policy for certain sets of encryption keys in the HPE Telco Network Functi

A vulnerability was discovered in the storage policy for certain sets of authentication keys in the HPE Telco Network Fu

A vulnerability was discovered in the storage policy for certain sets of sensitive credential information in the HPE Tel

OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows an unauthenticated, remote attacker to query the /App/

OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows attackers to bypass account-lockout and CAPTCHA protec

OPEXUS FOIAXpress Public Access Link (PAL), version v11.1.0, allows an authenticated user to add entries to the list of

CloudClassroom-PHP-Project 1.0 contains a reflected Cross-site Scripting (XSS) vulnerability in the email parameter of t

Sielox AnyWare v2.1.2 was discovered to contain a SQL injection vulnerability via the email address field of the passwor

A SQL Injection vulnerability exists in the takeassessment2.php endpoint of the CloudClassroom-PHP-Project 1.0, where th

A file upload vulnerability was discovered in CS Cart 4.18.3, allows attackers to execute arbitrary code. CS Cart 4.18.3

Cross Site Request Forgery (CSRF) vulnerability in CS Cart 4.18.3, allows attackers to add products to a user's comparis

A Plaintext Storage of a Password vulnerability in SUSE exposes the credentials for the HTTP proxy in the log files. Thi

A cross-site scripting (XSS) vulnerability exists in the LB-Link BL-CPE300M 01.01.02P42U14_06 router's web interface. Th

A stored Cross Site Scripting (xss) vulnerability in the "content management" feature in AnQiCMS v.3.4.11 allows a remot

ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control in the MailConfiguration API endpoint, where user