Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Cross Site Scri
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Cross Site Scri
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Preauthenticate
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.1002 Application 20.0.2614 allows Cross-Site Scr
Inappropriate implementation in Permission Prompts in Google Chrome prior to 134.0.6998.35 allowed an attacker who convi
Inappropriate implementation in Selection in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker w
Inappropriate implementation in Media Stream in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to obtain
Inappropriate implementation in Browser UI in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker
NVIDIA Hopper HGX for 8-GPU contains a vulnerability in the GPU vBIOS that may allow a malicious actor with tenant level
GMOD Apollo does not have sufficient logical or access checks when updating a user's information. This could result in a
After attempting to upload a file that does not meet prerequisites, GMOD Apollo will respond with local path information
A vulnerability has been found in SourceCodester Best Church Management Software 1.1 and classified as critical. Affecte
A vulnerability, which was classified as critical, has been found in aaluoxiang oa_system 1.0. This issue affects some u
hb.exe in TSplus Remote Access before 17.30 2024-10-30 allows remote attackers to retrieve a list of all domain accounts
On affected platforms running Arista EOS with BGP Link State configured, BGP peer flap can cause the BGP agent to leak m
On affected platforms running Arista EOS with 802.1X configured, certain conditions may occur where a dynamic ACL is rec
Cross-Site Scripting (XSS) vulnerability exists in the WPA/WAPI Passphrase field of the Wireless Security settings (2.4G
Improper request input validation in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center allows a us
A vulnerability, which was classified as problematic, has been found in ZZCMS 2025. This issue affects some unknown proc
A vulnerability classified as critical has been found in hzmanyun Education and Training System 2.1.3. This affects the
A vulnerability was found in hzmanyun Education and Training System 2.1. It has been rated as critical. Affected by this
A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Content Security Management Appliance (
A security vulnerability was discovered in the local status page functionality of Cisco Meraki’s MX67 and MX68 security
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF
Tuleap is an Open Source Suite to improve management of software developments and collaboration. In a standard usages of
Tuleap is an Open Source Suite to improve management of software developments and collaboration. The mass emailing featu
Pinecone is an experimental overlay routing protocol suite which is the foundation of the current P2P Matrix demos. The
Tuleap is an Open Source Suite to improve management of software developments and collaboration. The password to connect
An issue in xxyopen novel plus v.4.4.0 and before allows a remote attacker to execute arbitrary code via the PageControl
A Cross Site Scripting (XSS) vulnerability exists in TeamPasswordManager v12.162.284 and before that could allow a remot
t0mer BroadlinkManager v5.9.1 was discovered to contain an OS command injection vulnerability via the IP Address paramet
Malicious websites utilizing a server-side redirect to an internal error page could result in a spoofed website URL. Thi
Scanning certain QR codes that included text with a website URL could allow the URL to be opened without presenting the
Websites redirecting to a non-HTTP scheme URL could allow a website address to be spoofed for a malicious page. This vul
Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs
A web page could trick a user into setting that site as the default handler for a custom URL protocol. This vulnerabilit
It was possible to interrupt the processing of a RegExp bailout and run additional JavaScript, potentially triggering ga
A vulnerability classified as problematic was found in Open5GS up to 2.7.2. Affected by this vulnerability is the functi
The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized access to functionality in all
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the
There is a Hard-coded Cryptographic Key in Docusnap 13.0.1440.24261, and earlier and later versions. This key can be use
The Structured Content (JSON-LD) #wpsc plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin'
The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for
The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for
The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for Wor
The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for Wor
Vulnerability of improper access permission in the process management module Impact: Successful exploitation of this vul
Vulnerability of improper access permission in the HDC module Impact: Successful exploitation of this vulnerability may
Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability
Multi-thread problem vulnerability in the package management module Impact: Successful exploitation of this vulnerabilit
Frequently Asked Questions
What does MEDIUM severity mean for CVEs?
CVSS 4.0–6.9 — moderate vulnerabilities that may require specific conditions or user interaction to exploit
How many medium severity CVEs exist?
There are 169,588 CVE records rated MEDIUM in our database. Of these, 103 are listed in CISA's Known Exploited Vulnerabilities catalog.
How should I prioritize medium severity vulnerabilities?
MEDIUM severity vulnerabilities should be addressed as part of regular patching cycles. Prioritize those with high EPSS scores or that affect critical systems. CyberStrike helps you assess real-world exploitability beyond CVSS scores.
Detect MEDIUM Vulnerabilities
CyberStrike scans your infrastructure and detects medium severity vulnerabilities in real time.
Get Started