MEDIUM Severity CVEs

A buffer overflow vulnerability was discovered in D-Link DSL-3782 v1.01 via the sstartip, sendip, dstartip, and dendip p

A buffer overflow vulnerability was discovered in D-Link DSL-3782 v1.01, triggered by the destination, netmask and gatew

FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/iamf.c.

FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/mem.c.

FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awsm.in Drivr Lite

Missing Authorization vulnerability in QuanticaLabs MediCenter - Health Medical Clinic medicenter allows Exploiting Inco

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Erez Hadas-Sonnens

Improper Restriction of Excessive Authentication Attempts vulnerability in Rameez Iqbal Real Estate Manager real-estate-

A flaw was found in command/gpg. In some scenarios, hooks created by loaded modules are not removed when the related mod

A flaw was found in grub2. When failing to mount an HFS+ grub, the hfsplus filesystem driver doesn't properly set an ERR

A flaw was found in grub2. When reading a symbolic link's name from a UFS filesystem, grub2 fails to validate the string

When reading the language .mo file in grub_mofile_open(), grub2 fails to verify an integer overflow when allocating its

A flaw was found in grub2 where the grub_extcmd_dispatcher() function calls grub_arg_list_alloc() to allocate memory for

Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages using the `:red

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be

Meshtastic is an open source mesh networking solution. In affected firmware versions crafted packets over MQTT are able

Incorrect cookie session handling in WombatDialer before 25.02 results in the full session identity being written to sys

Server-Side Access Control Bypass vulnerability in WombatDialer before 25.02 could allow unauthorized users to potential

A flaw was found in grub2. A specially crafted JPEG file can cause the JPEG parser of grub2 to incorrectly check the bou

Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection. When users access the admin panel or oth

Sage DPW before 2024_12_000 is vulnerable to Cross Site Scripting (XSS). Low-privileged Sage users with employee role pr

Foundry Artifacts was found to be vulnerable to a Denial Of Service attack due to disk being potentially filled up based

Insecure Permissions in Atos Eviden IDRA and IDCA before 2.7.0. A highly trusted role (Config Admin) could exceed their

The administrative web interface of a Netgear C7800 Router running firmware version 6.01.07 (and possibly others) authen

The Uncode Core plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including

Memory safety bugs present in Firefox 135. Some of these bugs showed evidence of memory corruption and we presume that w

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in HAVELSAN Liman MYS allows Cross-Site Flashing. Thi

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Komtera Technolgies KLog

The FormCraft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in for

The Uncode theme for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'uncode_

The Uncode theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mle-description’ parameter in all v

A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to hijack a user's session by exploiting a

The Tour Master - Tour Booking, Travel, Hotel plugin for WordPress is vulnerable to time-based SQL Injection via the ‘re

The Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later plugin for WordPress is vulnerable to Cross-

The Threepress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'threepress' shortcode

The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin

The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to Refle

The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all

The Web Stories Enhancer – Level Up Your Web Stories plugin for WordPress is vulnerable to Stored Cross-Site Scripting v

The aBlocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Tabl

The Online Payments – Get Paid with PayPal, Square & Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scri

The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin

The MemorialDay plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1

Out-of-bounds write vulnerability exists in DocuPrint CP225w 01.22.01 and earlier, DocuPrint CP228w 01.22.01 and earlier

The SpeedSize Image & Video AI-Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all version

The Mortgage Calculator / Loan Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plug

The Mortgage Lead Capture System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to,

The Reaction Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all version

The Team Builder – Meet the Team plugin for WordPress is vulnerable to unauthorized modification of data due to a missin