Windows Kerberos Denial of Service Vulnerability
Windows Remote Desktop Configuration Service Tampering Vulnerability
Windows Deployment Services Denial of Service Vulnerability
Microsoft Outlook Spoofing Vulnerability
Internet Connection Sharing (ICS) Denial of Service Vulnerability
Internet Connection Sharing (ICS) Denial of Service Vulnerability
Internet Connection Sharing (ICS) Denial of Service Vulnerability
Azure Network Watcher VM Extension Elevation of Privilege Vulnerability
DHCP Client Service Denial of Service Vulnerability
Photoshop Elements versions 2025.0 and earlier are affected by a Creation of Temporary File in Directory with Incorrect
Substance3D - Stager versions 3.1.0 and earlier are affected by a NULL Pointer Dereference vulnerability that could resu
An exploitable CSRF vulnerability exists in Atlassian Jira, from versions 7.6.4 to 8.1.0. The login form doesn’t require
InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an Improper Input Validation vulnerability that c
InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by a NULL Pointer Dereference vulnerability that cou
InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an out-of-bounds read vulnerability that could le
An improper authentication in Fortinet FortiClientMac 7.0.11 through 7.2.4 allows attacker to gain improper access to Ma
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb 7.0.0
An Improper Access Control vulnerability [CWE-284] in FortiClient Windows version 7.4.0, version 7.2.6 and below, versio
An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in Fortinet For
A use of hard-coded cryptographic key to encrypt sensitive data vulnerability [CWE-321] in FortiManager 7.6.0 through 7.
A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged atta
Cleartext storage of information in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before versio
A hardcoded key in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.3 allows
Reflected XSS in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a
Issue summary: Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a server may fail to notice that the server
External control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version
Path traversal in Ivanti CSA before version 5.0.5 allows a remote unauthenticated attacker to access restricted function
In JetBrains TeamCity before 2024.12.2 several DOM-based XSS were possible on the Code Inspection Report tab
Improper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier allows an authenticated user to reus
In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all se
A vulnerability has been identified in OpenV2G (All versions < V0.9.6). The OpenV2G EXI parsing feature is missing a len
A vulnerability has been identified in SIMATIC S7-1200 CPU 1211C AC/DC/Rly (6ES7211-1BE40-0XB0) (All versions < V4.7), S
A vulnerability has been identified in SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) (All versions < V3.0.0), SCALANCE WAM763-1
The SuperSaaS – online appointment scheduling plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the
In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API
In affected versions of Octopus Server error messages were handled unsafely on the error page. If an adversary could con
A vulnerability has been identified in APOGEE PXC Series (BACnet) (All versions), APOGEE PXC Series (P2 Ethernet) (All v
A vulnerability has been identified in ModelSim (All versions < V2025.1), Questa (All versions < V2025.1). An example se
A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions), SIPROTEC 5 6MD85 (CP200) (All versions),
A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.90), SIPROTEC 5 6MD85 (CP200) (All ve
The integrated ICMP service of the network stack of affected devices can be forced to exhaust its available memory reso
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to
The login functionality of the web server in affected devices does not normalize the response times of login attempts. A
A serial interface can be accessed with physical access to the PCB of Wattsense Bridge devices. After connecting to the
The JTAG interface of Wattsense Bridge devices can be accessed with physical access to the PCB. After connecting to the
A vulnerability, which was classified as critical, was found in GNU Binutils 2.43. Affected is the function bfd_elf_relo
In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for
A vulnerability classified as critical was found in GNU Binutils 2.43. This vulnerability affects the function _bfd_elf_
SolarWinds Platform is vulnerable to a reflected cross-site scripting vulnerability. This was caused by an insufficient
Sensitive data could be exposed to non- privileged users in a configuration file. Local access to the computer with a l
Frequently Asked Questions
What does MEDIUM severity mean for CVEs?
CVSS 4.0–6.9 — moderate vulnerabilities that may require specific conditions or user interaction to exploit
How many medium severity CVEs exist?
There are 169,588 CVE records rated MEDIUM in our database. Of these, 103 are listed in CISA's Known Exploited Vulnerabilities catalog.
How should I prioritize medium severity vulnerabilities?
MEDIUM severity vulnerabilities should be addressed as part of regular patching cycles. Prioritize those with high EPSS scores or that affect critical systems. CyberStrike helps you assess real-world exploitability beyond CVSS scores.
Detect MEDIUM Vulnerabilities
CyberStrike scans your infrastructure and detects medium severity vulnerabilities in real time.
Get Started