MEDIUM Severity CVEs

A vulnerability was found in kronosnet's (version <=1.34) cryptographic configuration management. The framework does not

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPres

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored

HCL DevOps Plan is potentially susceptible to Cross-Site Scripting (XSS) which could allow an attacker to exploit this v

Missing Cryptographic Step (CWE-325) vulnerability exists in certain FeliCa IC chips shipped in or before 2017. If the v

A vulnerability was found in trinodb trino 481. Affected is an unknown function of the file core/trino-main/src/main/jav

The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince co

A vulnerability was identified in itsourcecode Hospital Management System 1.0. This vulnerability affects unknown code o

Gitleaks prior to 8.30.1 contains a template injection vulnerability that allows attackers who can supply or influence r

AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the en

Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote att

An issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through v0.4.29 allows a remote attacker to execute arbitrary code v

Cross Site Scripting vulnerability in fuint Member Marketing System <=v1.0 allows a remote attacker to execute arbitrary

Shamefile is a linter for undocumented linter warnings. Prior to version 0.1.7, a path traversal vulnerability in `shame

nono is software that allows users to run AI agents in a zero-latency sandbox. Prior to version 0.55.0, the nono Landloc

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-S

Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.5, the

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeSco

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's `Manage -> Logs -> App Lo

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A Prototype Pollution condition in th

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to (but not including) 5.0.10

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to bo

cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows at

HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to dir

Joomla Extension - hikashop.com - Open redirect in Hikashop < 6.5.2 - The Joomla extension Hikashop is vulnerable to an

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the parsing of Client Se

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.219, the open tr

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3, conta

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contai

Mettle SendPortal 3.0.1 and earlier contains a stored cross-site scripting (XSS) vulnerability in the template managemen

In the Linux kernel, the following vulnerability has been resolved: net/sched: dualpi2: fix GSO backlog accounting Whe

In the Linux kernel, the following vulnerability has been resolved: i2c: i801: fix hardware state machine corruption in

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if

In the Linux kernel, the following vulnerability has been resolved: net: team: fix NULL pointer dereference in team_xmi

In the Linux kernel, the following vulnerability has been resolved: xfs: fail recovery on a committed log item with no

Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called `ApprovalI

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `AgentRuntime` promises scoped fil

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.backup()` recu

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.restore(env, b

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of Client

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of RDP Co

A CSRF vulnerability exists in the `zone-include.php` script in Revive Adserver 6.0.7. Linking and unlinking banners or

In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in `properties_parse()` allows an authenticated attac

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulnerability within the

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a timing side-channel vulnerability in the login in

libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and in