Medium severity vulnerabilities
201 CVEs scored 4.0 to 6.9 on CVSS. Medium-severity vulnerabilities have limited impact or are harder to exploit. They still matter when chained with other flaws.
- 6.5 Medium severity
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Exploited
Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
- 4.3 Medium severity
Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Exploited
Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.
- 4.3 Medium severity
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Exploited
Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience
- 6.7 Medium severity
Siemens Software Center Uncontrolled Search Path Element Exploited
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially craft
- 4.3 Medium severity
Plex Media Server Server-Side Request Forgery (SSRF) Exploited
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.
- 6.5 Medium severity
Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Exploited
Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.
- 4.3 Medium severity
Plex Media Server Server-Side Request Forgery (SSRF) Exploited
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.
- 6.5 Medium severity
Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Exploited
RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the
- 5.3 Medium severity
JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Exploited
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.
- 5.3 Medium severity
Cisco Secure Firewall Management Center Use of Hard-coded Password Exploited
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.
- 5.9 Medium severity
WordPress Core SQL Injection Exploited
WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.
- 6.5 Medium severity
Cisco Catalyst SD-WAN Manager Directory or Path Traversal Exploited
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. This vulnerability exists because the affecte
- 5.8 Medium severity
Arista Extensible Operating System Incomplete Comparison with Missing Factors Exploited
On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward
- 6.5 Medium severity
Kludex Starlette HTTP Request/Response Smuggling Exploited
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt
- 6.7 Medium severity
Trend Micro Apex One (On-Premise) Directory Traversal Exploited
A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations. This vulnerability is only exploi
- 6.1 Medium severity
Microsoft Exchange Server Cross-Site Scripting Exploited
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
- 4.3 Medium severity
Microsoft Windows Protection Mechanism Failure Exploited
Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.
- 6.5 Medium severity
Microsoft SharePoint Server Improper Input Validation Exploited
Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
- 6.5 Medium severity
Fortinet Multiple Products Path Traversal Exploited
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPA
- 5.4 Medium severity
Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Exploited
A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credentials with API access o
- 6.2 Medium severity
Microsoft Windows NULL Pointer Dereference Exploited
Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally.
- 5.9 Medium severity
Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Exploited
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a r
- 5.5 Medium severity
Microsoft Windows Information Disclosure Exploited
Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.
- 6.1 Medium severity
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Exploited
Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.
- 6.6 Medium severity
SonicWall SMA1000 Missing Authorization Exploited
A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).
- 6.1 Medium severity
RoundCube Webmail Cross-site Scripting Exploited
Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.
- 5.5 Medium severity
Apple Multiple Products Classic Buffer Overflow Exploited
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicio
- 5.5 Medium severity
Android Framework Information Disclosure Exploited
In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User
- 5.5 Medium severity
Linux Kernel Race Condition Exploited
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, co
- 6.1 Medium severity
Libraesva Email Security Gateway Command Injection Exploited
Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix has been released in 5.1.20. For ESG 5.2 a fix has been released in 5.2.31. For ESG 5.4 a
- 5.4 Medium severity
Meta Platforms WhatsApp Incorrect Authorization Exploited
Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an a
- 4.3 Medium severity
Wing FTP Server Information Disclosure Exploited
loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.
- 6.5 Medium severity
Microsoft SharePoint Improper Authentication Exploited
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
- 6.1 Medium severity
Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Exploited
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unaut
- 4.2 Medium severity
Apple Multiple Products Unspecified Exploited
This issue was addressed with improved checks. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5, macOS Sequoia 15.3.1, macOS Sonoma 14.7.4, macOS Ventura 13.7.4, visionOS 2.3.1, wa
- 4.6 Medium severity
IGEL OS Use of a Key Past its Expiration Date Exploited
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.
- 4.0 Medium severity
TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Exploited
The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025.
- 5.3 Medium severity
TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Exploited
The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025.
- 4.9 Medium severity
TeleMessage TM SGNL Hidden Functionality Exploited
The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different functionality than described in the TeleMessage "End-to-End encryption from the mobile phone through to the
- 5.3 Medium severity
Craft CMS External Control of Assumed-Immutable Web Parameter Exploited
Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and gene