Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
v.26.4.2314

Medium Severity Vulnerabilities

Found 9114 vulnerabilities at Medium severity.

Vulnerability Name
CVE
CWE
Severity
Pega Infinity Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2025-9559)
CVE-2025-9559
CWE-639
Medium
DOMPurify Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-0540)
CVE-2026-0540
CWE-707
Medium
Python Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2026-0864)
CVE-2026-0864
CWE-138
Medium
axios : Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-101898)
CVE-2026-101898
CWE-918
Medium
axios : Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Inje (CVE-2026-101900)
CVE-2026-101900
CWE-138
Medium
axios : Uncontrolled Resource Consumption Vulnerability (CVE-2026-101901)
CVE-2026-101901
CWE-400
Medium
axios : Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') V (CVE-2026-101902)
CVE-2026-101902
CWE-1321
Medium
axios : Inefficient Regular Expression Complexity Vulnerability (CVE-2026-101903)
CVE-2026-101903
CWE-1333
Medium
axios : Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Inje (CVE-2026-101904)
CVE-2026-101904
CWE-138
Medium
axios : Unintended Proxy or Intermediary ('Confused Deputy') Vulnerability (CVE-2026-101905)
CVE-2026-101905
CWE-441
Medium
axios : Uncontrolled Resource Consumption Vulnerability (CVE-2026-101906)
CVE-2026-101906
CWE-400
Medium
axios : Unintended Proxy or Intermediary ('Confused Deputy') Vulnerability (CVE-2026-101907)
CVE-2026-101907
CWE-441
Medium
axios : Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') V (CVE-2026-101908)
CVE-2026-101908
CWE-1321
Medium
axios : Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') V (CVE-2026-101909)
CVE-2026-101909
CWE-1321
Medium
Grafana Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2026-10601)
CVE-2026-10601
CWE-22
Medium
Nexus Repository Manager Incorrect Authorization Vulnerability (CVE-2026-10741)
CVE-2026-10741
CWE-863
Medium
MOVEit Transfer Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-11903)
CVE-2026-11903
CWE-707
Medium
MongoDb Reachable Assertion Vulnerability (CVE-2026-13055)
CVE-2026-13055
CWE-617
Medium
MongoDb Improperly Controlled Sequential Memory Allocation Vulnerability (CVE-2026-13056)
CVE-2026-13056
CWE-1325
Medium
MongoDb Improper Input Validation Vulnerability (CVE-2026-13057)
CVE-2026-13057
CWE-20
Medium
MongoDb Reachable Assertion Vulnerability (CVE-2026-13058)
CVE-2026-13058
CWE-617
Medium
MongoDb Incorrect Authorization Vulnerability (CVE-2026-13060)
CVE-2026-13060
CWE-863
Medium
MongoDb Incorrect Authorization Vulnerability (CVE-2026-13061)
CVE-2026-13061
CWE-863
Medium
MongoDb Unintended Proxy or Intermediary ('Confused Deputy') Vulnerability (CVE-2026-13062)
CVE-2026-13062
CWE-441
Medium
MongoDb Integer Overflow or Wraparound Vulnerability (CVE-2026-13063)
CVE-2026-13063
CWE-190
Medium
MongoDb Inefficient Algorithmic Complexity Vulnerability (CVE-2026-13064)
CVE-2026-13064
CWE-407
Medium
MongoDb NULL Pointer Dereference Vulnerability (CVE-2026-13065)
CVE-2026-13065
CWE-476
Medium
MongoDb Access of Resource Using Incompatible Type ('Type Confusion') Vulnerability (CVE-2026-13066)
CVE-2026-13066
CWE-843
Medium
MongoDb Incorrect Authorization Vulnerability (CVE-2026-13067)
CVE-2026-13067
CWE-863
Medium
MongoDb Incorrect Authorization Vulnerability (CVE-2026-13068)
CVE-2026-13068
CWE-863
Medium
MongoDb Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2026-13069)
CVE-2026-13069
CWE-770
Medium
MongoDb NULL Pointer Dereference Vulnerability (CVE-2026-13070)
CVE-2026-13070
CWE-476
Medium
MongoDb Use After Free Vulnerability (CVE-2026-13071)
CVE-2026-13071
CWE-416
Medium
MongoDb Reachable Assertion Vulnerability (CVE-2026-13073)
CVE-2026-13073
CWE-617
Medium
MongoDb Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2026-13074)
CVE-2026-13074
CWE-770
Medium
MongoDb Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2026-13075)
CVE-2026-13075
CWE-770
Medium
MongoDb Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2026-13076)
CVE-2026-13076
CWE-770
Medium
PHP Heap-based Buffer Overflow Vulnerability (CVE-2026-14355)
CVE-2026-14355
CWE-122
Medium
MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-14358)
CVE-2026-14358
CWE-707
Medium
PostgreSQL Cleartext Storage in a File or on Disk Vulnerability (CVE-2026-14663)
CVE-2026-14663
CWE-313
Medium
PostgreSQL Improper Preservation of Consistency Between Independent Representations of Shared State Vulnerability (CVE-2026-14666)
CVE-2026-14666
CWE-1250
Medium
PostgreSQL Observable Response Discrepancy Vulnerability (CVE-2026-14672)
CVE-2026-14672
CWE-204
Medium
PostgreSQL Buffer Over-read Vulnerability (CVE-2026-14678)
CVE-2026-14678
CWE-126
Medium
PostgreSQL Improper Enforcement of Message Integrity During Transmission in a Communication Channel Vulnerability (CVE-2026-14681)
CVE-2026-14681
CWE-924
Medium
Django Memory Allocation with Excessive Size Value Vulnerability (CVE-2026-15337)
CVE-2026-15337
CWE-789
Medium
Django Uncontrolled Recursion Vulnerability (CVE-2026-15830)
CVE-2026-15830
CWE-674
Medium
Django Improper Neutralization of Script in Attributes in a Web Page Vulnerability (CVE-2026-15920)
CVE-2026-15920
CWE-707
Medium
MOVEit Transfer Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-15968)
CVE-2026-15968
CWE-707
Medium
PostgreSQL Buffer Over-read Vulnerability (CVE-2026-18024)
CVE-2026-18024
CWE-126
Medium
Chamilo Incorrect Privilege Assignment Vulnerability (CVE-2026-1106)
CVE-2026-1106
CWE-266
Medium
Django Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2026-1207)
CVE-2026-1207
CWE-138
Medium
Django Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2026-1287)
CVE-2026-1287
CWE-138
Medium
Django Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2026-1312)
CVE-2026-1312
CWE-138
Medium
Pega Infinity Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-1562)
CVE-2026-1562
CWE-707
Medium
Pega Infinity Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-1563)
CVE-2026-1563
CWE-707
Medium
Pega Infinity Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Vulnerability (CVE-2026-1564)
CVE-2026-1564
CWE-707
Medium
Pega Infinity Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-1711)
CVE-2026-1711
CWE-707
Medium
SharePoint Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-20945)
CVE-2026-20945
CWE-707
Medium
SharePoint Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-20958)
CVE-2026-20958
CWE-918
Medium
SharePoint Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-20959)
CVE-2026-20959
CWE-707
Medium
Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-21631)
CVE-2026-21631
CWE-707
Medium
Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-21632)
CVE-2026-21632
CWE-707
Medium
Grafana Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2026-21722)
CVE-2026-21722
CWE-200
Medium
Grafana Improper Authorization Vulnerability (CVE-2026-21724)
CVE-2026-21724
CWE-285
Medium
Werkzeug WSGI Improper Handling of Windows Device Names Vulnerability (CVE-2026-21860)
CVE-2026-21860
CWE-67
Medium
Oracle JRE CVE-2026-21925 Vulnerability (CVE-2026-21925)
CVE-2026-21925
-
Medium
Oracle JRE CVE-2026-21933 Vulnerability (CVE-2026-21933)
CVE-2026-21933
-
Medium
MySQL CVE-2026-21964 Vulnerability (CVE-2026-21964)
CVE-2026-21964
-
Medium
Oracle JRE Protection Mechanism Failure Vulnerability (CVE-2026-22013)
CVE-2026-22013
CWE-693
Medium
Oracle JRE Uncontrolled Resource Consumption Vulnerability (CVE-2026-22021)
CVE-2026-22021
CWE-400
Medium
Apache Traffic Server Regular Expression without Anchors Vulnerability (CVE-2026-22068)
CVE-2026-22068
CWE-777
Medium
Angular Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-22610)
CVE-2026-22610
CWE-707
Medium
OpenSSL Improper Check for Unusual or Exceptional Conditions Vulnerability (CVE-2026-22795)
CVE-2026-22795
CWE-754
Medium
OpenSSL Improper Check for Unusual or Exceptional Conditions Vulnerability (CVE-2026-22796)
CVE-2026-22796
CWE-754
Medium
CakePHP Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-23643)
CVE-2026-23643
CWE-707
Medium