Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
v.26.4.2314

Medium Severity Vulnerabilities

Found 8857 vulnerabilities at Medium severity.

Vulnerability Name
CVE
CWE
Severity
Chamilo Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-31941)
CVE-2026-31941
CWE-918
Medium
SharePoint Improper Input Validation Vulnerability (CVE-2026-32201)
CVE-2026-32201
CWE-20
Medium
Craft CMS Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2026-32262)
CVE-2026-32262
CWE-22
Medium
phpMyFAQ Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-32629)
CVE-2026-32629
CWE-707
Medium
Chamilo URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2026-32932)
CVE-2026-32932
CWE-601
Medium
Apache Tomcat Improper Input Validation Vulnerability (CVE-2026-32990)
CVE-2026-32990
CWE-20
Medium
Apache HTTP Server Observable Timing Discrepancy Vulnerability (CVE-2026-33006)
CVE-2026-33006
CWE-208
Medium
Apache HTTP Server NULL Pointer Dereference Vulnerability (CVE-2026-33007)
CVE-2026-33007
CWE-476
Medium
Django Inefficient Algorithmic Complexity Vulnerability (CVE-2026-33033)
CVE-2026-33033
CWE-407
Medium
Craft CMS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-33051)
CVE-2026-33051
CWE-707
Medium
SharePoint Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-33113)
CVE-2026-33113
CWE-707
Medium
Chamilo Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2026-33141)
CVE-2026-33141
CWE-639
Medium
Craft CMS Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2026-33158)
CVE-2026-33158
CWE-639
Medium
Craft CMS Missing Authentication for Critical Function Vulnerability (CVE-2026-33159)
CVE-2026-33159
CWE-306
Medium
Craft CMS Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2026-33160)
CVE-2026-33160
CWE-639
Medium
Craft CMS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2026-33161)
CVE-2026-33161
CWE-200
Medium
Craft CMS Improper Authorization Vulnerability (CVE-2026-33162)
CVE-2026-33162
CWE-285
Medium
Ruby on Rails Uncontrolled Resource Consumption Vulnerability (CVE-2026-33169)
CVE-2026-33169
CWE-400
Medium
Ruby on Rails Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-33170)
CVE-2026-33170
CWE-707
Medium
Ruby on Rails Improper Verification of Intent by Broadcast Receiver Vulnerability (CVE-2026-33173)
CVE-2026-33173
CWE-925
Medium
Grafana Uncontrolled Resource Consumption Vulnerability (CVE-2026-33375)
CVE-2026-33375
CWE-400
Medium
Grafana Uncontrolled Resource Consumption Vulnerability (CVE-2026-33378)
CVE-2026-33378
CWE-400
Medium
Grafana Files or Directories Accessible to External Parties Vulnerability (CVE-2026-33380)
CVE-2026-33380
CWE-552
Medium
Squid Out-of-bounds Read Vulnerability (CVE-2026-33515)
CVE-2026-33515
CWE-125
Medium
Apache HTTP Server Other Vulnerability (CVE-2026-33523)
CVE-2026-33523
-
Medium
EspoCRM Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-33534)
CVE-2026-33534
CWE-918
Medium
EspoCRM Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Vulnerability (CVE-2026-33657)
CVE-2026-33657
CWE-707
Medium
Ruby on Rails Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2026-33658)
CVE-2026-33658
CWE-770
Medium
PrestaShop Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-33673)
CVE-2026-33673
CWE-707
Medium
PrestaShop Improper Use of Validation Framework Vulnerability (CVE-2026-33674)
CVE-2026-33674
CWE-1173
Medium
Chamilo Insertion of Sensitive Information into Externally-Accessible File or Directory Vulnerability (CVE-2026-33705)
CVE-2026-33705
CWE-538
Medium
Chamilo Missing Authorization Vulnerability (CVE-2026-33708)
CVE-2026-33708
CWE-862
Medium
Chamilo Improper Restriction of XML External Entity Reference Vulnerability (CVE-2026-33737)
CVE-2026-33737
CWE-611
Medium
EspoCRM Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2026-33740)
CVE-2026-33740
CWE-639
Medium
Apache HTTP Server Out-of-bounds Read Vulnerability (CVE-2026-33857)
CVE-2026-33857
CWE-125
Medium
Handlebars Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-33916)
CVE-2026-33916
CWE-707
Medium
Apache HTTP Server Out-of-bounds Read Vulnerability (CVE-2026-34032)
CVE-2026-34032
CWE-125
Medium
Dolibarr Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio Vulnerability (CVE-2026-34036)
CVE-2026-34036
-
Medium
MediaWiki Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2026-34093)
CVE-2026-34093
CWE-200
Medium
MediaWiki Exposure of Resource to Wrong Sphere Vulnerability (CVE-2026-34095)
CVE-2026-34095
CWE-668
Medium
Chamilo Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-34161)
CVE-2026-34161
CWE-707
Medium
WebLogic Improper Authorization Vulnerability (CVE-2026-34315)
CVE-2026-34315
CWE-285
Medium
MySQL Improper Resource Shutdown or Release Vulnerability (CVE-2026-34317)
CVE-2026-34317
CWE-404
Medium
MySQL Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2026-34318)
CVE-2026-34318
CWE-200
Medium
MySQL Observable Response Discrepancy Vulnerability (CVE-2026-34319)
CVE-2026-34319
CWE-204
Medium
Chamilo Improper Authorization Vulnerability (CVE-2026-34370)
CVE-2026-34370
CWE-285
Medium
Apache Tomcat Improper Authentication Vulnerability (CVE-2026-34500)
CVE-2026-34500
CWE-287
Medium
phpMyFAQ Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-34729)
CVE-2026-34729
CWE-707
Medium
phpMyFAQ Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-34974)
CVE-2026-34974
CWE-707
Medium
OpenSSL Double Free Vulnerability (CVE-2026-35188)
CVE-2026-35188
CWE-415
Medium
Django Use of Persistent Cookies Containing Sensitive Information Vulnerability (CVE-2026-35192)
CVE-2026-35192
CWE-539
Medium
Joomla Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2026-35220)
CVE-2026-35220
CWE-352
Medium
WebLogic Improper Privilege Management Vulnerability (CVE-2026-35291)
CVE-2026-35291
CWE-269
Medium
Tornado Improper Handling of Invalid Use of Special Elements Vulnerability (CVE-2026-35536)
CVE-2026-35536
CWE-159
Medium
Roundcube Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-35539)
CVE-2026-35539
CWE-707
Medium
Roundcube Incorrect Resource Transfer Between Spheres Vulnerability (CVE-2026-35540)
CVE-2026-35540
CWE-669
Medium
Roundcube Access of Resource Using Incompatible Type ('Type Confusion') Vulnerability (CVE-2026-35541)
CVE-2026-35541
CWE-843
Medium
Roundcube Incorrect Resource Transfer Between Spheres Vulnerability (CVE-2026-35542)
CVE-2026-35542
CWE-669
Medium
Roundcube Incorrect Resource Transfer Between Spheres Vulnerability (CVE-2026-35543)
CVE-2026-35543
CWE-669
Medium
Roundcube Incorrect Resource Transfer Between Spheres Vulnerability (CVE-2026-35544)
CVE-2026-35544
CWE-669
Medium
axios Uncontrolled Resource Consumption Vulnerability (CVE-2026-39865)
CVE-2026-39865
CWE-400
Medium
Serendipity Reliance on Cookies without Validation and Integrity Checking Vulnerability (CVE-2026-39963)
CVE-2026-39963
CWE-565
Medium
Opencart Incomplete Filtering of Special Elements Vulnerability (CVE-2026-3714)
CVE-2026-3714
CWE-791
Medium
XWikiplatform Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Vulnerability (CVE-2026-40105)
CVE-2026-40105
CWE-707
Medium
axios Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') Vulnerability (CVE-2026-40175)
CVE-2026-40175
CWE-707
Medium
DOMPurify Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-41240)
CVE-2026-41240
CWE-707
Medium
Angular Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-41423)
CVE-2026-41423
CWE-918
Medium
axios Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2026-42034)
CVE-2026-42034
CWE-770
Medium
axios Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2026-42036)
CVE-2026-42036
CWE-770
Medium
axios Improper Neutralization of CRLF Sequences ('CRLF Injection') Vulnerability (CVE-2026-42037)
CVE-2026-42037
CWE-707
Medium
axios Improper Authentication Vulnerability (CVE-2026-42041)
CVE-2026-42041
CWE-287
Medium
axios Permissive List of Allowed Inputs Vulnerability (CVE-2026-42042)
CVE-2026-42042
CWE-183
Medium
OpenSSL NULL Pointer Dereference Vulnerability (CVE-2026-42766)
CVE-2026-42766
CWE-476
Medium
OpenSSL NULL Pointer Dereference Vulnerability (CVE-2026-42767)
CVE-2026-42767
CWE-476
Medium
OpenSSL Improper Certificate Validation Vulnerability (CVE-2026-42769)
CVE-2026-42769
CWE-295
Medium