MEDIUM - zero redgem

Recent Advisories

Severity	ID	Title	Vendor	Product	Date	Type
MEDIUM 6.5	CVE-2026-12110	Taskbuilder <= 5.0.8 - Authenticated (Subscriber+) SQL Injection via 'task_search' Parameter_CVE-2026-12110 The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to generic SQL Injection via the '...	taskbuilder	Taskbuilder – Project Management & Task Management Tool With Kanban Board	Jul 1, 2026	CVE
MEDIUM 6.5	CVE-2026-12090	Taskbuilder <= 5.0.8 - Authenticated (Subscriber+) SQL Injection via 'wppm_proj_filter' Parameter_CVE-2026-12090 The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to generic SQL Injection via the '...	taskbuilder	Taskbuilder – Project Management & Task Management Tool With Kanban Board	Jul 1, 2026	CVE
MEDIUM 6.5	CVE-2026-11988	LearnPress <= 4.3.9.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' Parameter_CVE-2026-11988 The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in ...	thimpress	LearnPress – WordPress LMS Plugin for Create and Sell Online Courses	Jul 1, 2026	CVE
MEDIUM 4.3	CVE-2026-11981	GiveWP <= 4.15.3 - Cross-Site Request Forgery_CVE-2026-11981 The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.15.3 This is due to missing nonce v...	stellarwp	GiveWP – Donation Plugin and Fundraising Platform	Jul 1, 2026	CVE
MEDIUM 6.4	CVE-2026-11380	JetWidgets For Elementor <= 1.0.21 - Authenticated (Author+) Stored Cross-Site Scripting via Animated Box 'animation_effect' Setting_CVE-2026-11380 The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.0.21. This is due ...	jetmonsters	JetWidgets For Elementor	Jul 1, 2026	CVE
MEDIUM 4.8	CVE-2025-15666	Open Asset Import Library Assimp Model File SceneCombiner.cpp Copy heap-based overflow_CVE-2025-15666 A security vulnerability has been detected in Open Asset Import Library Assimp up to 5.4.3. Affected by this vulnerability is the function Assimp::...	Open Asset Import Library	Assimp 5.4.0	Jul 1, 2026	CVE
MEDIUM 6.4	CVE-2026-9107	Kali Forms <= 2.4.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'kaliforms_field_components' Parameter_CVE-2026-9107 The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'meta[kaliforms_fie...	wpchill	Kali Forms — Contact Form & Drag-and-Drop Builder	Jul 1, 2026	CVE
MEDIUM 5.3	CVE-2026-7828	UltraVNC repeater integer overflow in win_log malloc leading to heap overflow_CVE-2026-7828 UltraVNC repeater through 1.8.2.2 contains an integer overflow in the HTTP request logging path. In repeater/webgui/settings.c:336, the win_log() f...	uvnc	UltraVNC	Jul 1, 2026	CVE
MEDIUM 6.9	CVE-2026-58519	Stored XSS through Cargo’s map format_CVE-2026-58519 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Ex...	The Wikimedia Foundation	Mediawiki - Cargo Extension *	Jul 1, 2026	CVE
MEDIUM 6.9	CVE-2026-58518	CVE-2026-58518_CVE-2026-58518 Cross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - RedirectManager Extension allows Cross Site Request Forgery...	The Wikimedia Foundation	Mediawiki - RedirectManager Extension *	Jul 1, 2026	CVE