Medium-severity CVEs (page 25)
Page 25 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-65345 | Medium | 5.5 | 2026-09-14 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, ma… |
CVE-2026-64756 | Medium | 5.5 | 2026-09-14 | A path handling issue was addressed with improved validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Taho… |
CVE-2026-64753 | Medium | 6.5 | 2026-09-14 | A permissions issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visio… |
CVE-2026-64717 | Medium | 6.3 | 2026-09-14 | A race condition was addressed with improved state handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15… |
CVE-2026-64714 | Medium | 5.5 | 2026-09-14 | A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, macOS Golden Gate 27, macOS Sequo… |
CVE-2026-53719 | Medium | 6.5 | 2026-09-14 | Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, translateSe… |
CVE-2026-53718 | Medium | 6.4 | 2026-09-14 | Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, an HTTPRout… |
CVE-2026-53716 | Medium | 6.5 | 2026-09-14 | Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, getFileFrom… |
CVE-2026-53715 | Medium | 5.3 | 2026-09-14 | Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, HTTPServer… |
CVE-2026-43808 | Medium | 5.5 | 2026-09-14 | A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, watchOS 26… |
CVE-2026-43791 | Medium | 6.5 | 2026-09-14 | A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app ma… |
CVE-2026-43788 | Medium | 6.6 | 2026-09-14 | An integer overflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27. Processing a maliciously crafted file may lead t… |
CVE-2026-43787 | Medium | 5.9 | 2026-09-14 | A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker in a privilege… |
CVE-2026-43785 | Medium | 5.5 | 2026-09-14 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Ta… |
CVE-2026-43762 | Medium | 5.5 | 2026-09-14 | The issue was addressed with improved checks. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6. An app may be able to access us… |
CVE-2026-43761 | Medium | 6.5 | 2026-09-14 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. M… |
CVE-2026-43741 | Medium | 5.5 | 2026-09-14 | A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be ab… |
CVE-2026-43737 | Medium | 5.5 | 2026-09-14 | An authorization issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, mac… |
CVE-2026-43719 | Medium | 6.5 | 2026-09-14 | A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Mounti… |
CVE-2026-43696 | Medium | 5.3 | 2026-09-14 | An authorization issue was addressed with improved entitlement checks. This issue is fixed in macOS Golden Gate 27. An app may be able to capture Touch Bar con… |
CVE-2026-43695 | Medium | 5.5 | 2026-09-14 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, mac… |
CVE-2026-43690 | Medium | 4.7 | 2026-09-14 | A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A local user may be ab… |
CVE-2026-43687 | Medium | 6.5 | 2026-09-14 | The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe… |
CVE-2026-43677 | Medium | 6.5 | 2026-09-14 | An out-of-bounds write issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7… |
CVE-2026-43674 | Medium | 4.6 | 2026-09-14 | An authentication issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27. An attacker with physical access to an unloc… |
CVE-2026-43664 | Medium | 5.5 | 2026-09-14 | This issue was addressed with improved data protection. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequ… |
CVE-2026-28968 | Medium | 5.5 | 2026-09-14 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden G… |
CVE-2026-28966 | Medium | 4.3 | 2026-09-14 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden G… |
CVE-2026-28937 | Medium | 5.5 | 2026-09-14 | This issue was addressed through improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to access sensitive user data. |
CVE-2026-28934 | Medium | 6.5 | 2026-09-14 | A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Mounting a ma… |
CVE-2026-28933 | Medium | 5.5 | 2026-09-14 | A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An ap… |
CVE-2026-28899 | Medium | 5.5 | 2026-09-14 | A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.6, macOS Tahoe 26.7. An app m… |
CVE-2026-28836 | Medium | 6.1 | 2026-09-14 | A correctness issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.8.8. An attacker with physical access may be able to silently pe… |
CVE-2026-19280 | Medium | 5.2 | 2026-09-14 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a denial of service as a result of a buffer overflow in a PASE process. An authenticated attacker could leverage this… |
CVE-2026-19273 | Medium | 5.4 | 2026-09-14 | IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6_2, 6.2.1.0 - 6.2.1.2, 6.2.2.0 - 6.2.2.1 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6_2, 6.2.1.0 -… |
CVE-2026-18069 | Medium | 6.0 | 2026-09-14 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain ownership of arbitrary file system objects due to a time-of-check to time-of-use (TOCTOU) r… |
CVE-2026-14277 | Medium | 6.3 | 2026-09-14 | IBM i Access Family 1.1.2.0 through 1.1.9.15 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to i… |
CVE-2026-14276 | Medium | 6.3 | 2026-09-14 | IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could allow an authenticated user to execute arbitrary commands with normal user pri… |
CVE-2026-14275 | Medium | 6.3 | 2026-09-14 | IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could allow an authenticated user to execute arbitrary commands with normal user pri… |
CVE-2026-13277 | Medium | 4.7 | 2026-09-14 | IBM Verify Identity Access could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a speciall… |
CVE-2026-13276 | Medium | 6.1 | 2026-09-14 | IBM Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and IBM Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001 and IBM Verify Identity… |
CVE-2026-13272 | Medium | 5.4 | 2026-09-14 | IBM Verify Identity Access is missing origin validation which could allow a remote attacker to perform operations as the victim and potentially launch further… |
CVE-2026-12767 | Medium | 6.5 | 2026-09-14 | IBM Langflow OSS 1.0.0 through 1.11.5 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requ… |
CVE-2026-12766 | Medium | 5.4 | 2026-09-14 | IBM Langflow OSS 1.0.0 through 1.11.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized reques… |
CVE-2026-12765 | Medium | 6.5 | 2026-09-14 | IBM Langflow OSS 1.0.0 through 1.10.2 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requ… |
CVE-2026-12763 | Medium | 4.2 | 2026-09-14 | IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due to improper cache key isolation in… |
CVE-2026-90816 | Medium | 4.3 | 2026-09-14 | A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Perfor… |
CVE-2026-90815 | Medium | 6.3 | 2026-09-14 | A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convo… |
CVE-2026-90814 | Medium | 6.3 | 2026-09-14 | A flaw has been found in cosmicstack-labs mercury-agent up to 1.1.13. Affected by this vulnerability is the function githubRequest of the file src/utils/github… |
CVE-2026-90813 | Medium | 4.3 | 2026-09-14 | A vulnerability was detected in cosmicstack-labs mercury-agent up to 1.1.13. Affected is the function checkShellCommand of the file src/capabilities/permission… |
CVE-2026-73497 | Medium | 6.5 | 2026-09-14 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). From 0.17.0 until 0.22.0, validate_url_for_ssrf resolves t… |
CVE-2026-55244 | Medium | 5.0 | 2026-09-14 | ASTEVAL is an evaluator of Python expressions and statements. Prior to 1.0.9, FROM_PY in asteval/astutils.py exposes BaseException, SystemExit, KeyboardInterru… |
CVE-2026-55093 | Medium | 6.1 | 2026-09-14 | Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.16, 0.22.2, and 0.23.1, tract-nnef uses unchecked usize multi… |
CVE-2026-54247 | Medium | 4.3 | 2026-09-14 | Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.22, Handler in dataclients/kubernetes/admission/admission.go passes the body… |
CVE-2026-54246 | Medium | 5.7 | 2026-09-14 | Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.13, the routesrv component serves cluster-wide control-plane data without ap… |
CVE-2026-53717 | Medium | 6.5 | 2026-09-14 | Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, internal/wa… |
CVE-2026-18251 | Medium | 4.3 | 2026-09-14 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper validation of the WebSocket origin. |
CVE-2026-18065 | Medium | 5.3 | 2026-09-14 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to gain access to sensitive information through session IP binding bypass in Navigat… |
CVE-2026-17628 | Medium | 5.4 | 2026-09-14 | IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to change the password of an account due to improper authentication. |
CVE-2026-17463 | Medium | 6.5 | 2026-09-14 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker… |
CVE-2026-17047 | Medium | 5.4 | 2026-09-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to improper request validation. |
CVE-2026-16702 | Medium | 6.5 | 2026-09-14 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker… |
CVE-2026-16435 | Medium | 5.9 | 2026-09-14 | IBM WebSphere Application Server 9.0, and 8.5 is affected by an authentication bypass vulnerability when using XD or Intelligent-Management features. |
CVE-2026-16189 | Medium | 4.8 | 2026-09-14 | IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log. |
CVE-2026-16188 | Medium | 5.3 | 2026-09-14 | IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log. |
CVE-2026-16187 | Medium | 6.5 | 2026-09-14 | IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication and obtain sensitive information by sending a crafted unau… |
CVE-2026-16186 | Medium | 5.4 | 2026-09-14 | IBM WebSphere Application Server 9.0, and 8.5 is affected by a reflected cross-site scripting vulnerability. |
CVE-2026-16185 | Medium | 6.4 | 2026-09-14 | IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication on an admin console servlet. |
CVE-2026-16148 | Medium | 4.6 | 2026-09-14 | The ITE it82xx2 USB device-controller driver initialized its bus-suspend detection work with k_work_init_delayable(&priv->suspended_work, suspended_handler) in… |
CVE-2026-16147 | Medium | 6.8 | 2026-09-14 | The ITE IT82xx2 USB device-controller driver (drivers/usb/udc/udc_it82xx2.c) mishandles multi-packet OUT transfers on non-control endpoints. In work_handler_ou… |
CVE-2026-15924 | Medium | 5.9 | 2026-09-14 | Zephyr's TLS socket layer in subsys/net/lib/sockets/sockets_tls.c keeps a single process-global array, client_cache, of cached client sessions that is shared b… |
CVE-2026-15887 | Medium | 5.4 | 2026-09-14 | IBM WebSphere Application Server 9.0, and 8.5 is affected by blind server-side request forgery when processing SOAP requests. |
CVE-2026-15634 | Medium | 6.5 | 2026-09-14 | IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsi… |
CVE-2026-15412 | Medium | 6.5 | 2026-09-14 | IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty could allow a remote attacker to conduct phishing attacks, using a… |
CVE-2026-15396 | Medium | 6.5 | 2026-09-14 | IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsi… |
CVE-2026-90812 | Medium | 4.3 | 2026-09-14 | A security vulnerability has been detected in cosmicstack-labs mercury-agent up to 1.2.0. This impacts the function checkShellCommand of the file src/capabilit… |
CVE-2026-90810 | Medium | 6.3 | 2026-09-14 | A security flaw has been discovered in cosmicstack-labs mercury-agent up to 1.1.13. The impacted element is the function PermissionManager.checkShellCommand of… |
CVE-2026-90808 | Medium | 6.3 | 2026-09-14 | A vulnerability was determined in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool._guard_command/ExecTool._spawn of the file nanobot/agent/tools/s… |
CVE-2026-89021 | Medium | 6.9 | 2026-09-14 | MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files… |
CVE-2026-89020 | Medium | 4.3 | 2026-09-14 | MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder fun… |
CVE-2026-82519 | Medium | 4.3 | 2026-09-14 | Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attacker… |
CVE-2026-19543 | Medium | 6.2 | 2026-09-14 | IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 performs input validation exclusively on the client side an… |
CVE-2026-18515 | Medium | 4.3 | 2026-09-14 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to place files into the file system with Navigator for i when they should be blocked b… |
CVE-2026-18151 | Medium | 4.2 | 2026-09-14 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition during the WebSocket handshake… |
CVE-2026-15893 | Medium | 6.5 | 2026-09-14 | net_if_ipv6_calc_reachable_time() in subsys/net/ip/net_if.c derives a randomized ND reachable time from ipv6->base_reachable_time as min_reachable + sys_rand32… |
CVE-2026-91081 | Medium | 5.8 | 2026-09-14 | Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by… |
CVE-2026-91021 | Medium | 5.4 | 2026-09-14 | Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting (XSS) vulnerability in the share renderer for webView notes due to improper… |
CVE-2026-90807 | Medium | 6.3 | 2026-09-14 | A vulnerability was found in nanocoai NanoClaw up to 2.1.17. This issue affects the function forwardAttachedFiles of the file src/modules/agent-to-agent/agent-… |
CVE-2026-90806 | Medium | 6.3 | 2026-09-14 | A vulnerability has been found in DjangoCRM django-crm up to 1.2. This vulnerability affects the function BulkUpdateCasesView of the file backend/cases/bulk_vi… |
CVE-2026-57581 | Medium | 5.3 | 2026-09-14 | DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, applications with configured file upload stor… |
CVE-2026-57570 | Medium | 6.5 | 2026-09-14 | backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administratio… |
CVE-2026-55847 | Medium | 6.1 | 2026-09-14 | Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the ansi.js helper at allure-generator/src/main/jav… |
CVE-2026-55846 | Medium | 6.2 | 2026-09-14 | Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the HTTP server started by allure serve and allure… |
CVE-2026-55832 | Medium | 6.1 | 2026-09-14 | Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.17, 0.22.3, and 0.23.2, the tract-onnx crate passes the attac… |
CVE-2026-54723 | Medium | 6.5 | 2026-09-14 | devpi is a Python package index staging server and packaging, testing, and release tool. Prior to 6.20.2 and 7.0.0b3, a server configured with the primary or d… |
CVE-2026-54181 | Medium | 5.4 | 2026-09-14 | backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administratio… |
CVE-2026-54177 | Medium | 6.6 | 2026-09-14 | backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administratio… |
CVE-2026-54176 | Medium | 6.5 | 2026-09-14 | backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administratio… |
CVE-2026-50157 | Medium | 6.5 | 2026-09-14 | Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate() and Authorizer::suppo… |
CVE-2026-47256 | Medium | 5.3 | 2026-09-14 | OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry d… |