Medium-severity CVEs (page 33)
Page 33 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-15690 | Medium | 6.8 | 2026-09-09 | The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it gener… |
CVE-2026-87737 | Medium | 5.9 | 2026-09-09 | An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml. There is a timing side channel for NIST elliptic-curve scalar multiplication: t… |
CVE-2026-87736 | Medium | 4.3 | 2026-09-09 | An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml. There is an EC public key out-of-bounds read for compressed points. |
CVE-2026-87735 | Medium | 4.3 | 2026-09-09 | An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a small message during RSA decryption or… |
CVE-2026-87733 | Medium | 6.2 | 2026-09-09 | An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions {P256,P384,P521}.Dsa.pub_of_octets accept 0x00, the encodi… |
CVE-2026-87732 | Medium | 6.2 | 2026-09-09 | An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM.authenticate_decrypt_into and Chacha20.authenticate_decrypt_into funct… |
CVE-2026-21113 | Medium | 5.5 | 2026-09-09 | Improper export of android application components in Visual Voicemail prior to version 20.1.00.05 allows local attackers to initiate call without proper permis… |
CVE-2026-21112 | Medium | 5.5 | 2026-09-09 | Improper input validation in Samsung Tips prior to Android 17 allows local attackers to launch arbitrary activity with Samsung Tips privilege. User interaction… |
CVE-2026-21108 | Medium | 5.5 | 2026-09-09 | Improper export of android application components in Bixby Touch prior to version 4.3.01.17 allows local attackers to access sensitive information. |
CVE-2026-21107 | Medium | 5.5 | 2026-09-09 | Out-of-bounds write in Samsung Notes prior to version 4.4.45.5 allows local attackers to write out-of-bounds memory. |
CVE-2026-21105 | Medium | 5.5 | 2026-09-09 | Improper access control in Collection prior to version 1.0.1.14 in Android 15 and 2.0.02.7 in Android 16 allows local attackers to access sensitive information. |
CVE-2026-21104 | Medium | 6.7 | 2026-09-09 | Heap-based buffer overflow in KnoxVault trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code. |
CVE-2026-21103 | Medium | 6.1 | 2026-09-09 | Path traversal in GalaxyDiagnostics prior to SMR Sep-2026 Release 1 allows physical attackers to access files with system privilege. |
CVE-2026-21102 | Medium | 6.7 | 2026-09-09 | Use after free in DualDAR prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code with root privilege. |
CVE-2026-21101 | Medium | 6.7 | 2026-09-09 | Improper input validation in DualDAR driver prior to SMR Sep-2026 Release 1 allows local privileged attackers to potentially execute arbitrary code with root p… |
CVE-2026-21099 | Medium | 5.5 | 2026-09-09 | Improper access control in SettingsProvider prior to SMR Sep-2026 Release 1 allows local attackers to access sensitive information. |
CVE-2026-21098 | Medium | 6.1 | 2026-09-09 | Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allows local attackers to establish a connection with the PC without proper user int… |
CVE-2026-21097 | Medium | 6.7 | 2026-09-09 | Improper authentication in ActivityTaskManagerService prior to SMR Sep-2026 Release 1 allows local privileged attackers to launch arbitrary activity. |
CVE-2026-21093 | Medium | 6.7 | 2026-09-09 | Stack-based buffer overflow in PROCA trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to write out-of-bounds memory. |
CVE-2026-21092 | Medium | 5.3 | 2026-09-09 | Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to create image files with system server privilege. |
CVE-2026-21085 | Medium | 6.7 | 2026-09-09 | Out-of-bounds write in Keymaster trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to write out-of-bounds memory. |
CVE-2026-19945 | Medium | 6.4 | 2026-09-09 | The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 2.2… |
CVE-2026-11821 | Medium | 5.4 | 2026-09-09 | The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass in all versions up… |
CVE-2026-81647 | Medium | 5.3 | 2026-09-09 | Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-81646 | Medium | 5.9 | 2026-09-09 | Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-81644 | Medium | 4.3 | 2026-09-09 | DoS vulnerability in the preview service module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-7804 | Medium | 6.1 | 2026-09-09 | The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpf_fid' parameter in all versions up t… |
CVE-2026-77187 | Medium | 6.4 | 2026-09-09 | The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes in a… |
CVE-2026-77186 | Medium | 6.4 | 2026-09-09 | The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode Attribute in all versions… |
CVE-2026-75966 | Medium | 6.4 | 2026-09-09 | The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter in all ver… |
CVE-2026-57825 | Medium | 5.7 | 2026-09-09 | In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files. |
CVE-2026-49313 | Medium | 5.5 | 2026-09-09 | Permission control vulnerability in the app lock module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-49312 | Medium | 4.0 | 2026-09-09 | Permission control vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-49311 | Medium | 6.2 | 2026-09-09 | Permission control vulnerability in the event notification module.Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-49309 | Medium | 4.8 | 2026-09-09 | Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-41987 | Medium | 6.2 | 2026-09-09 | Permission control vulnerability in the app management module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-19944 | Medium | 4.9 | 2026-09-09 | The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneo_reward' Post Meta in all versions up to, and including, 2.2.1 due to… |
CVE-2026-19800 | Medium | 4.9 | 2026-09-09 | The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to SQL Injection via the 'status' paramet… |
CVE-2026-19797 | Medium | 6.1 | 2026-09-09 | The User Access Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab_group_section' parameter in all versions up to, and i… |
CVE-2026-11363 | Medium | 6.6 | 2026-09-09 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including… |
CVE-2026-87073 | Medium | 6.5 | 2026-09-09 | Tanium addressed an improper access controls vulnerability in Comply. |
CVE-2026-87048 | Medium | 5.4 | 2026-09-09 | Tanium addressed an improper access controls vulnerability in Comply. |
CVE-2026-87047 | Medium | 6.3 | 2026-09-09 | Tanium addressed an improper access controls vulnerability in Comply. |
CVE-2026-87046 | Medium | 4.3 | 2026-09-09 | Tanium addressed an improper access controls vulnerability in Comply. |
CVE-2026-87037 | Medium | 5.4 | 2026-09-09 | Tanium addressed an improper access controls vulnerability in Comply. |
CVE-2026-87035 | Medium | 4.3 | 2026-09-09 | Tanium addressed an information disclosure vulnerability in Comply. |
CVE-2026-87033 | Medium | 5.4 | 2026-09-09 | Tanium addressed an improper access controls vulnerability in Comply. |
CVE-2026-87032 | Medium | 4.3 | 2026-09-09 | Tanium addressed an information disclosure vulnerability in Tanium Server. |
CVE-2026-87025 | Medium | 5.4 | 2026-09-09 | Tanium addressed an improper access controls vulnerability in Comply. |
CVE-2026-87019 | Medium | 4.3 | 2026-09-09 | Tanium addressed an improper access controls vulnerability in Comply. |
CVE-2026-14892 | Medium | 4.3 | 2026-09-09 | Tanium addressed an improper access controls vulnerability in Tanium Server. |
CVE-2026-14505 | Medium | 6.6 | 2026-09-09 | Tanium addressed a path traversal vulnerability in Tanium Data Service. |
CVE-2026-13709 | Medium | 6.4 | 2026-09-09 | The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'iq_tree_tree_chart_template' Widget Setti… |
CVE-2026-12956 | Medium | 5.3 | 2026-09-09 | The WP Event Solution (Eventin) plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the create_item() hand… |
CVE-2026-87724 | Medium | 6.5 | 2026-09-09 | Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attackers to cause a denial of service (crash)… |
CVE-2026-87083 | Medium | 5.5 | 2026-09-09 | A weakness has been identified in tile-ai tilelang up to 0.1.14. This impacts the function KernelCache._load_kernel_from_disk of the file tilelang/cache/kernel… |
CVE-2026-87658 | Medium | 4.3 | 2026-09-09 | Information leak in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain cross-origin data via… |
CVE-2026-87656 | Medium | 5.4 | 2026-09-09 | Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted… |
CVE-2026-87655 | Medium | 5.4 | 2026-09-09 | Clickjacking in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HT… |
CVE-2026-87653 | Medium | 5.4 | 2026-09-09 | UI misrepresentation in FullScreen in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page… |
CVE-2026-87651 | Medium | 4.3 | 2026-09-09 | Incorrect authorization in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromi… |
CVE-2026-87649 | Medium | 5.4 | 2026-09-09 | UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restr… |
CVE-2026-87645 | Medium | 5.4 | 2026-09-09 | Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted… |
CVE-2026-87642 | Medium | 4.3 | 2026-09-09 | Uninitialized resource in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium… |
CVE-2026-87641 | Medium | 4.2 | 2026-09-09 | Race condition in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chro… |
CVE-2026-87640 | Medium | 6.1 | 2026-09-09 | Out of bounds read in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read… |
CVE-2026-87635 | Medium | 5.4 | 2026-09-09 | UI misrepresentation in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium secu… |
CVE-2026-87632 | Medium | 4.3 | 2026-09-09 | Cross-site scripting in SanitizerAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Ch… |
CVE-2026-87631 | Medium | 6.5 | 2026-09-09 | Missing authorization in DOM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially leak sensitive information via a crafted HTML pag… |
CVE-2026-87630 | Medium | 4.3 | 2026-09-09 | Integer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromi… |
CVE-2026-87629 | Medium | 6.5 | 2026-09-09 | Incorrect authorization in Sources in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to leak sensitive informatio… |
CVE-2026-87627 | Medium | 6.5 | 2026-09-09 | Interpretation conflict in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass sys… |
CVE-2026-87626 | Medium | 6.5 | 2026-09-09 | Incorrect authorization in DeviceBoundSessionCredentials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via craf… |
CVE-2026-87624 | Medium | 4.2 | 2026-09-09 | UI misrepresentation in Passwords in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to s… |
CVE-2026-87623 | Medium | 6.5 | 2026-09-09 | Observable discrepancy in DOM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain sensitive information v… |
CVE-2026-87622 | Medium | 4.3 | 2026-09-09 | Missing authorization in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium… |
CVE-2026-87620 | Medium | 6.5 | 2026-09-09 | Observable discrepancy in SVG in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chrom… |
CVE-2026-87619 | Medium | 4.3 | 2026-09-09 | Observable discrepancy in Prefetch in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromi… |
CVE-2026-87615 | Medium | 5.4 | 2026-09-09 | Race condition in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted H… |
CVE-2026-87610 | Medium | 6.5 | 2026-09-09 | Incorrect authorization in Omnibox in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions into a privileged pag… |
CVE-2026-87605 | Medium | 5.3 | 2026-09-09 | Missing authorization in Contacts in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged soci… |
CVE-2026-87603 | Medium | 6.5 | 2026-09-09 | Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML p… |
CVE-2026-87602 | Medium | 4.7 | 2026-09-09 | Out of bounds read in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially read memory outside the sandbox via… |
CVE-2026-87600 | Medium | 6.5 | 2026-09-09 | Improper input validation in Safebrowsing in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypa… |
CVE-2026-87599 | Medium | 5.4 | 2026-09-09 | Improper input validation in Interstitials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chr… |
CVE-2026-87598 | Medium | 4.3 | 2026-09-09 | Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page… |
CVE-2026-87597 | Medium | 4.8 | 2026-09-09 | UI misrepresentation in CustomTabs in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to spoof address bar via a co-installed app… |
CVE-2026-87596 | Medium | 4.3 | 2026-09-09 | Out of bounds read in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chro… |
CVE-2026-87594 | Medium | 5.3 | 2026-09-09 | Incorrect authorization in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain se… |
CVE-2026-87593 | Medium | 6.5 | 2026-09-09 | Information leak in Editing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromiu… |
CVE-2026-87592 | Medium | 4.3 | 2026-09-09 | Out of bounds read in Tint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML p… |
CVE-2026-87591 | Medium | 6.5 | 2026-09-09 | Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted Chro… |
CVE-2026-87590 | Medium | 5.9 | 2026-09-09 | Improper input validation in Passwords in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially leak sensitive information via crafted… |
CVE-2026-87589 | Medium | 6.5 | 2026-09-09 | Incorrect authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass s… |
CVE-2026-87586 | Medium | 4.3 | 2026-09-09 | Out of bounds read in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chro… |
CVE-2026-87584 | Medium | 6.5 | 2026-09-09 | Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions into a privileged page… |
CVE-2026-87583 | Medium | 5.4 | 2026-09-09 | UI misrepresentation in Passwords in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page… |
CVE-2026-87580 | Medium | 6.5 | 2026-09-09 | Incorrect authorization in WebAppInstalls in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and levera… |
CVE-2026-87577 | Medium | 4.3 | 2026-09-09 | Incorrect authorization in Isolated in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy into a privileged page via a… |
CVE-2026-87575 | Medium | 5.4 | 2026-09-09 | Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restr… |