Medium-severity CVEs (page 35)
Page 35 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-13709 | Medium | 6.4 | 2026-09-09 | The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'iq_tree_tree_chart_template' Widget Setti… |
CVE-2026-12956 | Medium | 5.3 | 2026-09-09 | The WP Event Solution (Eventin) plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the create_item() hand… |
CVE-2026-87724 | Medium | 6.5 | 2026-09-09 | Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attackers to cause a denial of service (crash)… |
CVE-2026-87083 | Medium | 5.5 | 2026-09-09 | A weakness has been identified in tile-ai tilelang up to 0.1.14. This impacts the function KernelCache._load_kernel_from_disk of the file tilelang/cache/kernel… |
CVE-2026-87658 | Medium | 4.3 | 2026-09-09 | Information leak in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain cross-origin data via… |
CVE-2026-87656 | Medium | 5.4 | 2026-09-09 | Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted… |
CVE-2026-87655 | Medium | 5.4 | 2026-09-09 | Clickjacking in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HT… |
CVE-2026-87653 | Medium | 5.4 | 2026-09-09 | UI misrepresentation in FullScreen in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page… |
CVE-2026-87651 | Medium | 4.3 | 2026-09-09 | Incorrect authorization in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromi… |
CVE-2026-87649 | Medium | 5.4 | 2026-09-09 | UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restr… |
CVE-2026-87645 | Medium | 5.4 | 2026-09-09 | Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted… |
CVE-2026-87642 | Medium | 4.3 | 2026-09-09 | Uninitialized resource in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium… |
CVE-2026-87641 | Medium | 4.2 | 2026-09-09 | Race condition in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chro… |
CVE-2026-87640 | Medium | 6.1 | 2026-09-09 | Out of bounds read in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read… |
CVE-2026-87635 | Medium | 5.4 | 2026-09-09 | UI misrepresentation in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium secu… |
CVE-2026-87632 | Medium | 4.3 | 2026-09-09 | Cross-site scripting in SanitizerAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Ch… |
CVE-2026-87631 | Medium | 6.5 | 2026-09-09 | Missing authorization in DOM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially leak sensitive information via a crafted HTML pag… |
CVE-2026-87630 | Medium | 4.3 | 2026-09-09 | Integer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromi… |
CVE-2026-87629 | Medium | 6.5 | 2026-09-09 | Incorrect authorization in Sources in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to leak sensitive informatio… |
CVE-2026-87627 | Medium | 6.5 | 2026-09-09 | Interpretation conflict in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass sys… |
CVE-2026-87626 | Medium | 6.5 | 2026-09-09 | Incorrect authorization in DeviceBoundSessionCredentials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via craf… |
CVE-2026-87624 | Medium | 4.2 | 2026-09-09 | UI misrepresentation in Passwords in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to s… |
CVE-2026-87623 | Medium | 6.5 | 2026-09-09 | Observable discrepancy in DOM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain sensitive information v… |
CVE-2026-87622 | Medium | 4.3 | 2026-09-09 | Missing authorization in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium… |
CVE-2026-87620 | Medium | 6.5 | 2026-09-09 | Observable discrepancy in SVG in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chrom… |
CVE-2026-87619 | Medium | 4.3 | 2026-09-09 | Observable discrepancy in Prefetch in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromi… |
CVE-2026-87615 | Medium | 5.4 | 2026-09-09 | Race condition in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted H… |
CVE-2026-87610 | Medium | 6.5 | 2026-09-09 | Incorrect authorization in Omnibox in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions into a privileged pag… |
CVE-2026-87605 | Medium | 5.3 | 2026-09-09 | Missing authorization in Contacts in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged soci… |
CVE-2026-87603 | Medium | 6.5 | 2026-09-09 | Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML p… |
CVE-2026-87602 | Medium | 4.7 | 2026-09-09 | Out of bounds read in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially read memory outside the sandbox via… |
CVE-2026-87600 | Medium | 6.5 | 2026-09-09 | Improper input validation in Safebrowsing in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypa… |
CVE-2026-87599 | Medium | 5.4 | 2026-09-09 | Improper input validation in Interstitials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chr… |
CVE-2026-87598 | Medium | 4.3 | 2026-09-09 | Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page… |
CVE-2026-87597 | Medium | 4.8 | 2026-09-09 | UI misrepresentation in CustomTabs in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to spoof address bar via a co-installed app… |
CVE-2026-87596 | Medium | 4.3 | 2026-09-09 | Out of bounds read in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chro… |
CVE-2026-87594 | Medium | 5.3 | 2026-09-09 | Incorrect authorization in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain se… |
CVE-2026-87593 | Medium | 6.5 | 2026-09-09 | Information leak in Editing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromiu… |
CVE-2026-87592 | Medium | 4.3 | 2026-09-09 | Out of bounds read in Tint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML p… |
CVE-2026-87591 | Medium | 6.5 | 2026-09-09 | Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted Chro… |
CVE-2026-87590 | Medium | 5.9 | 2026-09-09 | Improper input validation in Passwords in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially leak sensitive information via crafted… |
CVE-2026-87589 | Medium | 6.5 | 2026-09-09 | Incorrect authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass s… |
CVE-2026-87586 | Medium | 4.3 | 2026-09-09 | Out of bounds read in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chro… |
CVE-2026-87584 | Medium | 6.5 | 2026-09-09 | Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions into a privileged page… |
CVE-2026-87583 | Medium | 5.4 | 2026-09-09 | UI misrepresentation in Passwords in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page… |
CVE-2026-87580 | Medium | 6.5 | 2026-09-09 | Incorrect authorization in WebAppInstalls in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and levera… |
CVE-2026-87577 | Medium | 4.3 | 2026-09-09 | Incorrect authorization in Isolated in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy into a privileged page via a… |
CVE-2026-87575 | Medium | 5.4 | 2026-09-09 | Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restr… |
CVE-2026-87574 | Medium | 4.3 | 2026-09-09 | Information leak in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chrom… |
CVE-2026-87573 | Medium | 4.3 | 2026-09-09 | Improper input validation in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Ch… |
CVE-2026-87571 | Medium | 5.4 | 2026-09-09 | Improper certificate validation in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin… |
CVE-2026-87568 | Medium | 4.3 | 2026-09-09 | Improper input validation in Chromium in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to spoof UI el… |
CVE-2026-87567 | Medium | 4.3 | 2026-09-09 | UI misrepresentation in UrlFormatting in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof address bar via… |
CVE-2026-87566 | Medium | 5.3 | 2026-09-09 | Observable discrepancy in Layout in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chro… |
CVE-2026-87565 | Medium | 6.5 | 2026-09-09 | Information leak in Passwords in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a crafted HTML… |
CVE-2026-87564 | Medium | 4.3 | 2026-09-09 | Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium sec… |
CVE-2026-87563 | Medium | 4.3 | 2026-09-09 | Origin validation error in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromi… |
CVE-2026-87562 | Medium | 4.3 | 2026-09-09 | Incorrect reference resolution in Accessibility in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to potentially spoof UI elements vi… |
CVE-2026-87561 | Medium | 4.3 | 2026-09-09 | Incorrect authorization in Web Authentication in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted Chrom… |
CVE-2026-87560 | Medium | 4.3 | 2026-09-09 | Missing authorization in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page… |
CVE-2026-87559 | Medium | 4.2 | 2026-09-09 | UI misrepresentation in UI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted H… |
CVE-2026-87557 | Medium | 4.3 | 2026-09-09 | Missing authorization in LocalNetworkAccess in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypas… |
CVE-2026-87556 | Medium | 4.3 | 2026-09-09 | Missing authorization in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page… |
CVE-2026-87555 | Medium | 4.7 | 2026-09-09 | Uninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to read memory outside the sandbox via a crafted… |
CVE-2026-87552 | Medium | 5.5 | 2026-09-09 | Missing authorization in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to obtain sensitive information vi… |
CVE-2026-87551 | Medium | 4.3 | 2026-09-09 | Improper certificate validation in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin po… |
CVE-2026-87550 | Medium | 4.3 | 2026-09-09 | Improper encoding or escaping of output in CSS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially bypass web origin policy via a… |
CVE-2026-87549 | Medium | 6.5 | 2026-09-09 | Incomplete cleanup in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restric… |
CVE-2026-87548 | Medium | 4.3 | 2026-09-09 | Improper state validation in Installer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTM… |
CVE-2026-87546 | Medium | 4.3 | 2026-09-09 | Incorrect type conversion or cast in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to bypass system access restricti… |
CVE-2026-87545 | Medium | 6.5 | 2026-09-09 | Information leak in Mobile in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to leak sensitive informat… |
CVE-2026-87543 | Medium | 4.3 | 2026-09-09 | Missing authorization in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolati… |
CVE-2026-87541 | Medium | 6.5 | 2026-09-09 | Information leak in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolat… |
CVE-2026-87540 | Medium | 5.4 | 2026-09-09 | Incorrect authorization in Isolated in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium s… |
CVE-2026-87538 | Medium | 4.2 | 2026-09-09 | Clickjacking in Input in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineeri… |
CVE-2026-87535 | Medium | 6.5 | 2026-09-09 | Information loss or omission in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions v… |
CVE-2026-87532 | Medium | 6.5 | 2026-09-09 | Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted… |
CVE-2026-87523 | Medium | 5.3 | 2026-09-09 | Race condition in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain sensitive information… |
CVE-2026-87522 | Medium | 6.5 | 2026-09-09 | Missing authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to potentially b… |
CVE-2026-87519 | Medium | 6.5 | 2026-09-09 | Incorrect authorization in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access… |
CVE-2026-87518 | Medium | 5.3 | 2026-09-09 | Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-87516 | Medium | 4.3 | 2026-09-09 | Observable discrepancy in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chro… |
CVE-2026-87515 | Medium | 6.5 | 2026-09-09 | Incorrect authorization in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access rest… |
CVE-2026-87513 | Medium | 6.5 | 2026-09-09 | Missing authorization in ControlledFrame in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system acces… |
CVE-2026-87511 | Medium | 4.3 | 2026-09-09 | Missing authorization in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension… |
CVE-2026-87508 | Medium | 4.3 | 2026-09-09 | Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chrom… |
CVE-2026-87507 | Medium | 5.4 | 2026-09-09 | UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a cr… |
CVE-2026-87503 | Medium | 6.5 | 2026-09-09 | Inappropriate implementation in Downloads in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypa… |
CVE-2026-87502 | Medium | 4.2 | 2026-09-09 | Confused deputy in Fullscreen in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social e… |
CVE-2026-87501 | Medium | 5.4 | 2026-09-09 | UI misrepresentation in Passwords in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium sec… |
CVE-2026-87497 | Medium | 4.3 | 2026-09-09 | Uninitialized resource in Codecs in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (… |
CVE-2026-87496 | Medium | 5.4 | 2026-09-09 | UI misrepresentation in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a craf… |
CVE-2026-87495 | Medium | 4.3 | 2026-09-09 | Information leak in Scroll in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to leak cross-origin data… |
CVE-2026-87493 | Medium | 6.5 | 2026-09-09 | Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access res… |
CVE-2026-87490 | Medium | 6.5 | 2026-09-09 | Information leak in Transactions Platform in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML… |
CVE-2026-87486 | Medium | 4.0 | 2026-09-09 | Clickjacking in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to spoof address bar via a co-installed app… |
CVE-2026-87484 | Medium | 5.4 | 2026-09-09 | UI misrepresentation in Geometry in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a cra… |
CVE-2026-87483 | Medium | 6.5 | 2026-09-09 | Incorrect authorization in Browser in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a c… |
CVE-2026-87482 | Medium | 5.9 | 2026-09-09 | Cleartext transmission of sensitive data in HttpsUpgrades in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker to leak sensitive informa… |
CVE-2026-87478 | Medium | 6.5 | 2026-09-09 | Observable discrepancy in Autofill in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (… |