Medium-severity CVEs (page 37)
Page 37 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-48308 | Medium | 5.9 | 2026-07-14 | Premiere Pro is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerab… |
CVE-2026-48125 | Medium | 5.3 | 2026-07-14 | UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expressio… |
CVE-2026-47979 | Medium | 5.5 | 2026-07-14 | Media Encoder is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerabili… |
CVE-2026-47475 | Medium | 6.2 | 2026-07-14 | NVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-compatible inference API where an attacker could trigger a reachable assertion in the sampler thread… |
CVE-2026-47470 | Medium | 6.2 | 2026-07-14 | NVIDIA TensorRT-LLM for any platform contains a vulnerability in the gRPC server chat API endpoint, where an attacker could cause CWE-20 by local attack. A suc… |
CVE-2026-24271 | Medium | 6.2 | 2026-07-14 | NVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-compatible inference API, where an attacker could cause allocation of GPU resources without limits o… |
CVE-2026-24259 | Medium | 6.4 | 2026-07-14 | NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause missing authentication for a critical function. A successful exploit of th… |
CVE-2026-24234 | Medium | 6.8 | 2026-07-14 | NVIDIA TensorRT-LLM for Linux contains a vulnerability in the multimodal media fetching functions, where a network-accessible attacker could cause server-side… |
CVE-2026-24227 | Medium | 5.3 | 2026-07-14 | NVIDIA TensorRT for contains a vulnerability where a user might cause a deserialization of untrusted data. A successful exploit of this vulnerability might lea… |
CVE-2026-24226 | Medium | 6.3 | 2026-07-14 | NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause improper control of code generation. A successful exploit of this vulnerab… |
CVE-2026-24220 | Medium | 6.4 | 2026-07-14 | NVIDIA TensorRT-LLM for any platform contains a vulnerability in visual gen server, where an attacker could cause an unsafe deserialization by unauthorized zer… |
CVE-2026-15778 | Medium | 6.5 | 2026-07-14 | Insufficient validation of untrusted input in Navigation in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer pr… |
CVE-2026-15775 | Medium | 6.5 | 2026-07-14 | Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Ch… |
CVE-2026-15771 | Medium | 5.3 | 2026-07-14 | Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker who had compromised the rende… |
CVE-2026-15770 | Medium | 6.5 | 2026-07-14 | Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to obtain potentially sensitive information from process memory via… |
CVE-2026-15768 | Medium | 6.5 | 2026-07-14 | Insufficient policy enforcement in HTML-in-Canvas in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same origin policy via a crafted… |
CVE-2026-15766 | Medium | 6.5 | 2026-07-14 | Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to obtain potentially sensitive information from process memory vi… |
CVE-2026-15749 | Medium | 5.3 | 2026-07-14 | A security flaw has been discovered in mastergo-design mastergo-magic-mcp up to 0.2.0. This issue affects the function execute of the file src/tools/get-c2d.ts… |
CVE-2026-50659 | Medium | 6.5 | 2026-07-14 | Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network. |
CVE-2026-48784 | Medium | 6.1 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, UrlGenerator::do… |
CVE-2026-48761 | Medium | 6.1 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlAttributeSani… |
CVE-2026-48760 | Medium | 6.1 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlSanitizer::pa… |
CVE-2026-48747 | Medium | 5.3 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.13 and 8.0.13, MailomatRequestParser::validateSi… |
CVE-2026-48371 | Medium | 5.4 | 2026-07-14 | Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts i… |
CVE-2026-48355 | Medium | 5.4 | 2026-07-14 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious… |
CVE-2026-48263 | Medium | 5.4 | 2026-07-14 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious… |
CVE-2026-48262 | Medium | 5.4 | 2026-07-14 | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM envi… |
CVE-2026-48261 | Medium | 5.4 | 2026-07-14 | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM envi… |
CVE-2026-48260 | Medium | 5.4 | 2026-07-14 | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM envi… |
CVE-2026-48257 | Medium | 5.4 | 2026-07-14 | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM envi… |
CVE-2026-48255 | Medium | 5.4 | 2026-07-14 | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM envi… |
CVE-2026-48254 | Medium | 5.4 | 2026-07-14 | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM envi… |
CVE-2026-48253 | Medium | 5.4 | 2026-07-14 | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM envi… |
CVE-2026-48038 | Medium | 5.3 | 2026-07-14 | joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception i… |
CVE-2026-48000 | Medium | 6.1 | 2026-07-14 | Adobe Commerce is affected by an Improper Redirect (Open Redirect) vulnerability that could result in a Security feature bypass. An attacker could construct a… |
CVE-2026-47999 | Medium | 4.8 | 2026-07-14 | Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts… |
CVE-2026-47998 | Medium | 5.9 | 2026-07-14 | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerab… |
CVE-2026-47997 | Medium | 5.9 | 2026-07-14 | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerab… |
CVE-2026-47996 | Medium | 6.8 | 2026-07-14 | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could lead to arbitrary file system read. A high-privileged attacker could exploit… |
CVE-2026-47481 | Medium | 6.5 | 2026-07-14 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an authentication bypass through an alternative path or channel… |
CVE-2026-47212 | Medium | 5.3 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, TwilioRequestParser::doP… |
CVE-2026-15714 | Medium | 6.5 | 2026-07-14 | An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The flaw exists in the soup_multipart_input_stream_read_headers() fu… |
CVE-2026-15713 | Medium | 5.9 | 2026-07-14 | A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termi… |
CVE-2026-5040 | Medium | 6.7 | 2026-07-14 | TP-Link Deco M5 v1 uses a weak password hashing mechanism to store user credentials. An attacker who obtains the password hash through system compromise or pr… |
CVE-2026-45755 | Medium | 5.3 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, MailtrapRequestParser::doParse()… |
CVE-2026-45754 | Medium | 5.3 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, the Mailjet mailer bridg… |
CVE-2026-45753 | Medium | 6.1 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlAttribu… |
CVE-2026-45072 | Medium | 5.4 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.4.24 until 6.4.40, 7.4.12, and 8.0.12, the development… |
CVE-2026-45070 | Medium | 6.5 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Componen… |
CVE-2026-45064 | Medium | 6.1 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlSanitiz… |
CVE-2026-15712 | Medium | 5.9 | 2026-07-14 | A heap buffer over-read vulnerability was discovered in libsoup's (versions: libsoup 3.0 to 3.7.0) HTTP/2 connection tracking framework. When the library proce… |
CVE-2026-58638 | Medium | 6.0 | 2026-07-14 | Missing cryptographic step in Windows Boot Loader allows an authorized attacker to bypass a security feature locally. |
CVE-2026-58547 | Medium | 5.5 | 2026-07-14 | Heap-based buffer overflow in Universal Plug and Play (upnp.dll) allows an authorized attacker to elevate privileges locally. |
CVE-2026-58546 | Medium | 6.5 | 2026-07-14 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. |
CVE-2026-58545 | Medium | 5.5 | 2026-07-14 | Improper access control in Windows Kernel allows an authorized attacker to bypass a security feature locally. |
CVE-2026-58543 | Medium | 6.3 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevat… |
CVE-2026-58539 | Medium | 6.5 | 2026-07-14 | Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network. |
CVE-2026-58535 | Medium | 6.5 | 2026-07-14 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. |
CVE-2026-58533 | Medium | 6.5 | 2026-07-14 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. |
CVE-2026-58528 | Medium | 6.8 | 2026-07-14 | Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical attack. |
CVE-2026-57982 | Medium | 6.5 | 2026-07-14 | Use of uninitialized resource in Windows RDP allows an authorized attacker to disclose information over a network. |
CVE-2026-57973 | Medium | 6.3 | 2026-07-14 | Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to perform tampering locally. |
CVE-2026-57095 | Medium | 6.2 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an unauthorized attacker to elevate privileges locally. |
CVE-2026-57085 | Medium | 5.5 | 2026-07-14 | Out-of-bounds read in Windows Print Spooler Components allows an authorized attacker to disclose information locally. |
CVE-2026-57084 | Medium | 5.5 | 2026-07-14 | Use of uninitialized resource in Windows File Explorer allows an unauthorized attacker to disclose information locally. |
CVE-2026-57083 | Medium | 5.5 | 2026-07-14 | Use of uninitialized resource in Microsoft Windows Codecs Library allows an unauthorized attacker to disclose information locally. |
CVE-2026-56649 | Medium | 5.9 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Network File System allows an unauthorized attacker to e… |
CVE-2026-56195 | Medium | 5.5 | 2026-07-14 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-56192 | Medium | 5.5 | 2026-07-14 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-56184 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an authorized attacker to disclose information locally. |
CVE-2026-56178 | Medium | 5.5 | 2026-07-14 | Time-of-check time-of-use (toctou) race condition in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally. |
CVE-2026-56168 | Medium | 6.5 | 2026-07-14 | Null pointer dereference in Windows SMB Server allows an authorized attacker to deny service over a network. |
CVE-2026-56157 | Medium | 5.4 | 2026-07-14 | Improper access control in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. |
CVE-2026-55898 | Medium | 6.1 | 2026-07-14 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-55145 | Medium | 6.3 | 2026-07-14 | Improper neutralization of special elements used in a command ('command injection') in Outlook Copilot allows an authorized attacker to perform tampering over… |
CVE-2026-55142 | Medium | 5.5 | 2026-07-14 | Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-55139 | Medium | 5.5 | 2026-07-14 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-55138 | Medium | 5.5 | 2026-07-14 | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-55135 | Medium | 4.6 | 2026-07-14 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-55124 | Medium | 5.5 | 2026-07-14 | Improper validation of specified type of input in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-55121 | Medium | 5.5 | 2026-07-14 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-55057 | Medium | 5.5 | 2026-07-14 | Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-55054 | Medium | 6.5 | 2026-07-14 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. |
CVE-2026-55051 | Medium | 6.5 | 2026-07-14 | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. |
CVE-2026-55050 | Medium | 5.5 | 2026-07-14 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-55047 | Medium | 5.5 | 2026-07-14 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-55046 | Medium | 5.5 | 2026-07-14 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-55042 | Medium | 5.5 | 2026-07-14 | Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-55035 | Medium | 5.5 | 2026-07-14 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-55030 | Medium | 4.6 | 2026-07-14 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-55028 | Medium | 5.5 | 2026-07-14 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-55027 | Medium | 5.5 | 2026-07-14 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-55026 | Medium | 6.2 | 2026-07-14 | Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-55023 | Medium | 5.5 | 2026-07-14 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-55020 | Medium | 4.6 | 2026-07-14 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-55019 | Medium | 4.6 | 2026-07-14 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-55016 | Medium | 4.6 | 2026-07-14 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-54126 | Medium | 6.5 | 2026-07-14 | Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network. |
CVE-2026-54116 | Medium | 6.5 | 2026-07-14 | Access of resource using incompatible type ('type confusion') in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-50690 | Medium | 5.5 | 2026-07-14 | Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally. |