Medium-severity CVEs (page 40)
Page 40 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-69318 | Medium | 5.5 | 2026-09-08 | Out-of-bounds read in Windows Imaging Component allows an authorized attacker to disclose information locally. |
CVE-2026-69317 | Medium | 5.7 | 2026-09-08 | Out-of-bounds read in Remote Desktop Client allows an authorized attacker to disclose information over a network. |
CVE-2026-69316 | Medium | 4.7 | 2026-09-08 | Buffer over-read in Windows Overlay Filter allows an authorized attacker to disclose information locally. |
CVE-2026-69315 | Medium | 5.5 | 2026-09-08 | Exposure of sensitive system information to an unauthorized control sphere in Windows License Manager allows an authorized attacker to disclose information loc… |
CVE-2026-69308 | Medium | 5.5 | 2026-09-08 | Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally. |
CVE-2026-69304 | Medium | 5.9 | 2026-09-08 | Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2026-69303 | Medium | 5.5 | 2026-09-08 | Out-of-bounds read in Push Message Routing Service allows an authorized attacker to disclose information locally. |
CVE-2026-69297 | Medium | 6.5 | 2026-09-08 | Storing passwords in a recoverable format in Windows DHCP Server allows an authorized attacker to disclose information over a network. |
CVE-2026-69294 | Medium | 5.5 | 2026-09-08 | Generation of error message containing sensitive information in Microsoft COM for Windows allows an authorized attacker to disclose information locally. |
CVE-2026-69288 | Medium | 5.5 | 2026-09-08 | Use of uninitialized resource in Windows GDI+ allows an authorized attacker to disclose information locally. |
CVE-2026-69286 | Medium | 5.5 | 2026-09-08 | Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to disclose information locally. |
CVE-2026-69267 | Medium | 6.5 | 2026-09-08 | Insufficient granularity of access control in Windows Connected User Experiences and Telemetry allows an authorized attacker to disclose information locally. |
CVE-2026-68898 | Medium | 6.5 | 2026-09-08 | Out-of-bounds read in Windows iSCSI allows an unauthorized attacker to deny service over a network. |
CVE-2026-68895 | Medium | 5.5 | 2026-09-08 | Numeric truncation error in Internet Storage Name Service allows an authorized attacker to disclose information locally. |
CVE-2026-68891 | Medium | 4.7 | 2026-09-08 | Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally. |
CVE-2026-68886 | Medium | 5.5 | 2026-09-08 | Use after free in Windows Network Connection Broker allows an authorized attacker to disclose information locally. |
CVE-2026-68881 | Medium | 5.5 | 2026-09-08 | Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally. |
CVE-2026-68874 | Medium | 5.7 | 2026-09-08 | Out-of-bounds read in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information over a network. |
CVE-2026-68873 | Medium | 5.5 | 2026-09-08 | Insertion of sensitive information into log file in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information local… |
CVE-2026-68852 | Medium | 5.5 | 2026-09-08 | Use of uninitialized resource in Microsoft Account allows an authorized attacker to disclose information locally. |
CVE-2026-68851 | Medium | 5.5 | 2026-09-08 | Buffer over-read in Windows NTFS allows an authorized attacker to disclose information locally. |
CVE-2026-68849 | Medium | 4.7 | 2026-09-08 | Out-of-bounds read in Windows Bluetooth Port Driver allows an authorized attacker to disclose information locally. |
CVE-2026-68843 | Medium | 5.5 | 2026-09-08 | Use after free in Microsoft Office Word allows an authorized attacker to disclose information locally. |
CVE-2026-68842 | Medium | 5.5 | 2026-09-08 | Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service Module allows an authorized attacker to disclose information… |
CVE-2026-68833 | Medium | 6.8 | 2026-09-08 | Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code with a physical attack. |
CVE-2026-68831 | Medium | 5.5 | 2026-09-08 | Files or directories accessible to external parties in Windows Defender Firewall Service allows an authorized attacker to disclose information locally. |
CVE-2026-68830 | Medium | 5.5 | 2026-09-08 | Improper link resolution before file access ('link following') in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to disclose… |
CVE-2026-68785 | Medium | 4.9 | 2026-09-08 | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. |
CVE-2026-68784 | Medium | 6.5 | 2026-09-08 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-68781 | Medium | 6.5 | 2026-09-08 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-68780 | Medium | 6.5 | 2026-09-08 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-68779 | Medium | 6.5 | 2026-09-08 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-68778 | Medium | 6.5 | 2026-09-08 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-68777 | Medium | 6.5 | 2026-09-08 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-68776 | Medium | 6.5 | 2026-09-08 | Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-67648 | Medium | 6.5 | 2026-09-08 | Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-67645 | Medium | 6.5 | 2026-09-08 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-67641 | Medium | 6.5 | 2026-09-08 | Integer overflow or wraparound in SQL Server allows an authorized attacker to deny service over a network. |
CVE-2026-67633 | Medium | 6.5 | 2026-09-08 | Out-of-bounds read in SQL Server allows an authorized attacker to deny service over a network. |
CVE-2026-67630 | Medium | 6.5 | 2026-09-08 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-67629 | Medium | 6.5 | 2026-09-08 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-67624 | Medium | 6.5 | 2026-09-08 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-67393 | Medium | 6.5 | 2026-09-08 | Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-67390 | Medium | 6.5 | 2026-09-08 | Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-67389 | Medium | 6.5 | 2026-09-08 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-67386 | Medium | 6.5 | 2026-09-08 | Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-67383 | Medium | 6.5 | 2026-09-08 | Generation of error message containing sensitive information in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-67369 | Medium | 6.5 | 2026-09-08 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-66816 | Medium | 6.5 | 2026-09-08 | Insufficient logging in SQL Server allows an authorized attacker to bypass a security feature over a network. |
CVE-2026-65812 | Medium | 6.8 | 2026-09-08 | Insertion of sensitive information into sent data in Microsoft Teams for Android allows an authorized attacker to disclose information over a network. |
CVE-2026-64918 | Medium | 6.5 | 2026-09-08 | Insufficiently protected credentials in Microsoft Office allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-62801 | Medium | 6.5 | 2026-09-08 | Improper limitation of a pathname to a restricted directory ('path traversal') in Windows PowerShell allows an unauthorized attacker to bypass a security featu… |
CVE-2026-62762 | Medium | 6.5 | 2026-09-08 | Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network. |
CVE-2026-58649 | Medium | 6.5 | 2026-09-08 | Origin validation error in .NET allows an unauthorized attacker to disclose information over a network. |
CVE-2026-54611 | Medium | 5.5 | 2026-09-08 | InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution (RCE) issue that allows remote authentica… |
CVE-2026-86668 | Medium | 4.3 | 2026-09-08 | A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15. The impacted element is the function uploadFile of the file controllers/pic.p… |
CVE-2026-86667 | Medium | 4.7 | 2026-09-08 | A weakness has been identified in aircheng-org iWebShop-5 up to 5.15. The affected element is the function member_list of the file controllers/member.php. This… |
CVE-2026-84391 | Medium | 6.5 | 2026-09-08 | A use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 through 7.6.6 may allow attacker to denial of service via <insert attack vector h… |
CVE-2026-84386 | Medium | 5.1 | 2026-09-08 | A unverified ownership vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2 all versions may allow attacker to improper acc… |
CVE-2026-84385 | Medium | 5.4 | 2026-09-08 | A improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.6, FortiSOAR PaaS 7.5.0 through 7.5.3, FortiSOAR PaaS 7.4 all versions, Fo… |
CVE-2026-82076 | Medium | 6.5 | 2026-09-08 | An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/write privileges to byp… |
CVE-2026-82074 | Medium | 6.5 | 2026-09-08 | MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specia… |
CVE-2026-82073 | Medium | 6.5 | 2026-09-08 | A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization check… |
CVE-2026-82070 | Medium | 6.5 | 2026-09-08 | A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected… |
CVE-2026-82068 | Medium | 6.5 | 2026-09-08 | A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially crafte… |
CVE-2026-82066 | Medium | 4.3 | 2026-09-08 | A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privilege… |
CVE-2026-82065 | Medium | 6.5 | 2026-09-08 | A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a persisten… |
CVE-2026-82063 | Medium | 5.3 | 2026-09-08 | A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cause a denial of service. Under specific… |
CVE-2026-82062 | Medium | 5.5 | 2026-09-08 | A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by… |
CVE-2026-82060 | Medium | 5.4 | 2026-09-08 | In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operat… |
CVE-2026-82059 | Medium | 5.3 | 2026-09-08 | An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to interna… |
CVE-2026-82058 | Medium | 6.5 | 2026-09-08 | A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. When a BSON… |
CVE-2026-82057 | Medium | 6.5 | 2026-09-08 | A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom… |
CVE-2026-82056 | Medium | 5.3 | 2026-09-08 | A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under certain concurrent i… |
CVE-2026-82055 | Medium | 6.5 | 2026-09-08 | A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due to a null pointer dereference. When a specially crafted Ge… |
CVE-2026-82054 | Medium | 6.5 | 2026-09-08 | A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially craft… |
CVE-2026-82052 | Medium | 6.5 | 2026-09-08 | The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod). Under certain spe… |
CVE-2026-52307 | Medium | 5.4 | 2026-09-08 | An authenticated stored cross-site scripting (XSS) vulnerability in the Column Management component of ClassCMS 1CMS v5.6 allows attackers to execute arbitrary… |
CVE-2026-22575 | Medium | 4.9 | 2026-09-08 | An improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.10, FortiManager 7.2 all versions, FortiM… |
CVE-2026-86853 | Medium | 4.3 | 2026-09-08 | A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS tem… |
CVE-2026-86737 | Medium | 4.3 | 2026-09-08 | snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/{asset}/barcode endpoint. Authenticated attackers can iterate asse… |
CVE-2026-86736 | Medium | 4.3 | 2026-09-08 | snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling that allows authenticated users to corrupt the assets.reques… |
CVE-2026-86735 | Medium | 5.0 | 2026-09-08 | snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUrl validation rule that fails to detect IPv6 transition addr… |
CVE-2026-86734 | Medium | 6.5 | 2026-09-08 | Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/{acceptance} endpoint, allowing authenticated users to submit… |
CVE-2026-86731 | Medium | 6.5 | 2026-09-08 | Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser (the users/activate-user action). While t… |
CVE-2026-86726 | Medium | 6.5 | 2026-09-08 | AVideo through 29.0 contains an information disclosure vulnerability in restreamsActive.json.php that allows authenticated streamers to enumerate source stream… |
CVE-2026-86724 | Medium | 6.5 | 2026-09-08 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php tha… |
CVE-2026-86719 | Medium | 5.4 | 2026-09-08 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master) contains a cross-site request forgery vulnerability in the CustomizeUser plugin en… |
CVE-2026-79573 | Medium | 6.5 | 2026-09-08 | L-ONE v1.0.0 was discovered to contain multiple SQL injection vulnerabilities in the /attachment/getBusinessUploadList component via the busid, id, and taskid… |
CVE-2026-56101 | Medium | 5.3 | 2026-09-08 | OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211_michael_mic_failure() function within sys/net80211/ieee80211_crypt… |
CVE-2026-84282 | Medium | 6.5 | 2026-09-08 | A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/addres… |
CVE-2026-12387 | Medium | 5.1 | 2026-09-08 | Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows… |
CVE-2026-12285 | Medium | 4.0 | 2026-09-08 | Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows… |
CVE-2026-11891 | Medium | 5.1 | 2026-09-08 | Use After Free vulnerability in Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user proces… |
CVE-2026-0001 | Medium | 4.4 | 2026-09-08 | Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows… |
CVE-2026-79379 | Medium | 6.5 | 2026-09-08 | A buffer overflow in the SBC_DecodeFrames() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier and fixed in v.5.0 allows att… |
CVE-2026-78838 | Medium | 6.5 | 2026-09-08 | A reflected cross-site scripting (XSS) vulnerability in the grid_datasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary Javasc… |
CVE-2026-73321 | Medium | 6.5 | 2026-09-08 | XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authenticated attackers to cause persistent denial of s… |
CVE-2026-73320 | Medium | 6.1 | 2026-09-08 | XenForo before 2.3.13 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private unfurl records… |
CVE-2026-73319 | Medium | 6.1 | 2026-09-08 | XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allows unauthenticated attackers to execute arbitrary… |