Medium-severity CVEs (page 49)
Page 49 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-14386 | Medium | 6.5 | 2026-07-01 | Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2026-14384 | Medium | 6.5 | 2026-07-01 | Out of bounds read in ANGLE in Google Chrome on Windows prior to 150.0.7871.46 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Ch… |
CVE-2026-14381 | Medium | 6.5 | 2026-07-01 | Incorrect security UI in WebAppInstalls in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chro… |
CVE-2026-54712 | Medium | 5.3 | 2026-07-01 | OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.27.0, the RMI con… |
CVE-2026-54704 | Medium | 6.5 | 2026-07-01 | OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.28.0, the JDBC au… |
CVE-2026-54262 | Medium | 4.3 | 2026-07-01 | Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, a low-level user with the "Can submit transla… |
CVE-2026-54261 | Medium | 6.5 | 2026-07-01 | Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, due to a missing permission check on the imag… |
CVE-2026-54260 | Medium | 4.3 | 2026-07-01 | Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, an authenticated admin user can trigger expen… |
CVE-2026-54259 | Medium | 4.3 | 2026-07-01 | Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, the Documents and Images chooser's chosen end… |
CVE-2026-36911 | Medium | 5.5 | 2026-07-01 | A division-by-zero vulnerability in the CStreamSwitcherOutputPin::DecideBufferSize function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to ca… |
CVE-2026-36910 | Medium | 5.5 | 2026-07-01 | An access violation in the BaseSplitterFile::Read function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service (DoS) via… |
CVE-2026-36909 | Medium | 6.2 | 2026-07-01 | A NULL pointer dereference in the AP4_TkhdAtom::GetTrackId() function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Servic… |
CVE-2026-54786 | Medium | 5.0 | 2026-07-01 | Wasmtime is a runtime for WebAssembly. All versions prior to 24.0.10; versions 25.0.0 through those before 36.0.11; versions 37.0.0 through those before 44.0… |
CVE-2026-54720 | Medium | 5.4 | 2026-07-01 | Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. In versions prior to 6.2.2, the "Insert media from web" functionality in the CMS i… |
CVE-2026-14340 | Medium | 5.0 | 2026-07-01 | An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a user-to-server token scoped to a GitHub App installation to… |
CVE-2026-55688 | Medium | 4.0 | 2026-07-01 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In versions from 2.0.0 pr… |
CVE-2026-54164 | Medium | 6.5 | 2026-07-01 | API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. In versions prior to 4.1.30, 4.2.26 and 4.3.12, the serializer's AbstractItemN… |
CVE-2026-49858 | Medium | 5.9 | 2026-07-01 | API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. In versions from 2.6.0 prior to 4.1.29, 4.2.26, and 4.3.12, a missing isCacheK… |
CVE-2026-58517 | Medium | 4.3 | 2026-07-01 | Improper neutralization of input terminators vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Authentication Bypass. This iss… |
CVE-2026-58451 | Medium | 6.5 | 2026-07-01 | Horde IMP before 7.0.1 contains a path traversal vulnerability in lib/Compose.php that allows authenticated attackers to read arbitrary files from the server f… |
CVE-2026-55628 | Medium | 5.5 | 2026-07-01 | ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-26he, the `-concatenate` operation is… |
CVE-2026-55597 | Medium | 5.5 | 2026-07-01 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-26, an incorrect handling of arguments ca… |
CVE-2026-55595 | Medium | 4.7 | 2026-07-01 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when providing invalid… |
CVE-2026-55594 | Medium | 5.3 | 2026-07-01 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a missing depth check… |
CVE-2026-55577 | Medium | 5.9 | 2026-07-01 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a heap buffer overflow… |
CVE-2026-55510 | Medium | 5.5 | 2026-07-01 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when identifying an im… |
CVE-2026-53489 | Medium | 6.5 | 2026-07-01 | containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a check… |
CVE-2026-53467 | Medium | 5.3 | 2026-07-01 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, the MNG decoder contai… |
CVE-2026-53466 | Medium | 6.5 | 2026-07-01 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, an integer overflow in… |
CVE-2026-47262 | Medium | 5.5 | 2026-07-01 | containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a maliciously cra… |
CVE-2026-38142 | Medium | 6.5 | 2026-07-01 | An unauthenticated command injection vulnerability in the /goform/fast_setting_internet_set endpoint of Tenda AC18 v15.03.05.05 allows attackers to execute arb… |
CVE-2026-14358 | Medium | 6.1 | 2026-07-01 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Charts Extension all… |
CVE-2026-13769 | Medium | 5.5 | 2026-07-01 | Overly permissive file permissions in AWS CLI before 1.44.78 (v1) and 2.34.29 (v2) on Unix-like systems where the umask has not been configured to restrict fil… |
CVE-2026-5051 | Medium | 4.4 | 2026-07-01 | HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file… |
CVE-2026-58520 | Medium | 6.1 | 2026-07-01 | URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - UrlShortener Extension allows Cross-Site Flashing. T… |
CVE-2026-57737 | Medium | 6.5 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta LTD Shortcodes and extra features for Phlox theme… |
CVE-2026-57722 | Medium | 5.9 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel Enable Media Replace allows Stored XSS. This… |
CVE-2026-51946 | Medium | 6.5 | 2026-07-01 | SQL Injection vulnerability in GoAdminGroup GoAdmin (last release v1.2.26) allows a remote attacker to execute arbitrary code and obtain sensitive information… |
CVE-2026-49090 | Medium | 6.5 | 2026-07-01 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can su… |
CVE-2026-57721 | Medium | 5.3 | 2026-07-01 | Missing Authorization vulnerability in WP Reloaded ApplyOnline allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects App… |
CVE-2026-57720 | Medium | 4.3 | 2026-07-01 | Missing Authorization vulnerability in Codexpert Inc ThumbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Th… |
CVE-2026-56152 | Medium | 5.3 | 2026-07-01 | Incorrect Authorization (CWE-863) in Elastic Defend can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACL… |
CVE-2026-56151 | Medium | 6.5 | 2026-07-01 | Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specia… |
CVE-2026-56150 | Medium | 6.5 | 2026-07-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Fleet Server can lead to a denial of service via Excessive Allocation (CAPEC-130). An attacke… |
CVE-2026-56149 | Medium | 4.9 | 2026-07-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user wi… |
CVE-2026-56148 | Medium | 6.5 | 2026-07-01 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a spec… |
CVE-2026-49088 | Medium | 4.4 | 2026-07-01 | Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (… |
CVE-2026-49087 | Medium | 6.5 | 2026-07-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated… |
CVE-2026-34098 | Medium | 4.6 | 2026-07-01 | Guardian language-system fails to sanitize the id GET parameter before inserting it into HTML source and form action attributes in media.php (lines 119, 129)… |
CVE-2026-34097 | Medium | 4.6 | 2026-07-01 | Guardian language-system fails to sanitize the id GET parameter before inserting it into multiple HTML form action attributes in text_file.php (lines 94, 101… |
CVE-2026-34096 | Medium | 4.6 | 2026-07-01 | Guardian language-system fails to sanitize the name GET parameter before outputting it into an HTML input value attribute in designer.php (line 57). An authent… |
CVE-2026-27409 | Medium | 5.3 | 2026-07-01 | Missing Authorization vulnerability in Webba Plugins Webba Booking allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects… |
CVE-2026-13211 | Medium | 4.3 | 2026-07-01 | The genucenter web interface before version 8.0p11 unnecessarily exposes sensitive SNMP authentication and encryption keys in its HTTP responses to users with… |
CVE-2026-12480 | Medium | 5.5 | 2026-07-01 | Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669. The vulnerability resides i… |
CVE-2026-8480 | Medium | 4.3 | 2026-07-01 | A vulnerability was discovered on Stormshield Network Security 4.3.0 to 4.3.41 (included), 4.4.0 to 4.8.15 (included) , 5.0.2 EA to 5.0.5 (included) A revo… |
CVE-2026-58038 | Medium | 6.1 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation timeline. This vulnerabilit… |
CVE-2026-58037 | Medium | 6.1 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerabili… |
CVE-2026-58033 | Medium | 6.5 | 2026-07-01 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program fil… |
CVE-2026-58032 | Medium | 6.1 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerabili… |
CVE-2026-58030 | Medium | 6.1 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation SyntaxHighlight_GeSHi. This… |
CVE-2026-58029 | Medium | 6.5 | 2026-07-01 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiChangeAuthenticationData.Php, includes/A… |
CVE-2026-58028 | Medium | 5.4 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundati… |
CVE-2026-58027 | Medium | 6.5 | 2026-07-01 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program f… |
CVE-2026-58026 | Medium | 5.7 | 2026-07-01 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program fil… |
CVE-2026-58024 | Medium | 5.7 | 2026-07-01 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program fil… |
CVE-2026-24266 | Medium | 5.9 | 2026-07-01 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause a use-after-free issue. A successful exploit of this vulnerabilit… |
CVE-2026-6686 | Medium | 4.6 | 2026-07-01 | FatFs R0.16 and earlier contains an uninitialized cluster exposure when f_lseek() extends files beyond EOF without zero-filling newly allocated clusters. This… |
CVE-2026-6684 | Medium | 4.6 | 2026-07-01 | FatFs prior to R0.16 that use GPT scanning with 'FF_LBA64 = 1' contains an issue where an unbounded loop count derived from GPT header field GPTH_PtNum, enabli… |
CVE-2026-6683 | Medium | 4.6 | 2026-07-01 | FatFs R0.16 and earlier contains a divide-by-zero in exFAT sync logic bug when crafted metadata causes n_fatent - 2 to be zero during write/sync operations. Th… |
CVE-2026-6283 | Medium | 5.4 | 2026-07-01 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allow… |
CVE-2026-5220 | Medium | 6.4 | 2026-07-01 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allow… |
CVE-2026-5142 | Medium | 6.5 | 2026-07-01 | A flaw was found in foreman. Authenticated users with 'view_keypairs' permission can bypass taxonomy scoping, allowing them to download private SSH (Secure She… |
CVE-2026-5138 | Medium | 4.3 | 2026-07-01 | A flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross-tenant information disclosure vulnerability. This flaw occu… |
CVE-2026-5135 | Medium | 6.5 | 2026-07-01 | A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-edit permissions to retarget an existing lookup va… |
CVE-2026-58035 | Medium | 4.8 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerabili… |
CVE-2026-58034 | Medium | 4.8 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerabili… |
CVE-2026-58031 | Medium | 5.4 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerabili… |
CVE-2026-14330 | Medium | 5.5 | 2026-07-01 | Multiple unbounded alloca() calls in the PulseAudio protocol server. |
CVE-2026-14324 | Medium | 6.5 | 2026-07-01 | RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return. |
CVE-2026-53353 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: hsr: Remove WARN_ONCE() in hsr_addr_is_self(). syzbot reported the warning [0] in hsr_add… |
CVE-2026-53352 | Medium | 4.7 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() When a multi-threaded… |
CVE-2026-53351 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI Fixes a warning while dumping core… |
CVE-2026-53350 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: ASoC: wm_adsp: Fix NULL dereference when removing firmware controls In wm_adsp_control_re… |
CVE-2026-53349 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: destroy stale expectfn expectations on unregister NAT helpers su… |
CVE-2026-53348 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions sdca_dev_unregi… |
CVE-2026-53347 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Fix driver removal with disabled KMS DRM atomic and modesetting aren't initia… |
CVE-2026-53345 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying When marking a p… |
CVE-2026-53344 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init Regmap initializa… |
CVE-2026-53343 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow Commit 44e9a3bb76e5 ("ARM… |
CVE-2026-53342 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: arm64: mm: call pagetable dtor when freeing hot-removed page tables Since 5e8eb9aeeda3 ("… |
CVE-2026-53340 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix clock and pinctrl state inconsistency in runtime PM In i2c_imx_runtime_susp… |
CVE-2026-53339 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() On all modern platforms Qualc… |
CVE-2026-53338 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: net: airoha: Add NULL check for of_reserved_mem_lookup() in airoha_qdma_init_hfwd_queues()… |
CVE-2026-53337 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix NULL pointer dereference in bond_do_ioctl() In bond_do_ioctl(), slave_d… |
CVE-2026-53336 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: nvmem: layouts: onie-tlv: fix hang on unknown types The EEPROM on my board has a vendor s… |
CVE-2026-53335 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/lru_sort: handle ctx allocation failure DAMON_LRU_SORT allocates the damon_ctx o… |
CVE-2026-53334 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/reclaim: handle ctx allocation failure Patch series "mm/damon/{reclaim,lru_sort}… |
CVE-2026-53333 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: mm/mincore: handle non-swap entries before !CONFIG_SWAP guard mincore_swap() also fields… |
CVE-2026-53332 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd When the remoteproc sta… |
CVE-2026-53331 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock During the SSR/PDR down notifica… |