Medium-severity CVEs (page 55)
Page 55 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-13172 | Medium | 5.3 | 2026-08-26 | The Eventin WordPress plugin before 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API namespaces, allowin… |
CVE-2026-80200 | Medium | 4.7 | 2026-08-26 | Kimai before 2.53.0 contains an open redirect vulnerability in the SAML authentication success handler that accepts unvalidated RelayState POST parameters as r… |
CVE-2026-80197 | Medium | 4.3 | 2026-08-26 | Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to mani… |
CVE-2026-80195 | Medium | 5.4 | 2026-08-26 | Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint (PATCH /api/teams/{id}), which removes all… |
CVE-2026-80194 | Medium | 4.3 | 2026-08-26 | Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController export route (report_project_view_export). The authorization gu… |
CVE-2026-80189 | Medium | 6.5 | 2026-08-26 | LeafWiki extracts an uploaded ZIP archive without limiting how much data it will write. ZipExtractor.ExtractToDir in internal/importer/zip_extractor.go opens e… |
CVE-2026-76149 | Medium | 4.4 | 2026-08-26 | CorvusSKK contains an integer overflow vulnerability, which may allow malicious data to be written to a dictionary file. |
CVE-2026-73335 | Medium | 5.3 | 2026-08-26 | Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939). A malicious application installed on the u… |
CVE-2026-70665 | Medium | 4.2 | 2026-08-25 | Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client… |
CVE-2026-55805 | Medium | 5.4 | 2026-08-25 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects… |
CVE-2026-18261 | Medium | 5.7 | 2026-08-25 | Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions: *.*. |
CVE-2026-18260 | Medium | 5.7 | 2026-08-25 | Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page… |
CVE-2026-16646 | Medium | 5.7 | 2026-08-25 | Vulnerability in Drupal PanKM. This issue affects PanKM versions: *.*. |
CVE-2026-16643 | Medium | 5.7 | 2026-08-25 | Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: *.*. |
CVE-2026-16642 | Medium | 5.7 | 2026-08-25 | Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*. |
CVE-2026-16640 | Medium | 6.1 | 2026-08-25 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This… |
CVE-2026-16638 | Medium | 6.1 | 2026-08-25 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folders allows Stored XSS. This issue affect… |
CVE-2026-15917 | Medium | 4.7 | 2026-08-25 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). Thi… |
CVE-2026-15916 | Medium | 4.2 | 2026-08-25 | Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0… |
CVE-2026-15088 | Medium | 5.7 | 2026-08-25 | Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: *.*. |
CVE-2026-80185 | Medium | 5.7 | 2026-08-25 | BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML pars… |
CVE-2026-73180 | Medium | 6.8 | 2026-08-25 | Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket con… |
CVE-2026-38474 | Medium | 5.4 | 2026-08-25 | GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 suffers from a Broken access control vulnerability in the IP lock manager, which… |
CVE-2026-38473 | Medium | 5.4 | 2026-08-25 | A Stored XSS vulnerability in the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authent… |
CVE-2026-38472 | Medium | 6.1 | 2026-08-25 | A Stored XSS vulnerability in forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote attackers to… |
CVE-2026-38470 | Medium | 4.3 | 2026-08-25 | A Broken access control vulnerability in the API user endpoint in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows unprivil… |
CVE-2026-38469 | Medium | 5.4 | 2026-08-25 | A Stored XSS vulnerability in the custom bonus title feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote aut… |
CVE-2026-38468 | Medium | 4.3 | 2026-08-25 | A SQL injection vulnerability in the country-code lookup endpoint in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remot… |
CVE-2026-38467 | Medium | 5.4 | 2026-08-25 | A SQL injection vulnerability in the tags manager in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated… |
CVE-2026-38466 | Medium | 5.4 | 2026-08-25 | A Stored XSS vulnerability in the torrent remaster custom title feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows… |
CVE-2026-38465 | Medium | 5.4 | 2026-08-25 | A Stored XSS vulnerability in the donor avatar mouse-over text feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows… |
CVE-2026-80101 | Medium | 4.4 | 2026-08-25 | A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width and bytes-per-line pa… |
CVE-2026-79793 | Medium | 4.3 | 2026-08-25 | A vulnerability has been found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/sumit… |
CVE-2026-79792 | Medium | 5.6 | 2026-08-25 | A flaw has been found in zackees transcribe-anything up to 4.1.0. Affected is the function ytdlp_download of the file src/transcribe_anything/ytldp_download.py… |
CVE-2026-79293 | Medium | 6.5 | 2026-08-25 | Information leak in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chrom… |
CVE-2026-79291 | Medium | 6.5 | 2026-08-25 | Information leak in CSS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium se… |
CVE-2026-79288 | Medium | 6.5 | 2026-08-25 | Improper input validation in Autofill in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a cra… |
CVE-2026-79287 | Medium | 5.3 | 2026-08-25 | Observable discrepancy in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chr… |
CVE-2026-79285 | Medium | 6.5 | 2026-08-25 | Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML… |
CVE-2026-79284 | Medium | 4.3 | 2026-08-25 | UI misrepresentation in Core in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to spoof UI e… |
CVE-2026-79283 | Medium | 5.4 | 2026-08-25 | UI misrepresentation in Geometry in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium secu… |
CVE-2026-79276 | Medium | 4.3 | 2026-08-25 | Improper privilege management in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system ac… |
CVE-2026-79274 | Medium | 4.3 | 2026-08-25 | Information leak in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium securi… |
CVE-2026-79273 | Medium | 4.3 | 2026-08-25 | Incorrect reference resolution in WebView in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin poli… |
CVE-2026-79271 | Medium | 6.5 | 2026-08-25 | Information leak in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive information via a c… |
CVE-2026-79270 | Medium | 6.5 | 2026-08-25 | Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (… |
CVE-2026-79269 | Medium | 4.3 | 2026-08-25 | Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML pa… |
CVE-2026-79267 | Medium | 4.3 | 2026-08-25 | Race condition in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin polic… |
CVE-2026-79265 | Medium | 5.3 | 2026-08-25 | Incomplete cleanup in GetUserMedia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged soc… |
CVE-2026-79264 | Medium | 4.3 | 2026-08-25 | Incorrect reference resolution in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page… |
CVE-2026-79262 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chro… |
CVE-2026-79261 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Controls in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chr… |
CVE-2026-79260 | Medium | 6.5 | 2026-08-25 | Improper input validation in Cookies in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web o… |
CVE-2026-79259 | Medium | 4.3 | 2026-08-25 | Improper input validation in Safebrowsing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted… |
CVE-2026-79258 | Medium | 6.5 | 2026-08-25 | Incorrect authorization in WebXR in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain cross-origin data vi… |
CVE-2026-79254 | Medium | 4.3 | 2026-08-25 | Incorrect reference resolution in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictio… |
CVE-2026-79253 | Medium | 6.5 | 2026-08-25 | Improper input validation in Network in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to leak sens… |
CVE-2026-79252 | Medium | 4.3 | 2026-08-25 | Information leak in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chrom… |
CVE-2026-79251 | Medium | 4.3 | 2026-08-25 | Improper input validation in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy via a crafted HT… |
CVE-2026-79250 | Medium | 5.4 | 2026-08-25 | UI misrepresentation in Navigation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium se… |
CVE-2026-79249 | Medium | 6.5 | 2026-08-25 | Code injection in Bisection in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted file. (Chromium sec… |
CVE-2026-79248 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Input in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origi… |
CVE-2026-79246 | Medium | 6.5 | 2026-08-25 | Information leak in DataTransfer in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Ch… |
CVE-2026-79243 | Medium | 6.5 | 2026-08-25 | Improper input validation in ReadingList in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer proce… |
CVE-2026-79242 | Medium | 5.3 | 2026-08-25 | Observable discrepancy in HTML in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chro… |
CVE-2026-79241 | Medium | 6.5 | 2026-08-25 | Out of bounds read in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to read memory outside the sandbox via a crafted HTML… |
CVE-2026-79239 | Medium | 6.5 | 2026-08-25 | Out of bounds read in Tint in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a… |
CVE-2026-79238 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin p… |
CVE-2026-79237 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (C… |
CVE-2026-79234 | Medium | 6.5 | 2026-08-25 | Injection in CSS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially obtain sensitive information via a crafted HTML page. (Chromi… |
CVE-2026-79233 | Medium | 4.3 | 2026-08-25 | UI misrepresentation in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to spoof address bar via a crafted HTML page… |
CVE-2026-79229 | Medium | 6.5 | 2026-08-25 | Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to read memory outsi… |
CVE-2026-79225 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Browser in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass syst… |
CVE-2026-79222 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to bypass web origin policy via a co-insta… |
CVE-2026-79221 | Medium | 6.5 | 2026-08-25 | Uninitialized resource in Dawn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HT… |
CVE-2026-79220 | Medium | 5.3 | 2026-08-25 | Information leak in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to obtain sensitive info… |
CVE-2026-79217 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafte… |
CVE-2026-79214 | Medium | 4.3 | 2026-08-25 | Improper input validation in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web o… |
CVE-2026-79213 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in WebAppInstalls in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions… |
CVE-2026-79212 | Medium | 4.3 | 2026-08-25 | Missing authorization in Passwords in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged soc… |
CVE-2026-79211 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in USB in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrict… |
CVE-2026-79208 | Medium | 5.9 | 2026-08-25 | Missing authorization in HTTP2 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information via crafted network traffic. (Ch… |
CVE-2026-79207 | Medium | 6.5 | 2026-08-25 | Information leak in Passwords in Google Chrome on on iOS prior to 152.0.7977.65 allowed a local attacker to obtain sensitive information via a crafted file. (C… |
CVE-2026-79206 | Medium | 6.5 | 2026-08-25 | Out of bounds read in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to read memory outside the san… |
CVE-2026-79205 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chro… |
CVE-2026-79204 | Medium | 5.4 | 2026-08-25 | UI misrepresentation in Input in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromi… |
CVE-2026-79201 | Medium | 4.3 | 2026-08-25 | Improper access control in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chro… |
CVE-2026-79199 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML pa… |
CVE-2026-79196 | Medium | 5.3 | 2026-08-25 | Race condition in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive information via a… |
CVE-2026-79193 | Medium | 4.3 | 2026-08-25 | Information leak in Canvas in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium secur… |
CVE-2026-79192 | Medium | 4.3 | 2026-08-25 | Improper input validation in Variations in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy via crafted n… |
CVE-2026-79190 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web… |
CVE-2026-79185 | Medium | 4.3 | 2026-08-25 | Information leak in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium securi… |
CVE-2026-79184 | Medium | 4.3 | 2026-08-25 | Missing authorization in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origi… |
CVE-2026-79181 | Medium | 5.3 | 2026-08-25 | Observable discrepancy in Glic in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chro… |
CVE-2026-79180 | Medium | 5.4 | 2026-08-25 | UI misrepresentation in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to spoof UI el… |
CVE-2026-79179 | Medium | 6.5 | 2026-08-25 | Incorrect authorization in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially leak sensitive information via a crafted HTML p… |
CVE-2026-79178 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Web Authentication (Passkeys & Security Keys) in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin… |
CVE-2026-79177 | Medium | 6.5 | 2026-08-25 | Incorrect authorization in Media in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to by… |
CVE-2026-79176 | Medium | 6.5 | 2026-08-25 | UI misrepresentation in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive informat… |