Medium-severity CVEs (page 6)
Page 6 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-72712 | Medium | 6.5 | 2026-08-11 | Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted pa… |
CVE-2026-69113 | Medium | 5.4 | 2026-08-11 | Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any priva… |
CVE-2026-65680 | Medium | 6.7 | 2026-08-11 | Improper link resolution before file access ('link following') in Microsoft OneDrive allows an authorized attacker to elevate privileges locally. |
CVE-2026-48790 | Medium | 5.5 | 2026-08-11 | Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to `settings.js… |
CVE-2026-48411 | Medium | 6.5 | 2026-08-11 | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker with high privileges could l… |
CVE-2026-73084 | Medium | 6.1 | 2026-08-11 | Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query… |
CVE-2026-72971 | Medium | 5.5 | 2026-08-11 | Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to p… |
CVE-2026-71390 | Medium | 4.0 | 2026-08-11 | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage th… |
CVE-2026-71389 | Medium | 6.2 | 2026-08-11 | CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attack… |
CVE-2026-70348 | Medium | 5.5 | 2026-08-11 | Improper link resolution before file access ('link following') in Windows Management Services allows an authorized attacker to deny service locally. |
CVE-2026-70330 | Medium | 6.7 | 2026-08-11 | Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally. |
CVE-2026-70328 | Medium | 6.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. |
CVE-2026-70327 | Medium | 6.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. |
CVE-2026-70325 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
CVE-2026-70323 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-70322 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
CVE-2026-70320 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
CVE-2026-70319 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-70318 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-70317 | Medium | 5.5 | 2026-08-11 | Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-70316 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
CVE-2026-70315 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-70314 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-70312 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
CVE-2026-70310 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-70304 | Medium | 6.7 | 2026-08-11 | Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally. |
CVE-2026-68819 | Medium | 5.9 | 2026-08-11 | Buffer over-read in Windows Network File System allows an unauthorized attacker to deny service over a network. |
CVE-2026-68813 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-68809 | Medium | 5.5 | 2026-08-11 | Incomplete cleanup in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
CVE-2026-68808 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-68802 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-68799 | Medium | 5.5 | 2026-08-11 | Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-68797 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-66810 | Medium | 5.5 | 2026-08-11 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-66809 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-66806 | Medium | 5.5 | 2026-08-11 | Off-by-one error in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-66301 | Medium | 6.5 | 2026-08-11 | Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information over a… |
CVE-2026-65813 | Medium | 6.5 | 2026-08-11 | Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-65806 | Medium | 6.5 | 2026-08-11 | Missing authorization in Azure CycleCloud allows an authorized attacker to disclose information over a network. |
CVE-2026-65799 | Medium | 6.7 | 2026-08-11 | Integer overflow or wraparound in Windows DNS allows an authorized attacker to elevate privileges locally. |
CVE-2026-65798 | Medium | 6.7 | 2026-08-11 | Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally. |
CVE-2026-65797 | Medium | 6.7 | 2026-08-11 | Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally. |
CVE-2026-65795 | Medium | 6.7 | 2026-08-11 | No cwe for this issue in Windows DNS allows an authorized attacker to elevate privileges locally. |
CVE-2026-65794 | Medium | 6.5 | 2026-08-11 | Buffer over-read in Windows SMB Client allows an unauthorized attacker to disclose information over a network. |
CVE-2026-65785 | Medium | 6.5 | 2026-08-11 | Uncontrolled resource consumption in Windows DHCP Client allows an unauthorized attacker to deny service over an adjacent network. |
CVE-2026-65784 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. |
CVE-2026-65777 | Medium | 5.3 | 2026-08-11 | Inadequate encryption strength in Windows Active Directory allows an authorized attacker to bypass a security feature over a network. |
CVE-2026-65769 | Medium | 6.5 | 2026-08-11 | Exposure of sensitive information to an unauthorized actor in Microsoft Teams Mobile allows an unauthorized attacker to disclose information over a network. |
CVE-2026-65662 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Windows GDI allows an authorized attacker to disclose information locally. |
CVE-2026-65660 | Medium | 6.5 | 2026-08-11 | Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. |
CVE-2026-64922 | Medium | 4.6 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-64917 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-64916 | Medium | 4.6 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-64902 | Medium | 4.6 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-64899 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-64897 | Medium | 4.6 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-63531 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-63530 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-63529 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-63528 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-63524 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-63521 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-63517 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-63516 | Medium | 6.5 | 2026-08-11 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. |
CVE-2026-63512 | Medium | 6.5 | 2026-08-11 | Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network. |
CVE-2026-62917 | Medium | 4.6 | 2026-08-11 | Improper input validation in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. |
CVE-2026-62915 | Medium | 6.5 | 2026-08-11 | Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a security feature over a network. |
CVE-2026-62912 | Medium | 6.5 | 2026-08-11 | Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny service over a network. |
CVE-2026-62902 | Medium | 6.5 | 2026-08-11 | Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network. |
CVE-2026-62900 | Medium | 5.9 | 2026-08-11 | Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network. |
CVE-2026-62899 | Medium | 5.9 | 2026-08-11 | Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a ne… |
CVE-2026-62887 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. |
CVE-2026-62883 | Medium | 6.7 | 2026-08-11 | Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally. |
CVE-2026-62882 | Medium | 4.3 | 2026-08-11 | Insufficiently protected credentials in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-62881 | Medium | 6.7 | 2026-08-11 | Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally. |
CVE-2026-62842 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-62839 | Medium | 6.5 | 2026-08-11 | Insufficiently protected credentials in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. |
CVE-2026-62837 | Medium | 6.5 | 2026-08-11 | Relative path traversal in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. |
CVE-2026-62829 | Medium | 4.6 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-62814 | Medium | 6.5 | 2026-08-11 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. |
CVE-2026-62798 | Medium | 5.5 | 2026-08-11 | Untrusted pointer dereference in Windows Win32K allows an authorized attacker to disclose information locally. |
CVE-2026-62796 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. |
CVE-2026-62793 | Medium | 5.5 | 2026-08-11 | Buffer over-read in Windows NTFS allows an authorized attacker to disclose information locally. |
CVE-2026-62786 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Windows Win32K allows an authorized attacker to disclose information locally. |
CVE-2026-62782 | Medium | 6.5 | 2026-08-11 | Out-of-bounds read in Windows SMB Client allows an unauthorized attacker to disclose information over a network. |
CVE-2026-62775 | Medium | 5.5 | 2026-08-11 | Incorrect authorization in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to disclose information locally. |
CVE-2026-62769 | Medium | 6.7 | 2026-08-11 | Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally. |
CVE-2026-62757 | Medium | 5.3 | 2026-08-11 | Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-62750 | Medium | 6.5 | 2026-08-11 | Partial string comparison in Windows HTTP Protocol Stack allows an unauthorized attacker to perform tampering over an adjacent network. |
CVE-2026-62746 | Medium | 5.5 | 2026-08-11 | Buffer over-read in Windows Win32K allows an authorized attacker to disclose information locally. |
CVE-2026-62745 | Medium | 6.5 | 2026-08-11 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. |
CVE-2026-62743 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Windows Win32K allows an authorized attacker to disclose information locally. |
CVE-2026-62742 | Medium | 6.5 | 2026-08-11 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. |
CVE-2026-62740 | Medium | 5.5 | 2026-08-11 | Use of uninitialized resource in Windows Imaging Component allows an authorized attacker to disclose information locally. |
CVE-2026-62738 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Windows Management Instrumentation allows an authorized attacker to disclose information locally. |
CVE-2026-62730 | Medium | 5.5 | 2026-08-11 | Buffer over-read in Windows Wired AutoConfig Service allows an authorized attacker to disclose information locally. |
CVE-2026-62720 | Medium | 6.5 | 2026-08-11 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. |
CVE-2026-62718 | Medium | 6.5 | 2026-08-11 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. |
CVE-2026-62716 | Medium | 6.5 | 2026-08-11 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. |
CVE-2026-62715 | Medium | 6.5 | 2026-08-11 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. |