Medium-severity CVEs (page 7)
Page 7 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-62714 | Medium | 6.5 | 2026-08-11 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. |
CVE-2026-62709 | Medium | 5.5 | 2026-08-11 | Use of uninitialized resource in Windows GDI+ allows an authorized attacker to disclose information locally. |
CVE-2026-62708 | Medium | 6.4 | 2026-08-11 | Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack. |
CVE-2026-62703 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally. |
CVE-2026-62702 | Medium | 6.8 | 2026-08-11 | Null pointer dereference in Windows Graphics Kernel allows an unauthorized attacker to deny service over a network. |
CVE-2026-62699 | Medium | 6.8 | 2026-08-11 | Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an unauthorized attacker to execute code with a physical attack. |
CVE-2026-61936 | Medium | 5.5 | 2026-08-11 | Missing authorization in Windows Defender Firewall Service allows an authorized attacker to bypass a security feature locally. |
CVE-2026-61933 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally. |
CVE-2026-61928 | Medium | 5.5 | 2026-08-11 | Cleartext storage of sensitive information in Windows Hello allows an authorized attacker to perform tampering locally. |
CVE-2026-61924 | Medium | 6.5 | 2026-08-11 | Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. |
CVE-2026-61921 | Medium | 6.5 | 2026-08-11 | Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. |
CVE-2026-61920 | Medium | 6.6 | 2026-08-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an authorized attacker to execute code over a… |
CVE-2026-61918 | Medium | 6.5 | 2026-08-11 | Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. |
CVE-2026-61368 | Medium | 5.0 | 2026-08-11 | Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to disclose information locally. |
CVE-2026-61360 | Medium | 5.5 | 2026-08-11 | Untrusted pointer dereference in Windows GDI allows an authorized attacker to disclose information locally. |
CVE-2026-61350 | Medium | 4.6 | 2026-08-11 | Buffer over-read in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack. |
CVE-2026-61347 | Medium | 5.5 | 2026-08-11 | Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally. |
CVE-2026-61345 | Medium | 6.5 | 2026-08-11 | Null pointer dereference in Microsoft Remote Registry Service allows an authorized attacker to deny service over a network. |
CVE-2026-59138 | Medium | 6.5 | 2026-08-11 | Null pointer dereference in Microsoft Remote Registry Service allows an authorized attacker to deny service over a network. |
CVE-2026-59137 | Medium | 5.5 | 2026-08-11 | Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally. |
CVE-2026-59136 | Medium | 5.5 | 2026-08-11 | Use of uninitialized resource in Microsoft COM for Windows allows an authorized attacker to disclose information locally. |
CVE-2026-59135 | Medium | 5.5 | 2026-08-11 | Weak authentication in Microsoft Windows Search Component allows an authorized attacker to disclose information locally. |
CVE-2026-59131 | Medium | 5.6 | 2026-08-11 | No cwe for this issue in AMD Zen allows an authorized attacker to disclose information locally. |
CVE-2026-59130 | Medium | 5.6 | 2026-08-11 | No cwe for this issue in AMD Zen allows an authorized attacker to disclose information locally. |
CVE-2026-59128 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information locally. |
CVE-2026-58639 | Medium | 6.5 | 2026-08-11 | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. |
CVE-2026-54123 | Medium | 5.5 | 2026-08-11 | Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpoint allows an authorized attacker to disclose information locally. |
CVE-2026-48483 | Medium | 5.4 | 2026-08-11 | TypeBot is a chatbot builder tool. Prior to version 3.17.0, Typebot's WhatsApp status forwarding feature stores a workspace-configured webhook forwarding URL a… |
CVE-2026-48446 | Medium | 5.5 | 2026-08-11 | CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbit… |
CVE-2026-48445 | Medium | 6.2 | 2026-08-11 | CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could… |
CVE-2026-48444 | Medium | 6.2 | 2026-08-11 | CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could… |
CVE-2026-48443 | Medium | 6.2 | 2026-08-11 | CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could e… |
CVE-2026-48437 | Medium | 5.5 | 2026-08-11 | CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could lever… |
CVE-2026-48436 | Medium | 6.5 | 2026-08-11 | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage th… |
CVE-2026-48435 | Medium | 6.2 | 2026-08-11 | CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attack… |
CVE-2026-48434 | Medium | 6.2 | 2026-08-11 | CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could e… |
CVE-2026-48387 | Medium | 6.2 | 2026-08-11 | CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could… |
CVE-2026-48384 | Medium | 4.9 | 2026-08-11 | ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker with high privileges co… |
CVE-2026-48376 | Medium | 5.4 | 2026-08-11 | is affected by an Improper Encoding or Escaping of Output vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverag… |
CVE-2026-48375 | Medium | 6.5 | 2026-08-11 | ColdFusion is affected by an Incorrect Authorization vulnerability that could result in an application denial-of-service. A low-privileged attacker could explo… |
CVE-2026-47922 | Medium | 4.7 | 2026-08-11 | CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue… |
CVE-2026-47285 | Medium | 6.5 | 2026-08-11 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to disclose informati… |
CVE-2026-40375 | Medium | 6.5 | 2026-08-11 | Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over a network. |
CVE-2026-21269 | Medium | 4.6 | 2026-08-11 | is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable… |
CVE-2026-73068 | Medium | 5.9 | 2026-08-11 | ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.207, the ToolJet… |
CVE-2026-6727 | Medium | 5.9 | 2026-08-11 | A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may… |
CVE-2026-56720 | Medium | 4.3 | 2026-08-11 | CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access… |
CVE-2026-53414 | Medium | 6.5 | 2026-08-11 | Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting participant to conduct a denial of service on… |
CVE-2026-19078 | Medium | 4.3 | 2026-08-11 | A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the grant approval handler is not properly… |
CVE-2026-18638 | Medium | 6.5 | 2026-08-11 | Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling Set… |
CVE-2026-14180 | Medium | 5.3 | 2026-08-11 | A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issu… |
CVE-2026-72925 | Medium | 6.1 | 2026-08-11 | SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0, the minifyJson processin… |
CVE-2026-18636 | Medium | 6.8 | 2026-08-11 | The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore. To prevent users from reading sensitive files or accessing… |
CVE-2026-17535 | Medium | 6.2 | 2026-08-11 | Velociraptor's NTFS parsing library mishandles several out of bound and memory exhaustion bugs which may be triggered by maliciously crafted NTFS images. Typi… |
CVE-2026-72785 | Medium | 4.3 | 2026-08-11 | Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission (without… |
CVE-2026-72784 | Medium | 5.4 | 2026-08-11 | Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL save<Volume>Ass… |
CVE-2026-72783 | Medium | 6.2 | 2026-08-11 | Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the ensurePathIsContained functio… |
CVE-2026-72782 | Medium | 6.5 | 2026-08-11 | Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets (via ${ENV_VAR} strings in the eleme… |
CVE-2026-72780 | Medium | 6.5 | 2026-08-11 | Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay ca… |
CVE-2026-72779 | Medium | 4.5 | 2026-08-11 | Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The create() Twig function restricts class instanti… |
CVE-2026-72744 | Medium | 6.2 | 2026-08-11 | Nuxt versions >= 4.4.7 and < 4.5.1, and >= 3.21.7 and < 3.21.10, contain an information disclosure vulnerability in the development server's Chrome DevTools wo… |
CVE-2026-69108 | Medium | 6.0 | 2026-08-11 | A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.1). The affected application is vulnerable to a local privilege escalati… |
CVE-2026-59693 | Medium | 4.3 | 2026-08-11 | A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.233.16-7862), Desigo PXC3 (All versions < V01.21.233.16-7862), Desigo PXC4 (All versi… |
CVE-2026-57263 | Medium | 6.8 | 2026-08-11 | A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). The project password feature in the affected products stores the password as an… |
CVE-2026-57262 | Medium | 6.8 | 2026-08-11 | A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). Affected products use a static, hardcoded AES master key to encrypt project file… |
CVE-2026-72610 | Medium | 4.3 | 2026-08-11 | A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the borrowers => edit_borrowers… |
CVE-2026-72608 | Medium | 6.5 | 2026-08-11 | A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => label_creator perm… |
CVE-2026-72604 | Medium | 6.5 | 2026-08-11 | A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the adm… |
CVE-2026-72598 | Medium | 6.5 | 2026-08-11 | A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the server issue HTTP requests to internal ne… |
CVE-2026-72597 | Medium | 6.5 | 2026-08-11 | A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe… |
CVE-2026-72560 | Medium | 6.5 | 2026-08-11 | A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRF_PROTECTION_ENABLED is set to false by default… |
CVE-2026-72559 | Medium | 5.4 | 2026-08-11 | A stored cross-site scripting vulnerability in HortusFox 5.9 allows authenticated workspace members to inject persistent JavaScript into plant notes via Parsed… |
CVE-2026-72554 | Medium | 6.5 | 2026-08-11 | A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows any self-registered customer to read ticket conversations belonging… |
CVE-2026-72553 | Medium | 5.4 | 2026-08-11 | A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member to inject persistent JavaScript into the profile fields cu… |
CVE-2026-72549 | Medium | 5.3 | 2026-08-11 | An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to map any email address or username to… |
CVE-2026-72542 | Medium | 5.4 | 2026-08-11 | A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write job progress and read job metrics for a… |
CVE-2026-72541 | Medium | 6.5 | 2026-08-11 | A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema… |
CVE-2026-72540 | Medium | 4.3 | 2026-08-11 | An insecure direct object reference vulnerability in PhotoPrism through commit bb0b933 allows any user with a valid preview token to retrieve the original-reso… |
CVE-2026-72539 | Medium | 6.5 | 2026-08-11 | An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scri… |
CVE-2026-33922 | Medium | 6.0 | 2026-08-11 | A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input param… |
CVE-2026-33921 | Medium | 5.2 | 2026-08-11 | The Windows installer deployed Npcap leaving its access restriction option at the insecure default value, so the driver was accessible to every local user of t… |
CVE-2026-71218 | Medium | 5.3 | 2026-08-11 | A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the `JSON_read()` function, which accepts a peer-controlled messag… |
CVE-2026-19519 | Medium | 4.3 | 2026-08-11 | A flaw was found in claircore's RPM package scanner. Crafted RPM header data in a container layer can cause an unchecked type assertion to panic the scanner. T… |
CVE-2026-19518 | Medium | 6.5 | 2026-08-11 | Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipulation. |
CVE-2026-19517 | Medium | 6.5 | 2026-08-11 | Improper Validation of Specified Quantity in Input and Allocation of Resources Without Limits or Throttling vulnerability in Samsung Open Source rlottie allows… |
CVE-2026-19391 | Medium | 6.5 | 2026-08-11 | A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows… |
CVE-2026-8158 | Medium | 5.3 | 2026-08-11 | The Signed Video Framework contained a buffer overflow issue which could lead the application using this framework to crash. The issue exclusively affects th… |
CVE-2026-6505 | Medium | 5.1 | 2026-08-11 | The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. This vulnerability ca… |
CVE-2026-6181 | Medium | 5.9 | 2026-08-11 | The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can only be exploited after authenticating with a viewer-privilege… |
CVE-2026-5304 | Medium | 5.7 | 2026-08-11 | An ACAP configuration file lacks input validation, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis d… |
CVE-2026-5303 | Medium | 5.7 | 2026-08-11 | The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. This vulnerability ca… |
CVE-2026-18348 | Medium | 4.1 | 2026-08-11 | Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role user can initiate attacker-contro… |
CVE-2026-14549 | Medium | 4.3 | 2026-08-11 | The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenti… |
CVE-2026-14548 | Medium | 6.5 | 2026-08-11 | The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenti… |
CVE-2026-12052 | Medium | 5.2 | 2026-08-11 | The USB device-side CDC NCM class control-to-host handler usbd_cdc_ncm_cth in subsys/usb/device_next/class/usbd_cdc_ncm.c builds a fixed-size response for the… |
CVE-2026-12051 | Medium | 4.6 | 2026-08-11 | The USB DFU class implementation in Zephyr's new (experimental) device_next USB device stack contains a NULL pointer dereference in handle_download() (subsys/u… |
CVE-2026-11894 | Medium | 5.9 | 2026-08-11 | The Realtek BEE Bluetooth HCI driver's send callback, bt_hci_bee_send() in drivers/bluetooth/hci/hci_bee.c, violated the bt_hci_driver_api buffer-ownership con… |
CVE-2026-16974 | Medium | 6.4 | 2026-08-11 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post_meta Shortcode i… |
CVE-2026-11893 | Medium | 5.9 | 2026-08-11 | The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers (BL60x/BL70x/BL61x), bt_bflb_send() in drivers/bluetooth/hci/hci_bflb.c, violates the bt_hci_… |
CVE-2026-24330 | Medium | 6.5 | 2026-08-11 | A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file from an untrusted so… |