Medium-severity CVEs (page 73)
Page 73 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-70315 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-70314 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-70312 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
CVE-2026-70310 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-70304 | Medium | 6.7 | 2026-08-11 | Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally. |
CVE-2026-68819 | Medium | 5.9 | 2026-08-11 | Buffer over-read in Windows Network File System allows an unauthorized attacker to deny service over a network. |
CVE-2026-68813 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-68809 | Medium | 5.5 | 2026-08-11 | Incomplete cleanup in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
CVE-2026-68808 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-68802 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-68799 | Medium | 5.5 | 2026-08-11 | Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-68797 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-66810 | Medium | 5.5 | 2026-08-11 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-66809 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-66806 | Medium | 5.5 | 2026-08-11 | Off-by-one error in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-66301 | Medium | 6.5 | 2026-08-11 | Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information over a… |
CVE-2026-65813 | Medium | 6.5 | 2026-08-11 | Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-65806 | Medium | 6.5 | 2026-08-11 | Missing authorization in Azure CycleCloud allows an authorized attacker to disclose information over a network. |
CVE-2026-65799 | Medium | 6.7 | 2026-08-11 | Integer overflow or wraparound in Windows DNS allows an authorized attacker to elevate privileges locally. |
CVE-2026-65798 | Medium | 6.7 | 2026-08-11 | Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally. |
CVE-2026-65797 | Medium | 6.7 | 2026-08-11 | Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally. |
CVE-2026-65795 | Medium | 6.7 | 2026-08-11 | Relative path traversal in Windows DNS allows an authorized attacker to elevate privileges locally. |
CVE-2026-65794 | Medium | 6.5 | 2026-08-11 | Buffer over-read in Windows SMB Client allows an unauthorized attacker to disclose information over a network. |
CVE-2026-65785 | Medium | 6.5 | 2026-08-11 | Uncontrolled resource consumption in Windows DHCP Client allows an unauthorized attacker to deny service over an adjacent network. |
CVE-2026-65784 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. |
CVE-2026-65777 | Medium | 5.3 | 2026-08-11 | Inadequate encryption strength in Windows Active Directory allows an authorized attacker to bypass a security feature over a network. |
CVE-2026-65769 | Medium | 6.5 | 2026-08-11 | Exposure of sensitive information to an unauthorized actor in Microsoft Teams Mobile allows an unauthorized attacker to disclose information over a network. |
CVE-2026-65662 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Windows GDI allows an authorized attacker to disclose information locally. |
CVE-2026-64922 | Medium | 4.6 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-64917 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-64916 | Medium | 4.6 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-64902 | Medium | 4.6 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-64899 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-64897 | Medium | 4.6 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-63531 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-63530 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-63529 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-63528 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-63524 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-63521 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-63517 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-63516 | Medium | 6.5 | 2026-08-11 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. |
CVE-2026-63512 | Medium | 6.5 | 2026-08-11 | Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network. |
CVE-2026-62917 | Medium | 4.6 | 2026-08-11 | Improper input validation in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. |
CVE-2026-62915 | Medium | 6.5 | 2026-08-11 | Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a security feature over a network. |
CVE-2026-62912 | Medium | 6.5 | 2026-08-11 | Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny service over a network. |
CVE-2026-62902 | Medium | 6.5 | 2026-08-11 | Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network. |
CVE-2026-62900 | Medium | 5.9 | 2026-08-11 | Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network. |
CVE-2026-62899 | Medium | 5.9 | 2026-08-11 | Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a ne… |
CVE-2026-62887 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. |
CVE-2026-62883 | Medium | 6.7 | 2026-08-11 | Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally. |
CVE-2026-62882 | Medium | 4.3 | 2026-08-11 | Insufficiently protected credentials in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-62881 | Medium | 6.7 | 2026-08-11 | Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally. |
CVE-2026-62842 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-62839 | Medium | 6.5 | 2026-08-11 | Insufficiently protected credentials in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. |
CVE-2026-62837 | Medium | 6.5 | 2026-08-11 | Relative path traversal in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. |
CVE-2026-62829 | Medium | 4.6 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-62814 | Medium | 6.5 | 2026-08-11 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. |
CVE-2026-62798 | Medium | 5.5 | 2026-08-11 | Untrusted pointer dereference in Windows Win32K allows an authorized attacker to disclose information locally. |
CVE-2026-62796 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. |
CVE-2026-62793 | Medium | 5.5 | 2026-08-11 | Buffer over-read in Windows NTFS allows an authorized attacker to disclose information locally. |
CVE-2026-62786 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Windows Win32K allows an authorized attacker to disclose information locally. |
CVE-2026-62782 | Medium | 6.5 | 2026-08-11 | Out-of-bounds read in Windows SMB Client allows an unauthorized attacker to disclose information over a network. |
CVE-2026-62775 | Medium | 5.5 | 2026-08-11 | Incorrect authorization in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to disclose information locally. |
CVE-2026-62769 | Medium | 6.7 | 2026-08-11 | Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally. |
CVE-2026-62757 | Medium | 5.3 | 2026-08-11 | Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-62750 | Medium | 6.5 | 2026-08-11 | Partial string comparison in Windows HTTP Protocol Stack allows an unauthorized attacker to perform tampering over an adjacent network. |
CVE-2026-62746 | Medium | 5.5 | 2026-08-11 | Buffer over-read in Windows Win32K allows an authorized attacker to disclose information locally. |
CVE-2026-62745 | Medium | 6.5 | 2026-08-11 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. |
CVE-2026-62743 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Windows Win32K allows an authorized attacker to disclose information locally. |
CVE-2026-62742 | Medium | 6.5 | 2026-08-11 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. |
CVE-2026-62740 | Medium | 5.5 | 2026-08-11 | Use of uninitialized resource in Windows Imaging Component allows an authorized attacker to disclose information locally. |
CVE-2026-62738 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Windows Management Instrumentation allows an authorized attacker to disclose information locally. |
CVE-2026-62730 | Medium | 5.5 | 2026-08-11 | Buffer over-read in Windows Wired AutoConfig Service allows an authorized attacker to disclose information locally. |
CVE-2026-62720 | Medium | 6.5 | 2026-08-11 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. |
CVE-2026-62718 | Medium | 6.5 | 2026-08-11 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. |
CVE-2026-62716 | Medium | 6.5 | 2026-08-11 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. |
CVE-2026-62715 | Medium | 6.5 | 2026-08-11 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. |
CVE-2026-62714 | Medium | 6.5 | 2026-08-11 | Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. |
CVE-2026-62709 | Medium | 5.5 | 2026-08-11 | Use of uninitialized resource in Windows GDI+ allows an authorized attacker to disclose information locally. |
CVE-2026-62708 | Medium | 6.4 | 2026-08-11 | Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack. |
CVE-2026-62703 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally. |
CVE-2026-62702 | Medium | 6.8 | 2026-08-11 | Null pointer dereference in Windows Graphics Kernel allows an unauthorized attacker to deny service over a network. |
CVE-2026-62699 | Medium | 6.8 | 2026-08-11 | Null pointer dereference in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to execute code locally. |
CVE-2026-61936 | Medium | 5.5 | 2026-08-11 | Missing authorization in Windows Defender Firewall Service allows an authorized attacker to bypass a security feature locally. |
CVE-2026-61933 | Medium | 5.5 | 2026-08-11 | Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally. |
CVE-2026-61928 | Medium | 5.5 | 2026-08-11 | Cleartext storage of sensitive information in Windows Hello allows an authorized attacker to perform tampering locally. |
CVE-2026-61924 | Medium | 6.5 | 2026-08-11 | Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. |
CVE-2026-61921 | Medium | 6.5 | 2026-08-11 | Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. |
CVE-2026-61920 | Medium | 6.6 | 2026-08-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an authorized attacker to execute code over a… |
CVE-2026-61918 | Medium | 6.5 | 2026-08-11 | Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. |
CVE-2026-61368 | Medium | 5.0 | 2026-08-11 | Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to disclose information locally. |
CVE-2026-61360 | Medium | 5.5 | 2026-08-11 | Untrusted pointer dereference in Windows GDI allows an authorized attacker to disclose information locally. |
CVE-2026-61350 | Medium | 4.6 | 2026-08-11 | Buffer over-read in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack. |
CVE-2026-61347 | Medium | 5.5 | 2026-08-11 | Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally. |
CVE-2026-61345 | Medium | 6.5 | 2026-08-11 | Null pointer dereference in Microsoft Remote Registry Service allows an authorized attacker to deny service over a network. |
CVE-2026-59138 | Medium | 6.5 | 2026-08-11 | Null pointer dereference in Microsoft Remote Registry Service allows an authorized attacker to deny service over a network. |
CVE-2026-59137 | Medium | 5.5 | 2026-08-11 | Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally. |
CVE-2026-59136 | Medium | 5.5 | 2026-08-11 | Use of uninitialized resource in Microsoft COM for Windows allows an authorized attacker to disclose information locally. |
CVE-2026-59135 | Medium | 5.5 | 2026-08-11 | Weak authentication in Microsoft Windows Search Component allows an authorized attacker to disclose information locally. |