Medium-severity CVEs (page 74)
Page 74 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-27765 | Medium | 5.5 | 2026-08-11 | Improper input validation for some vLLM Hardware Plugin for Intel(R) Gaudi(R) software before version 0.16.0 within Ring 3: User Applications may allow a denia… |
CVE-2026-24099 | Medium | 5.1 | 2026-08-11 | Use after free for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 0: Kernel may allow a denial of service. System software adversary with… |
CVE-2026-21269 | Medium | 4.6 | 2026-08-11 | ColdFusion is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into… |
CVE-2026-20913 | Medium | 5.3 | 2026-08-11 | Improper input validation for some Intel(R) Neural Compressor software before version v3.7 within Ring 3: User Applications may allow an escalation of privileg… |
CVE-2026-20908 | Medium | 5.3 | 2026-08-11 | Time-of-check time-of-use race condition for the Intel(R) NPU Driver for Windows for all versions within Ring 1: Device Drivers may allow a denial of service… |
CVE-2026-20906 | Medium | 6.7 | 2026-08-11 | Protection mechanism failure for some Intel(R) Neural Compressor software before version v3.6 within Ring 3: User Applications may allow an escalation of privi… |
CVE-2026-20786 | Medium | 6.1 | 2026-08-11 | Out-of-bounds read for the Intel(R) NPU Driver for all versions within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary… |
CVE-2026-20783 | Medium | 6.1 | 2026-08-11 | Improper conditions check in the firmware for the Intel(R) NPU Driver for all versions within Ring 1: Device Drivers may allow a denial of service. Unprivilege… |
CVE-2026-20780 | Medium | 6.5 | 2026-08-11 | Uncontrolled resource consumption for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of service. Unpr… |
CVE-2026-20778 | Medium | 6.8 | 2026-08-11 | Out-of-bounds read for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 0: Kernel may allow a denial of service. Unprivileged software adver… |
CVE-2026-20775 | Medium | 5.3 | 2026-08-11 | Uncaught exception for some Intel(R) TDX modules within Ring 0: Trust Domain may allow a denial of service. System software adversary with a privileged user co… |
CVE-2026-20769 | Medium | 6.1 | 2026-08-11 | Improper conditions check for the Intel(R) NPU Driver for all versions within Ring 3: User Applications may allow a denial of service. Unprivileged software ad… |
CVE-2026-20765 | Medium | 4.2 | 2026-08-11 | Incorrect comparison for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may allow an escalation of privilege. System so… |
CVE-2026-20763 | Medium | 4.2 | 2026-08-11 | Incorrect calculation for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may allow an escalation of privilege. System s… |
CVE-2026-20752 | Medium | 4.4 | 2026-08-11 | Improper authentication for some Intel(R) PROSet/Wireless WiFi Software within Ring 0: Kernel may allow an information disclosure. System software adversary wi… |
CVE-2026-20747 | Medium | 6.5 | 2026-08-11 | Improper conditions check for some Intel(R) PROSet/Wireless WiFi Software within Ring 2: Device Drivers may allow a denial of service. Network adversary with a… |
CVE-2026-20731 | Medium | 6.1 | 2026-08-11 | Improper buffer restrictions for the Intel(R) NPU Driver for all versions within Ring 3: User Applications may allow a denial of service. Unprivileged software… |
CVE-2026-20705 | Medium | 5.3 | 2026-08-11 | Insecure storage of sensitive information in the Intel(R) TDX module for some Intel(R) platform within Ring 0: Trust Domain may allow information disclosure. S… |
CVE-2025-31936 | Medium | 5.7 | 2026-08-11 | Improper handling of overlap between protected memory ranges for some Intel(R) Xeon(R) 6 processors when using Intel(R) TDX within SMM may allow an escalation… |
CVE-2026-9214 | Medium | 4.5 | 2026-08-11 | Insufficient input validation vulnerability in the NETGEAR R7000 models allows authenticated administrators connected to the local network to make unauthoriz… |
CVE-2026-73070 | Medium | 5.5 | 2026-08-11 | Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in src/socketserver.c accepts unbounded client connections in soc… |
CVE-2026-73068 | Medium | 5.9 | 2026-08-11 | ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.207, the ToolJet… |
CVE-2026-6727 | Medium | 5.9 | 2026-08-11 | A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may… |
CVE-2026-56720 | Medium | 4.3 | 2026-08-11 | CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access… |
CVE-2026-53414 | Medium | 6.5 | 2026-08-11 | Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting participant to conduct a denial of service on… |
CVE-2026-19078 | Medium | 4.3 | 2026-08-11 | A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the grant approval handler is not properly… |
CVE-2026-18638 | Medium | 6.5 | 2026-08-11 | Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling Set… |
CVE-2026-14180 | Medium | 5.3 | 2026-08-11 | A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issu… |
CVE-2026-11814 | Medium | 6.8 | 2026-08-11 | A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to intercept and modify local network traffi… |
CVE-2026-11739 | Medium | 6.4 | 2026-08-11 | A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a network-adjacent attacker with the ability to intercept and modify l… |
CVE-2026-11738 | Medium | 4.4 | 2026-08-11 | Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorize… |
CVE-2026-11737 | Medium | 4.5 | 2026-08-11 | Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthori… |
CVE-2026-11736 | Medium | 4.9 | 2026-08-11 | A stack-based buffer overflow vulnerability affects certain NETGEAR models allowing an authenticated admin user to make unauthorized modification to router sof… |
CVE-2026-11735 | Medium | 4.9 | 2026-08-11 | A stack-based buffer overflow vulnerability affects the listed NETGEAR models allowing an authenticated admin user to make unauthorized modification to the rou… |
CVE-2026-11733 | Medium | 4.9 | 2026-08-11 | A buffer overflow vulnerability in the listed NETGEAR models allows a device administrator to temporarily interrupt the normal operation of the affected device. |
CVE-2026-72925 | Medium | 6.1 | 2026-08-11 | SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0, the minifyJson processin… |
CVE-2026-18636 | Medium | 6.8 | 2026-08-11 | The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore. To prevent users from reading sensitive files or accessing… |
CVE-2026-17535 | Medium | 6.2 | 2026-08-11 | Velociraptor's NTFS parsing library mishandles several out of bound and memory exhaustion bugs which may be triggered by maliciously crafted NTFS images. Typi… |
CVE-2026-72785 | Medium | 4.3 | 2026-08-11 | Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission (without… |
CVE-2026-72784 | Medium | 5.4 | 2026-08-11 | Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL save<Volume>Ass… |
CVE-2026-72783 | Medium | 6.2 | 2026-08-11 | Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the ensurePathIsContained functio… |
CVE-2026-72782 | Medium | 6.5 | 2026-08-11 | Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets (via ${ENV_VAR} strings in the eleme… |
CVE-2026-72780 | Medium | 6.5 | 2026-08-11 | Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay ca… |
CVE-2026-72779 | Medium | 4.5 | 2026-08-11 | Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The create() Twig function restricts class instanti… |
CVE-2026-72774 | Medium | 6.5 | 2026-08-11 | n8n before 1.123.67, 2.31.5, and 2.32.1 contains a credential authorization bypass in the HTTP Request node. An authenticated member with edit access to a shar… |
CVE-2026-72771 | Medium | 6.5 | 2026-08-11 | n8n versions before 2.32.1 fail to enforce the Allowed HTTP Request Domains allowlist in multiple AI and LLM nodes when user-supplied base or endpoint URLs are… |
CVE-2026-72770 | Medium | 6.5 | 2026-08-11 | n8n versions before 1.123.67 contain a path traversal vulnerability in the Git node's fetch, pull, and push-tags operations that allows authenticated users to… |
CVE-2026-72763 | Medium | 6.5 | 2026-08-11 | n8n before 1.123.67, 2.31.5, and 2.32.1 validates credential-access only for a node's top-level credentials and not for credentials referenced inside an Execut… |
CVE-2026-72749 | Medium | 6.5 | 2026-08-11 | n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields (Set) node. The node assigns output fields via a dot-no… |
CVE-2026-72744 | Medium | 6.2 | 2026-08-11 | Nuxt versions >= 4.4.7 and < 4.5.1, and >= 3.21.7 and < 3.21.10, contain an information disclosure vulnerability in the development server's Chrome DevTools wo… |
CVE-2026-69108 | Medium | 6.0 | 2026-08-11 | A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.1). The affected application is vulnerable to a local privilege escalati… |
CVE-2026-59693 | Medium | 4.3 | 2026-08-11 | A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.233.16-7862), Desigo PXC3 (All versions < V01.21.233.16-7862), Desigo PXC4 (All versi… |
CVE-2026-57263 | Medium | 6.8 | 2026-08-11 | A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). The project password feature in the affected products stores the password as an… |
CVE-2026-57262 | Medium | 6.8 | 2026-08-11 | A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). Affected products use a static, hardcoded AES master key to encrypt project file… |
CVE-2026-72610 | Medium | 4.3 | 2026-08-11 | A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the borrowers => edit_borrowers… |
CVE-2026-72608 | Medium | 6.5 | 2026-08-11 | A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => label_creator perm… |
CVE-2026-72604 | Medium | 6.5 | 2026-08-11 | A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the adm… |
CVE-2026-72598 | Medium | 6.5 | 2026-08-11 | A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the server issue HTTP requests to internal ne… |
CVE-2026-72597 | Medium | 6.5 | 2026-08-11 | A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe… |
CVE-2026-72560 | Medium | 6.5 | 2026-08-11 | A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRF_PROTECTION_ENABLED is set to false by default… |
CVE-2026-72559 | Medium | 5.4 | 2026-08-11 | A stored cross-site scripting vulnerability in HortusFox 5.9 allows authenticated workspace members to inject persistent JavaScript into plant notes via Parsed… |
CVE-2026-72554 | Medium | 6.5 | 2026-08-11 | A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows any self-registered customer to read ticket conversations belonging… |
CVE-2026-72553 | Medium | 5.4 | 2026-08-11 | A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member to inject persistent JavaScript into the profile fields cu… |
CVE-2026-72549 | Medium | 5.3 | 2026-08-11 | An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to map any email address or username to… |
CVE-2026-72542 | Medium | 5.4 | 2026-08-11 | A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write job progress and read job metrics for a… |
CVE-2026-72541 | Medium | 6.5 | 2026-08-11 | A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema… |
CVE-2026-72539 | Medium | 6.5 | 2026-08-11 | An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scri… |
CVE-2026-33922 | Medium | 6.0 | 2026-08-11 | A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input param… |
CVE-2026-33921 | Medium | 5.2 | 2026-08-11 | The Windows installer deployed Npcap leaving its access restriction option at the insecure default value, so the driver was accessible to every local user of t… |
CVE-2026-71218 | Medium | 5.3 | 2026-08-11 | A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the `JSON_read()` function, which accepts a peer-controlled messag… |
CVE-2026-19519 | Medium | 4.3 | 2026-08-11 | A flaw was found in claircore's RPM package scanner. Crafted RPM header data in a container layer can cause an unchecked type assertion to panic the scanner. T… |
CVE-2026-19518 | Medium | 6.5 | 2026-08-11 | Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipulation. |
CVE-2026-19517 | Medium | 6.5 | 2026-08-11 | Improper Validation of Specified Quantity in Input and Allocation of Resources Without Limits or Throttling vulnerability in Samsung Open Source rlottie allows… |
CVE-2026-19391 | Medium | 6.5 | 2026-08-11 | A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows… |
CVE-2026-8158 | Medium | 5.3 | 2026-08-11 | The Signed Video Framework contained a buffer overflow issue which could lead the application using this framework to crash. The issue exclusively affects th… |
CVE-2026-6505 | Medium | 5.1 | 2026-08-11 | The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. This vulnerability ca… |
CVE-2026-6181 | Medium | 5.9 | 2026-08-11 | The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can only be exploited after authenticating with a viewer-privilege… |
CVE-2026-5304 | Medium | 5.7 | 2026-08-11 | An ACAP configuration file lacks input validation, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis d… |
CVE-2026-5303 | Medium | 5.7 | 2026-08-11 | The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. This vulnerability ca… |
CVE-2026-18348 | Medium | 4.1 | 2026-08-11 | Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role user can initiate attacker-contro… |
CVE-2026-14549 | Medium | 4.3 | 2026-08-11 | The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenti… |
CVE-2026-14548 | Medium | 6.5 | 2026-08-11 | The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenti… |
CVE-2026-12052 | Medium | 5.2 | 2026-08-11 | The USB device-side CDC NCM class control-to-host handler usbd_cdc_ncm_cth in subsys/usb/device_next/class/usbd_cdc_ncm.c builds a fixed-size response for the… |
CVE-2026-12051 | Medium | 4.6 | 2026-08-11 | The USB DFU class implementation in Zephyr's new (experimental) device_next USB device stack contains a NULL pointer dereference in handle_download() (subsys/u… |
CVE-2026-11894 | Medium | 5.9 | 2026-08-11 | The Realtek BEE Bluetooth HCI driver's send callback, bt_hci_bee_send() in drivers/bluetooth/hci/hci_bee.c, violated the bt_hci_driver_api buffer-ownership con… |
CVE-2026-16974 | Medium | 6.4 | 2026-08-11 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post_meta Shortcode i… |
CVE-2026-11893 | Medium | 5.9 | 2026-08-11 | The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers (BL60x/BL70x/BL61x), bt_bflb_send() in drivers/bluetooth/hci/hci_bflb.c, violates the bt_hci_… |
CVE-2026-24330 | Medium | 6.5 | 2026-08-11 | A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file from an untrusted so… |
CVE-2026-24329 | Medium | 4.9 | 2026-08-11 | A flaw was found in wildfly-core. A remote user authenticated as an administrative user can inject a malformed payload into the Inet Address field through the… |
CVE-2026-66779 | Medium | 6.3 | 2026-08-11 | Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP, an authenticated attacker could generate a malicious link and make… |
CVE-2026-66778 | Medium | 5.3 | 2026-08-11 | SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components. An unauthenticated attacker could send a… |
CVE-2026-66777 | Medium | 5.9 | 2026-08-11 | SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend destinations. Due to the complexity of the required co… |
CVE-2026-66776 | Medium | 5.9 | 2026-08-11 | SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low p… |
CVE-2026-66775 | Medium | 4.3 | 2026-08-11 | SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious… |
CVE-2026-66773 | Medium | 5.9 | 2026-08-11 | A malicious or compromised OData service could disclose sensitive authentication information and inject untrusted data into the application, which may leads to… |
CVE-2026-66772 | Medium | 4.3 | 2026-08-11 | SAP BusinessObjects Business Intelligence Platform (Admin Tools) does not perform sufficient authorization check on certain administrative functionality. An a… |
CVE-2026-66771 | Medium | 6.1 | 2026-08-11 | SAPUI5 allows a key user with content adaptation privileges to inject malicious script content into persisted application changes. When another user subsequent… |
CVE-2026-66770 | Medium | 6.3 | 2026-08-11 | Due to an SQL Injection vulnerability in SAP Social intelligence, an authenticated attacker could directly inject an SQL DDL (Data Definition Language) string… |
CVE-2026-66764 | Medium | 4.3 | 2026-08-11 | Reprocess Bank Statement Items in SAP S/4HANA does not perform the necessary authorization checks for authenticated users, allowing them to use rules that have… |
CVE-2026-66761 | Medium | 4.3 | 2026-08-11 | SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consum… |