Medium-severity CVEs (page 75)
Page 75 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-11286 | Medium | 4.3 | 2026-06-05 | Insufficient validation of untrusted input in Wallet in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-11285 | Medium | 4.3 | 2026-06-05 | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HT… |
CVE-2026-11284 | Medium | 6.5 | 2026-06-05 | Side-channel information leakage in PerformanceAPIs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted H… |
CVE-2026-11283 | Medium | 6.5 | 2026-06-05 | Insufficient validation of untrusted input in Shortcuts in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restricti… |
CVE-2026-11281 | Medium | 5.0 | 2026-06-05 | Integer overflow in Chromoting in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to obtain potentially sensitive information from pro… |
CVE-2026-11280 | Medium | 4.3 | 2026-06-05 | Inappropriate implementation in Signin in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page… |
CVE-2026-11278 | Medium | 6.5 | 2026-06-05 | Inappropriate implementation in CustomTabs in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to leak cross-origin data via a crafted… |
CVE-2026-11277 | Medium | 4.3 | 2026-06-05 | Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access contr… |
CVE-2026-11276 | Medium | 5.1 | 2026-06-05 | Inappropriate implementation in Cast in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to bypass discretionary access co… |
CVE-2026-11275 | Medium | 6.5 | 2026-06-05 | Inappropriate implementation in Page Info in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-11274 | Medium | 4.3 | 2026-06-05 | Inappropriate implementation in DOM Distiller in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a… |
CVE-2026-11273 | Medium | 6.1 | 2026-06-05 | Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in speci… |
CVE-2026-11271 | Medium | 6.5 | 2026-06-05 | Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestu… |
CVE-2026-11270 | Medium | 6.5 | 2026-06-05 | Inappropriate implementation in UI in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML pa… |
CVE-2026-11268 | Medium | 6.5 | 2026-06-05 | Uninitialized Use in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chr… |
CVE-2026-11267 | Medium | 4.3 | 2026-06-05 | Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2026-11266 | Medium | 4.3 | 2026-06-05 | Inappropriate implementation in SafeBrowsing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass Safe Browsing via a malicious file. (C… |
CVE-2026-11264 | Medium | 4.3 | 2026-06-05 | Policy bypass in Content Security Policy in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass content security policy via a crafted HTML… |
CVE-2026-11263 | Medium | 6.5 | 2026-06-05 | Insufficient policy enforcement in WebAuthentication in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the rende… |
CVE-2026-11261 | Medium | 4.3 | 2026-06-05 | Inappropriate implementation in PDF in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform UI sp… |
CVE-2026-11260 | Medium | 4.3 | 2026-06-05 | Inappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass content security policy via a crafted H… |
CVE-2026-11259 | Medium | 4.3 | 2026-06-05 | Insufficient validation of untrusted input in Cast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted… |
CVE-2026-11258 | Medium | 6.5 | 2026-06-05 | Inappropriate implementation in File System Access in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific… |
CVE-2026-11257 | Medium | 4.3 | 2026-06-05 | Inappropriate implementation in Browser in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML… |
CVE-2026-11254 | Medium | 4.3 | 2026-06-05 | Inappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2026-11253 | Medium | 4.3 | 2026-06-05 | Inappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page… |
CVE-2026-11252 | Medium | 4.3 | 2026-06-05 | Insufficient policy enforcement in Content Settings in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access control vi… |
CVE-2026-11249 | Medium | 4.7 | 2026-06-05 | Use after free in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sens… |
CVE-2026-11246 | Medium | 5.3 | 2026-06-05 | Insufficient validation of untrusted input in IndexedDB in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer proc… |
CVE-2026-11245 | Medium | 4.3 | 2026-06-05 | Inappropriate implementation in Payments in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chr… |
CVE-2026-11243 | Medium | 5.4 | 2026-06-05 | Inappropriate implementation in Downloads in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTM… |
CVE-2026-11238 | Medium | 5.9 | 2026-06-05 | Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to o… |
CVE-2026-10878 | Medium | 6.3 | 2026-06-05 | A vulnerability was detected in D-Link DWR-M920 1.1.50/1.1.70. Affected is the function sub_41C8E8 of the file /boafrm/formSmsManage. Performing a manipulation… |
CVE-2026-10876 | Medium | 6.3 | 2026-06-05 | A weakness has been identified in SourceCodester Ship Ferry Ticket Reservation System 1.0. This affects an unknown function of the file /admin/. This manipulat… |
CVE-2026-47655 | Medium | 6.5 | 2026-06-04 | Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose information over a network. |
CVE-2026-47644 | Medium | 6.5 | 2026-06-04 | Improper neutralization of special elements in output used by a downstream component ('injection') in Copilot Chat (Microsoft Edge) allows an unauthorized atta… |
CVE-2026-42824 | Medium | 6.5 | 2026-06-04 | Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information ove… |
CVE-2026-11234 | Medium | 4.3 | 2026-06-04 | Inappropriate implementation in FoldableAPIs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypa… |
CVE-2026-11233 | Medium | 4.7 | 2026-06-04 | Insufficient policy enforcement in FoldableAPIs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to b… |
CVE-2026-11232 | Medium | 5.4 | 2026-06-04 | Inappropriate implementation in TabGroups in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via malicious network traffi… |
CVE-2026-11229 | Medium | 6.1 | 2026-06-04 | Inappropriate implementation in Enterprise in Google Chrome prior to 149.0.7827.53 allowed a local attacker to perform privilege escalation via physical access… |
CVE-2026-11228 | Medium | 4.3 | 2026-06-04 | Inappropriate implementation in File Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2026-11227 | Medium | 6.5 | 2026-06-04 | Incorrect security UI in Tab Hover Cards in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafted domain name… |
CVE-2026-11226 | Medium | 6.5 | 2026-06-04 | Insufficient policy enforcement in PreviewTab in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in sp… |
CVE-2026-11225 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in WebUI in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafted domain name. (… |
CVE-2026-11223 | Medium | 6.5 | 2026-06-04 | Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer proces… |
CVE-2026-11222 | Medium | 6.5 | 2026-06-04 | Incorrect security UI in Tab Strip in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chrom… |
CVE-2026-11221 | Medium | 4.3 | 2026-06-04 | Insufficient validation of untrusted input in PointerLock in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer pr… |
CVE-2026-11220 | Medium | 6.5 | 2026-06-04 | Insufficient validation of untrusted input in Navigation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer pro… |
CVE-2026-11219 | Medium | 4.3 | 2026-06-04 | Inappropriate implementation in Navigation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HT… |
CVE-2026-11218 | Medium | 6.8 | 2026-06-04 | Inappropriate implementation in PlatformIntegration in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage… |
CVE-2026-11217 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Fenced Frames in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to byp… |
CVE-2026-11216 | Medium | 4.3 | 2026-06-04 | Incorrect security UI in File Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to… |
CVE-2026-11215 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Cronet in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafted do… |
CVE-2026-11214 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted… |
CVE-2026-11212 | Medium | 4.3 | 2026-06-04 | Insufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension t… |
CVE-2026-11210 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Safe Browsing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access control via a cr… |
CVE-2026-11209 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain… |
CVE-2026-11208 | Medium | 6.5 | 2026-06-04 | Use after free in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via… |
CVE-2026-11206 | Medium | 6.5 | 2026-06-04 | Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2026-11205 | Medium | 6.1 | 2026-06-04 | Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who convinced a user to e… |
CVE-2026-11204 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Signin in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted… |
CVE-2026-11203 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in GPU in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page… |
CVE-2026-11200 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Ch… |
CVE-2026-11199 | Medium | 5.9 | 2026-06-04 | Inappropriate implementation in WebRTC in Google Chrome prior to 149.0.7827.53 allowed an attacker in a privileged network position to leak cross-origin data v… |
CVE-2026-11197 | Medium | 6.5 | 2026-06-04 | Insufficient policy enforcement in Workers in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass… |
CVE-2026-11196 | Medium | 6.5 | 2026-06-04 | Type Confusion in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a c… |
CVE-2026-11195 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in MHTML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures… |
CVE-2026-11194 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (C… |
CVE-2026-11193 | Medium | 6.5 | 2026-06-04 | Insufficient policy enforcement in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access control vi… |
CVE-2026-11192 | Medium | 4.3 | 2026-06-04 | Insufficient validation of untrusted input in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via mal… |
CVE-2026-11190 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to… |
CVE-2026-11189 | Medium | 6.5 | 2026-06-04 | Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious… |
CVE-2026-11187 | Medium | 6.3 | 2026-06-04 | Inappropriate implementation in Glic in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML pag… |
CVE-2026-11186 | Medium | 6.1 | 2026-06-04 | Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted… |
CVE-2026-11184 | Medium | 6.3 | 2026-06-04 | Insufficient policy enforcement in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML… |
CVE-2026-11183 | Medium | 6.5 | 2026-06-04 | Out of bounds read in GWP-ASan in Google Chrome prior to 149.0.7827.53 allowed a local attacker to obtain potentially sensitive information from process memory… |
CVE-2026-11182 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in SVG in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chrom… |
CVE-2026-11181 | Medium | 6.3 | 2026-06-04 | Inappropriate implementation in Media Session in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML… |
CVE-2026-11180 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in SVG in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chrom… |
CVE-2026-11178 | Medium | 4.3 | 2026-06-04 | Insufficient policy enforcement in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted… |
CVE-2026-11176 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chr… |
CVE-2026-11174 | Medium | 5.3 | 2026-06-04 | Inappropriate implementation in Site Isolation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to by… |
CVE-2026-11168 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain… |
CVE-2026-11166 | Medium | 6.8 | 2026-06-04 | Inappropriate implementation in SVG in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted… |
CVE-2026-11162 | Medium | 4.3 | 2026-06-04 | Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chrom… |
CVE-2026-11161 | Medium | 4.3 | 2026-06-04 | Inappropriate implementation in DataTransfer in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML pag… |
CVE-2026-11160 | Medium | 6.5 | 2026-06-04 | Out of bounds read in Input in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process… |
CVE-2026-11159 | Medium | 4.3 | 2026-06-04 | Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium securi… |
CVE-2026-11157 | Medium | 5.4 | 2026-06-04 | Script injection in Accessibility in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to inject a… |
CVE-2026-11156 | Medium | 4.3 | 2026-06-04 | Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chrom… |
CVE-2026-11155 | Medium | 4.3 | 2026-06-04 | Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chrom… |
CVE-2026-11150 | Medium | 6.1 | 2026-06-04 | Inappropriate implementation in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted… |
CVE-2026-11148 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Payments in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to leak cross-origin data via a crafted HT… |
CVE-2026-11145 | Medium | 5.3 | 2026-06-04 | Race in Geolocation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium s… |
CVE-2026-11143 | Medium | 6.5 | 2026-06-04 | Out of bounds read in Extensions in Google Chrome on Linux prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to… |
CVE-2026-11142 | Medium | 6.5 | 2026-06-04 | Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page… |
CVE-2026-11141 | Medium | 6.5 | 2026-06-04 | Uninitialized Use in Audio in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sen… |
CVE-2026-11140 | Medium | 6.5 | 2026-06-04 | Out of bounds read in Chromecast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potential… |
CVE-2026-11139 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chr… |