Medium-severity CVEs (page 76)
Page 76 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-11138 | Medium | 6.5 | 2026-06-04 | Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium secur… |
CVE-2026-11137 | Medium | 6.5 | 2026-06-04 | Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory vi… |
CVE-2026-11135 | Medium | 6.5 | 2026-06-04 | Insufficient policy enforcement in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access control via a craf… |
CVE-2026-11134 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chr… |
CVE-2026-11133 | Medium | 6.5 | 2026-06-04 | Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page… |
CVE-2026-11132 | Medium | 6.5 | 2026-06-04 | Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page… |
CVE-2026-11129 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page… |
CVE-2026-11128 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Web Share in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestu… |
CVE-2026-11127 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in WebAPKs in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafted W… |
CVE-2026-11126 | Medium | 4.3 | 2026-06-04 | Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to l… |
CVE-2026-11123 | Medium | 6.5 | 2026-06-04 | Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory vi… |
CVE-2026-11122 | Medium | 6.1 | 2026-06-04 | Inappropriate implementation in Keyboard in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a cra… |
CVE-2026-11121 | Medium | 6.5 | 2026-06-04 | Insufficient validation of untrusted input in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process t… |
CVE-2026-11110 | Medium | 6.5 | 2026-06-04 | Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium secur… |
CVE-2026-11109 | Medium | 6.5 | 2026-06-04 | Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium secur… |
CVE-2026-11107 | Medium | 4.3 | 2026-06-04 | Inappropriate implementation in Downloads in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2026-11106 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chr… |
CVE-2026-11105 | Medium | 6.5 | 2026-06-04 | Insufficient validation of untrusted input in WebUI in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-11104 | Medium | 6.5 | 2026-06-04 | Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sen… |
CVE-2026-11101 | Medium | 6.5 | 2026-06-04 | Uninitialized Use in Dawn in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chro… |
CVE-2026-11098 | Medium | 5.3 | 2026-06-04 | Insufficient validation of untrusted input in GPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-11097 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HT… |
CVE-2026-11096 | Medium | 6.5 | 2026-06-04 | Out of bounds read in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory… |
CVE-2026-11093 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Printing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cro… |
CVE-2026-11090 | Medium | 6.5 | 2026-06-04 | Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium secur… |
CVE-2026-11089 | Medium | 6.5 | 2026-06-04 | Uninitialized Use in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sen… |
CVE-2026-11087 | Medium | 6.5 | 2026-06-04 | Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data… |
CVE-2026-11084 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2026-11083 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2026-11081 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Canvas in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page… |
CVE-2026-11078 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in FileSystem in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass… |
CVE-2026-11075 | Medium | 6.5 | 2026-06-04 | Out of bounds read in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via… |
CVE-2026-11073 | Medium | 6.5 | 2026-06-04 | Use after free in WebGL in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a… |
CVE-2026-11069 | Medium | 6.5 | 2026-06-04 | Insufficient validation of untrusted input in Cast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted… |
CVE-2026-11067 | Medium | 6.5 | 2026-06-04 | Uninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via… |
CVE-2026-11064 | Medium | 6.5 | 2026-06-04 | Race in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via… |
CVE-2026-11062 | Medium | 4.3 | 2026-06-04 | Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2026-11057 | Medium | 6.5 | 2026-06-04 | Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sens… |
CVE-2026-11051 | Medium | 6.5 | 2026-06-04 | Out of bounds read in ANGLE in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process… |
CVE-2026-11048 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to… |
CVE-2026-11045 | Medium | 6.5 | 2026-06-04 | Insufficient validation of untrusted input in GPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-11044 | Medium | 6.5 | 2026-06-04 | Integer overflow in ANGLE in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process mem… |
CVE-2026-11039 | Medium | 6.5 | 2026-06-04 | Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium securi… |
CVE-2026-11038 | Medium | 6.5 | 2026-06-04 | Insufficient policy enforcement in Subresource Integrity in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass content security policy vi… |
CVE-2026-11036 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in DOM in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Ch… |
CVE-2026-11034 | Medium | 6.1 | 2026-06-04 | Insufficient validation of untrusted input in Tab Group Sync in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary s… |
CVE-2026-11033 | Medium | 6.5 | 2026-06-04 | Uninitialized Use in WebML in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process me… |
CVE-2026-11032 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2026-11031 | Medium | 4.3 | 2026-06-04 | Insufficient validation of untrusted input in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via mal… |
CVE-2026-11027 | Medium | 6.5 | 2026-06-04 | Insufficient validation of untrusted input in Glic in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process t… |
CVE-2026-11026 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to… |
CVE-2026-11025 | Medium | 6.5 | 2026-06-04 | Insufficient policy enforcement in Navigation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to bypass content security policy vi… |
CVE-2026-11023 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in WebAppInstalls in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to by… |
CVE-2026-11022 | Medium | 6.5 | 2026-06-04 | Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer proce… |
CVE-2026-11020 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted XML file… |
CVE-2026-11019 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Payments in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-11018 | Medium | 6.5 | 2026-06-04 | Insufficient policy enforcement in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML… |
CVE-2026-11017 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Link Preview in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypa… |
CVE-2026-11016 | Medium | 6.5 | 2026-06-04 | Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer proces… |
CVE-2026-11014 | Medium | 6.5 | 2026-06-04 | Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2026-11013 | Medium | 6.5 | 2026-06-04 | Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer proces… |
CVE-2026-11008 | Medium | 6.5 | 2026-06-04 | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer… |
CVE-2026-11007 | Medium | 6.5 | 2026-06-04 | Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the rend… |
CVE-2026-11006 | Medium | 6.5 | 2026-06-04 | Out of bounds read in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (… |
CVE-2026-11005 | Medium | 5.3 | 2026-06-04 | Out of bounds read in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain pot… |
CVE-2026-11004 | Medium | 5.3 | 2026-06-04 | Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially se… |
CVE-2026-11001 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Payments in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
CVE-2026-10999 | Medium | 6.5 | 2026-06-04 | Integer overflow in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain poten… |
CVE-2026-10998 | Medium | 4.0 | 2026-06-04 | Out of bounds read in Media in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to perform an out of bounds memory read vi… |
CVE-2026-10997 | Medium | 6.5 | 2026-06-04 | Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2026-10996 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Workers in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page… |
CVE-2026-10994 | Medium | 6.5 | 2026-06-04 | Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory vi… |
CVE-2026-10993 | Medium | 6.5 | 2026-06-04 | Heap buffer overflow in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory… |
CVE-2026-10992 | Medium | 6.5 | 2026-06-04 | Insufficient data validation in Animation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from pr… |
CVE-2026-10985 | Medium | 6.5 | 2026-06-04 | Out of bounds read in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium secur… |
CVE-2026-10984 | Medium | 5.4 | 2026-06-04 | Inappropriate implementation in Accessibility in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted… |
CVE-2026-10981 | Medium | 6.5 | 2026-06-04 | Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-10980 | Medium | 6.5 | 2026-06-04 | Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer proce… |
CVE-2026-10979 | Medium | 6.5 | 2026-06-04 | Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2026-10977 | Medium | 6.5 | 2026-06-04 | Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data… |
CVE-2026-10950 | Medium | 6.5 | 2026-06-04 | Insufficient policy enforcement in Autofill in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HT… |
CVE-2026-10944 | Medium | 6.5 | 2026-06-04 | Insufficient policy enforcement in Autofill in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HT… |
CVE-2026-10938 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass site… |
CVE-2026-10937 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML pag… |
CVE-2026-10916 | Medium | 6.1 | 2026-06-04 | Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer proce… |
CVE-2026-10912 | Medium | 6.5 | 2026-06-04 | Insufficient validation of untrusted input in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer pro… |
CVE-2026-10875 | Medium | 6.3 | 2026-06-04 | A security flaw has been discovered in projectworlds Online Art Gallery Shop Project 1.0. The impacted element is an unknown function of the file /admin/adminH… |
CVE-2026-10874 | Medium | 6.3 | 2026-06-04 | A vulnerability was identified in projectworlds Online Art Gallery Shop Project 1.0. The affected element is an unknown function of the file /admin/adminHome.p… |
CVE-2024-27891 | Medium | 5.3 | 2026-06-04 | On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egress… |
CVE-2023-5502 | Medium | 5.9 | 2026-06-04 | On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, and routing enabled on the access VLAN of the ports… |
CVE-2026-42547 | Medium | 5.4 | 2026-06-04 | IRIS is a web collaborative platform that helps incident responders share technical details during investigations. In versions prior to 2.4.28, users can creat… |
CVE-2026-42543 | Medium | 4.3 | 2026-06-04 | IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 are vulnerable to a… |
CVE-2026-42540 | Medium | 4.3 | 2026-06-04 | IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 allow a user to alt… |
CVE-2026-42539 | Medium | 6.5 | 2026-06-04 | IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 return sensitive da… |
CVE-2026-11322 | Medium | 6.5 | 2026-06-04 | Hermes WebUI prior to v0.51.221 contains a path traversal vulnerability that allows attackers to escape the workspace boundary by supplying symlinks that resol… |
CVE-2024-6858 | Medium | 6.5 | 2026-06-04 | In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the f… |
CVE-2026-5066 | Medium | 6.3 | 2026-06-04 | A potential out-of-bounds write/read exists in the TLS socket connect path of the network sockets subsystem (subsys/net/lib/sockets/sockets_tls.c). When the TL… |
CVE-2026-42538 | Medium | 6.3 | 2026-06-04 | IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 do not properly val… |
CVE-2026-42329 | Medium | 4.7 | 2026-06-04 | Iris is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 contain a weakness… |
CVE-2026-5589 | Medium | 6.3 | 2026-06-04 | An integer underflow in bt_mesh_sol_recv() in the Bluetooth Mesh solicitation handling (subsys/bluetooth/mesh/solicitation.c) leads to an out-of-bounds write… |