Medium-severity CVEs (page 82)
Page 82 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-43979 | Medium | 5.0 | 2026-05-28 | Local Deep Research is an AI-powered research assistant for deep, iterative research. Prior to 1.6.0, PDFService._markdown_to_html() constructs an HTML documen… |
CVE-2026-43000 | Medium | 6.0 | 2026-05-28 | An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the mem… |
CVE-2026-42999 | Medium | 6.0 | 2026-05-28 | An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call unconditionally merges the raw JSON request body… |
CVE-2026-42998 | Medium | 6.0 | 2026-05-28 | An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin does not verify that the user supplied i… |
CVE-2026-46561 | Medium | 5.0 | 2026-05-28 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the PREREQFUNCTION-based private IP check was not applied to HTTP… |
CVE-2026-45307 | Medium | 6.1 | 2026-05-28 | Speakr is a personal, self-hosted web application designed for transcribing audio recordings. Prior to 0.8.20-alpha, the is_safe_url() helper used to validate… |
CVE-2026-45306 | Medium | 6.5 | 2026-05-28 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the fix for CVE-2026-33509 prevents setting storage_folder inside… |
CVE-2026-44796 | Medium | 6.5 | 2026-05-28 | Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot UI object-bulk-rename endpoints (for example, /dcim/… |
CVE-2026-44794 | Medium | 5.4 | 2026-05-28 | Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, in the case of inter-object references via GenericForeignKey… |
CVE-2026-9091 | Medium | 5.3 | 2026-05-28 | Casdoor versions 2.362.0 and earlier contain a logic flaw in the social‑login binding flow that allows users to bypass configured MFA requirements. The binding… |
CVE-2026-47676 | Medium | 5.3 | 2026-05-28 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, app.mount() strips the mount prefix from the incoming r… |
CVE-2026-47675 | Medium | 4.3 | 2026-05-28 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the serialize() function in hono/cookie validates domai… |
CVE-2026-47674 | Medium | 5.3 | 2026-05-28 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) com… |
CVE-2026-47673 | Medium | 4.8 | 2026-05-28 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the jwt and jwk middlewares do not verify that the Auth… |
CVE-2026-45292 | Medium | 5.3 | 2026-05-28 | opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1… |
CVE-2026-45078 | Medium | 5.5 | 2026-05-28 | Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, local authenticated users can cause Synapse to starve other requests of CPU and l… |
CVE-2026-44462 | Medium | 6.4 | 2026-05-28 | Zed is a code editor. Prior to 0.229.0, Zed's terminal tool permission system can be bypassed via bash variable expansion chaining (${var@P}), allowing arbitra… |
CVE-2026-41185 | Medium | 6.5 | 2026-05-28 | When Calico is configured with the Azure IPAM plugin, the Calico CNI binary mutates the incoming CNI configuration to attach subnet information before delegati… |
CVE-2026-41184 | Medium | 6.5 | 2026-05-28 | In Calico, the install-cni init container logs the rendered CNI configuration to standard output. When the configuration template uses the __SERVICEACCOUNT_TOK… |
CVE-2026-41160 | Medium | 4.3 | 2026-05-28 | EspoCRM is an open source customer relationship management application. Prior to 9.3.5, a business logic flaw (Broken Access Control) in EspoCRM 9.3.3 allows l… |
CVE-2026-41141 | Medium | 6.5 | 2026-05-28 | EspoCRM is an open source customer relationship management application. Prior to 9.3.5, the POST /api/v1/EmailTemplate/:id/prepare endpoint accepts an emailAdd… |
CVE-2026-48735 | Medium | 5.5 | 2026-05-28 | pypdf is a free and open-source pure-python PDF library. Prior to 6.12.1, an attacker who uses this vulnerability can craft a PDF which leads to large memory u… |
CVE-2026-48525 | Medium | 5.3 | 2026-05-28 | PyJWT is a JSON Web Token implementation in Python. From 2.8.0 to 2.12.1, when verifying detached JWS tokens using the unencoded-payload option ("b64": false… |
CVE-2026-48523 | Medium | 5.4 | 2026-05-28 | PyJWT is a JSON Web Token implementation in Python. From 2.9.0 to 2.12.1, there is a verifier-side algorithm allow-list bypass when jwt.decode() or jwt.decode_… |
CVE-2026-48522 | Medium | 4.2 | 2026-05-28 | PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen() which uses Python… |
CVE-2026-48155 | Medium | 5.5 | 2026-05-28 | pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory u… |
CVE-2026-40914 | Medium | 4.3 | 2026-05-28 | A vulnerability exists in Apache Artemis whereby an application using the STOMP protocol with security credentials that grant either the consume or send permis… |
CVE-2026-46239 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov5647: Fix runtime PM refcount leak in s_ctrl Three control cases (AUTOGAIN… |
CVE-2026-46236 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: media: rc: xbox_remote: heed DMA restrictions The buffer for IO must not be part of the d… |
CVE-2026-46235 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: media: saa7164: add ioremap return checks and cleanups Add checks for ioremap return valu… |
CVE-2026-46233 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: only purge non-released claims When batadv_bla_purge_claims() goes throu… |
CVE-2026-46231 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: put backbone reference on failed claim hash insert When batadv_bla_add_c… |
CVE-2026-46229 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure KFD VRAM allocations… |
CVE-2026-46228 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: spi: ch341: fix devres lifetime USB drivers bind to USB interfaces and any device managed… |
CVE-2026-46226 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: spi: fsl: fix controller deregistration Make sure to deregister the controller before rel… |
CVE-2026-46225 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: spi: rspi: fix controller deregistration Make sure to deregister the controller before re… |
CVE-2026-46224 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure When drm_gpuvm_resv_ob… |
CVE-2026-46223 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: cgroup: Defer css percpu_ref kill on rmdir until cgroup is depopulated A chain of commits… |
CVE-2026-46222 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: media: rockchip: rkcif: Add missing MUST_CONNECT flag to pads The pads missed checks for… |
CVE-2026-46221 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: EDAC/versalnet: Fix device name memory leak The device name allocated via kzalloc() in in… |
CVE-2026-46220 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission sdma_v4_0_ring_emit_fence… |
CVE-2026-46216 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/hdcp: Add NULL check for media_gt in intel_hdcp_gsc_check_status() When media GT i… |
CVE-2026-46214 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix accept queue count leak on transport mismatch virtio_transport_recv_lis… |
CVE-2026-46211 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() msm_ioctl_gem_info_g… |
CVE-2026-46207 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix empty payload in tap skb for non-linear buffers For non-linear skbs, vi… |
CVE-2026-46202 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: HID: appletb-kbd: run inactivity autodim from workqueues The autodim code in hid-appletb-… |
CVE-2026-46200 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: spi: mpc52xx: fix controller deregistration Make sure to deregister the controller before… |
CVE-2026-46196 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() When a trace… |
CVE-2026-46193 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: xfrm: ah: account for ESN high bits in async callbacks AH allocates its temporary auth/IC… |
CVE-2026-46192 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: spi: microchip-core-qspi: don't attempt to transmit during emulated read-only dual/quad op… |
CVE-2026-46188 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: octeon_ep_vf: add NULL check for napi_build_skb() napi_build_skb() can return NULL on all… |
CVE-2026-46187 | Medium | 4.7 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix kthread lifetime race between self-exit and external-stop RSI driver use b… |
CVE-2026-46186 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtio_bt: validate rx pkt_type header length virtbt_rx_handle() reads the lea… |
CVE-2026-46184 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: sound: ua101: fix division by zero at probe Add a missing sanity check for bNrChannels in… |
CVE-2026-46182 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace The hdr variable is al… |
CVE-2026-46179 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Don't allow pointer operations on unconfigured streams When reporting the poin… |
CVE-2026-46172 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() xfrm6_rcv_encap() performs an IPv6… |
CVE-2026-46171 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: riscv: kvm: fix vector context allocation leak When the second kzalloc (host_context.vect… |
CVE-2026-46170 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADD_ADDR rtx: free sk if last When an ADD_ADDR is retransmitted, the sk is hel… |
CVE-2026-46169 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix uninit-value by validating catalog record size Syzbot reported a KMSAN unini… |
CVE-2026-46168 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: mptcp: fix scheduling with atomic in timestamp sockopt Using lock_sock_fast() (atomic con… |
CVE-2026-46167 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Just like in a previous pro… |
CVE-2026-46165 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: openvswitch: vport: fix self-deadlock on release of tunnel ports vports are used concurre… |
CVE-2026-46161 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix divide-by-zero in setup_geo() with zero far_copies setup_geo() extracts ne… |
CVE-2026-46160 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix missing last_unlink_trans update when removing a directory When removing a dir… |
CVE-2026-46159 | Medium | 4.7 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak btrfs_i… |
CVE-2026-46158 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount When an ADD_ADDR is retransmitted, t… |
CVE-2026-46156 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() The switch case in loongson… |
CVE-2026-46153 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: 8021q: delete cleared egress QoS mappings vlan_dev_set_egress_priority() currently keeps… |
CVE-2026-46151 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: usb: usblp: fix heap leak in IEEE 1284 device ID via short response usblp_ctrl_msg() coll… |
CVE-2026-46148 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: spi: microchip-core-qspi: control built-in cs manually The coreQSPI IP supports only a si… |
CVE-2026-46147 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() Two bugs exist in… |
CVE-2026-46146 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() The convert_chmap_v3(… |
CVE-2026-46144 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() Sashiko points out that mana_ib_cf… |
CVE-2026-46143 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens As prepare can be called mulitple t… |
CVE-2026-46142 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix VF illegal register access Register WX_CFG_PORT_ST is a PF restricted reg… |
CVE-2026-46141 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: powerpc/xive: fix kmemleak caused by incorrect chip_data lookup The kmemleak reports the… |
CVE-2026-46139 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: smb: client: use kzalloc to zero-initialize security descriptor buffer Commit 62e7dd0a39c… |
CVE-2026-46134 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration cros_typec_registe… |
CVE-2026-46132 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo rtnl_f… |
CVE-2026-46131 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: check for nEPT/nNPT in slow flush hypercalls Checking is_guest_mode(vcpu) is in… |
CVE-2026-46128 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: ipmi: Check event message buffer response for bad data The event message buffer response… |
CVE-2026-46127 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Sashiko points out… |
CVE-2026-46126 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() Sashiko points ou… |
CVE-2026-46118 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: pseries/papr-hvpipe: Fix null ptr deref in papr_hvpipe_dev_create_handle() commit 6d3789d… |
CVE-2026-46109 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: usb: ulpi: fix memory leak on ulpi_register() error paths Commit 01af542392b5 ("usb: ulpi… |
CVE-2026-46108 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: ipmi:si: Return state to normal if message allocation fails There were places where nothi… |
CVE-2026-46106 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: eventfs: Hold eventfs_mutex and SRCU when remount walks events Commit 340f0c7067a9 ("even… |
CVE-2026-46104 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: selinux: use sk blob accessor in socket permission helpers SELinux socket state lives in… |
CVE-2025-48977 | Medium | 6.5 | 2026-05-28 | Relative Path Traversal vulnerability in Apache Ignite REST API. Authenticated REST API users can read any file on the server with "cmd=log" command and a log… |
CVE-2026-9807 | Medium | 4.3 | 2026-05-28 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain… |
CVE-2026-9015 | Medium | 4.3 | 2026-05-28 | The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress is vulnerable to authorization bypass in all versio… |
CVE-2026-8689 | Medium | 4.3 | 2026-05-28 | The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.11… |
CVE-2026-7526 | Medium | 4.3 | 2026-05-28 | The PDF Embedder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.9.3 via the enqueue_block_assets… |
CVE-2026-7048 | Medium | 6.5 | 2026-05-28 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'order_by' parameter in… |
CVE-2026-6937 | Medium | 5.3 | 2026-05-28 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Missing Authorization in all versions up t… |
CVE-2026-4334 | Medium | 6.4 | 2026-05-28 | The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headline' parameter in the [shariff] shortcode in all versions u… |
CVE-2026-9618 | Medium | 4.3 | 2026-05-28 | The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) plugin for WordPress is vulnerable to Cross-Si… |
CVE-2026-8682 | Medium | 4.3 | 2026-05-28 | The 3D Viewer – 3D Model Viewer – Augmented Reality – Virtual Try On plugin for WordPress is vulnerable to authorization bypass in all versions up to, and incl… |
CVE-2026-7660 | Medium | 6.1 | 2026-05-28 | The Easy Updates Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'paged' parameter in versions up to, and including, 9.0.2… |