Medium-severity CVEs (page 85)
Page 85 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-17788 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chr… |
CVE-2026-17787 | Medium | 6.5 | 2026-07-30 | Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page… |
CVE-2026-17785 | Medium | 4.3 | 2026-07-30 | Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium secur… |
CVE-2026-17783 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Loader in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Ch… |
CVE-2026-17782 | Medium | 4.3 | 2026-07-30 | Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to spoof the contents of the Omnibox (URL bar)… |
CVE-2026-17781 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to… |
CVE-2026-17780 | Medium | 6.3 | 2026-07-30 | Inappropriate implementation in Isolated Web Apps in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a cra… |
CVE-2026-17779 | Medium | 5.4 | 2026-07-30 | Inappropriate implementation in Site Isolation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass site isolation via a crafted HTML pa… |
CVE-2026-17777 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (… |
CVE-2026-17776 | Medium | 5.8 | 2026-07-30 | Policy bypass in Receiver in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a s… |
CVE-2026-17775 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in PresentationAPI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2026-17773 | Medium | 4.3 | 2026-07-30 | Insufficient validation of untrusted input in Cast in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HT… |
CVE-2026-17772 | Medium | 4.3 | 2026-07-30 | Out of bounds read in WebGL in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page… |
CVE-2026-17771 | Medium | 4.3 | 2026-07-30 | Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium securi… |
CVE-2026-17770 | Medium | 5.8 | 2026-07-30 | Out of bounds read in Media in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially pe… |
CVE-2026-17769 | Medium | 4.3 | 2026-07-30 | Insufficient validation of untrusted input in Cast in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HT… |
CVE-2026-17767 | Medium | 4.3 | 2026-07-30 | Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the rend… |
CVE-2026-17765 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in WebProtect in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak c… |
CVE-2026-17764 | Medium | 6.5 | 2026-07-30 | Inappropriate implementation in FedCM in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (… |
CVE-2026-17763 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in GPU in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-or… |
CVE-2026-17762 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted… |
CVE-2026-17761 | Medium | 5.4 | 2026-07-30 | Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scrip… |
CVE-2026-17760 | Medium | 4.3 | 2026-07-30 | Side-channel information leakage in NoStatePrefetch in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted H… |
CVE-2026-17759 | Medium | 6.5 | 2026-07-30 | Uninitialized Use in Codecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2026-17757 | Medium | 4.3 | 2026-07-30 | Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium securi… |
CVE-2026-17756 | Medium | 6.5 | 2026-07-30 | Insufficient policy enforcement in Presentation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a craft… |
CVE-2026-17755 | Medium | 4.3 | 2026-07-30 | Incorrect security UI in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to perfor… |
CVE-2026-17754 | Medium | 6.5 | 2026-07-30 | Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (… |
CVE-2026-17753 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (… |
CVE-2026-17748 | Medium | 6.5 | 2026-07-30 | Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass… |
CVE-2026-17747 | Medium | 4.2 | 2026-07-30 | Insufficient validation of untrusted input in Payments in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the ren… |
CVE-2026-17746 | Medium | 5.8 | 2026-07-30 | Use after free in GPU in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2026-17745 | Medium | 5.8 | 2026-07-30 | Out of bounds read in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
CVE-2026-17743 | Medium | 6.5 | 2026-07-30 | Insufficient policy enforcement in ControlledFrame in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted… |
CVE-2026-17742 | Medium | 4.3 | 2026-07-30 | Insufficient policy enforcement in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page… |
CVE-2026-17740 | Medium | 4.3 | 2026-07-30 | Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium secur… |
CVE-2026-17739 | Medium | 4.2 | 2026-07-30 | Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2026-17737 | Medium | 5.0 | 2026-07-30 | Use after free in Bluetooth in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentiall… |
CVE-2026-17736 | Medium | 5.8 | 2026-07-30 | Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the rend… |
CVE-2026-17734 | Medium | 5.4 | 2026-07-30 | Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a cra… |
CVE-2026-17733 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in QUIC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2026-17731 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Autofill in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted H… |
CVE-2026-17730 | Medium | 4.3 | 2026-07-30 | Side-channel information leakage in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI ge… |
CVE-2026-17728 | Medium | 5.4 | 2026-07-30 | Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a c… |
CVE-2026-17724 | Medium | 4.2 | 2026-07-30 | Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML p… |
CVE-2026-17714 | Medium | 6.5 | 2026-07-30 | Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory vi… |
CVE-2026-17707 | Medium | 6.5 | 2026-07-30 | Uninitialized Use in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to obtain pote… |
CVE-2026-17706 | Medium | 4.3 | 2026-07-30 | Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the render… |
CVE-2026-17703 | Medium | 6.5 | 2026-07-30 | Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions vi… |
CVE-2026-17700 | Medium | 4.3 | 2026-07-30 | Insufficient validation of untrusted input in Actor in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-17696 | Medium | 4.3 | 2026-07-30 | Side-channel information leakage in Media in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page… |
CVE-2026-17693 | Medium | 4.3 | 2026-07-30 | Insufficient policy enforcement in FileSystem in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pa… |
CVE-2026-17690 | Medium | 6.5 | 2026-07-30 | Insufficient validation of untrusted input in PDF in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-origin data via a c… |
CVE-2026-17689 | Medium | 4.3 | 2026-07-30 | Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium secur… |
CVE-2026-17683 | Medium | 6.5 | 2026-07-30 | Inappropriate implementation in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from proces… |
CVE-2026-17679 | Medium | 6.5 | 2026-07-30 | Insufficient validation of untrusted input in Print Preview in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer… |
CVE-2026-17674 | Medium | 6.5 | 2026-07-30 | Inappropriate implementation in HTML in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy via a crafted HTML pag… |
CVE-2026-17668 | Medium | 6.5 | 2026-07-30 | Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium secur… |
CVE-2026-17667 | Medium | 6.5 | 2026-07-30 | Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium secur… |
CVE-2026-17664 | Medium | 6.5 | 2026-07-30 | Insufficient validation of untrusted input in Loader in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-17662 | Medium | 4.3 | 2026-07-30 | Insufficient policy enforcement in Prefetch in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page… |
CVE-2026-17659 | Medium | 4.2 | 2026-07-30 | Inappropriate implementation in SiteIsolation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to byp… |
CVE-2026-64685 | Medium | 5.3 | 2026-07-30 | ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, the BGR decoder does not check fo… |
CVE-2026-62946 | Medium | 5.1 | 2026-07-30 | ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to both 6.9.13-52 and 7.1.2-27, processing an… |
CVE-2026-62363 | Medium | 5.0 | 2026-07-30 | ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, a heap buffer over-write can occu… |
CVE-2026-62343 | Medium | 4.7 | 2026-07-30 | ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 6.9.13-51 and 7.0.1-0 and above prior to 7… |
CVE-2026-15157 | Medium | 4.2 | 2026-07-29 | undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In und… |
CVE-2026-14643 | Medium | 5.9 | 2026-07-29 | undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici f… |
CVE-2026-67439 | Medium | 4.3 | 2026-07-29 | OliveTin gives safe and simple access to predefined shell commands from a web interface. Prior to 3000.17.0, the service/internal/api/api.go StartActionAndWait… |
CVE-2026-67438 | Medium | 6.6 | 2026-07-29 | OliveTin gives access to predefined shell commands from a web interface. From 3000.2.0 until 3000.17.0, the service/internal/executor/arguments.go checkShellAr… |
CVE-2026-65975 | Medium | 6.5 | 2026-07-29 | Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.88.0 up to but not including 1.107.1 and 2.0… |
CVE-2026-54249 | Medium | 6.8 | 2026-07-29 | Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.65.0 through 1.105.0, and 2.0.0b1 through 2.0.0b5, a client that… |
CVE-2026-46678 | Medium | 6.8 | 2026-07-29 | Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.56.0 through 1.98.0, when an application opts a URL into force_d… |
CVE-2026-16728 | Medium | 4.8 | 2026-07-29 | undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume… |
CVE-2026-13309 | Medium | 6.8 | 2026-07-29 | Autel MaxiCharger AC Elite Home NFC Stack-based Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers… |
CVE-2026-13307 | Medium | 6.8 | 2026-07-29 | Autel MaxiCharger AC Elite Home USB Heap-based Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers t… |
CVE-2026-13306 | Medium | 4.3 | 2026-07-29 | Autel MaxiCharger AC Elite Home USB Authentication Bypass Vulnerability. This vulnerability allows physically present attackers to bypass authentication on aff… |
CVE-2026-13305 | Medium | 6.4 | 2026-07-29 | Autel MaxiCharger AC Elite Home Software Update Improper Verification of Cryptographic Signature Arbitrary Code Execution Vulnerability. This vulnerability all… |
CVE-2025-65337 | Medium | 6.1 | 2026-07-29 | Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting (XSS) in pageEditMember.php via the address field. |
CVE-2026-6336 | Medium | 5.3 | 2026-07-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain co… |
CVE-2026-67430 | Medium | 5.3 | 2026-07-29 | MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the… |
CVE-2026-63119 | Medium | 6.2 | 2026-07-29 | MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StdioTransport and MCP::Client… |
CVE-2026-5492 | Medium | 6.5 | 2026-07-29 | DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected in… |
CVE-2026-5489 | Medium | 5.3 | 2026-07-29 | DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected in… |
CVE-2026-4672 | Medium | 4.3 | 2026-07-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain co… |
CVE-2026-3093 | Medium | 4.7 | 2026-07-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain co… |
CVE-2026-18266 | Medium | 5.4 | 2026-07-29 | Dify AI Workflow oauth_redirect_url Open Redirect Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected insta… |
CVE-2026-16553 | Medium | 5.4 | 2026-07-29 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain condi… |
CVE-2026-15831 | Medium | 4.3 | 2026-07-29 | GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allo… |
CVE-2026-15077 | Medium | 4.3 | 2026-07-29 | GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allo… |
CVE-2026-14351 | Medium | 4.3 | 2026-07-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain con… |
CVE-2026-14341 | Medium | 4.9 | 2026-07-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain co… |
CVE-2026-13113 | Medium | 6.5 | 2026-07-29 | GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain condi… |
CVE-2026-13346 | Medium | 6.5 | 2026-07-29 | pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wh… |
CVE-2026-59920 | Medium | 6.5 | 2026-07-29 | Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's STOMP encoder ( StompSubfram… |
CVE-2026-59919 | Medium | 5.5 | 2026-07-29 | Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's HAProxy encoder ( HAProxyMes… |
CVE-2026-59900 | Medium | 5.3 | 2026-07-29 | Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation… |
CVE-2026-54705 | Medium | 6.3 | 2026-07-29 | MathLive provides web components for math display and input. Prior to 0.110.0, MathLive fails to escape text-mode content in \text{} and \mbox{} commands in Bo… |
CVE-2026-13723 | Medium | 6.5 | 2026-07-29 | A vulnerability in the `zipx.Unzip` extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a U… |
CVE-2026-67194 | Medium | 6.5 | 2026-07-29 | Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH… |