Medium-severity CVEs (page 89)
Page 89 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-64356 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: xfs: fix memory leak in xfs_dqinode_metadir_create() If xfs_metadir_create() fails in xfs… |
CVE-2026-64353 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Keep dynamic inner array lookups nullable An ARRAY_OF_MAPS can use an array created… |
CVE-2026-64351 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() kalmia_rx_fixup() computes u… |
CVE-2026-64350 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() cdnsp_alloc_stream… |
CVE-2026-64349 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup() The dwc3_ulpi_se… |
CVE-2026-64347 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler The OTG branch of… |
CVE-2026-64345 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_printer: take kref only for successful open printer_open() returns -EBUSY… |
CVE-2026-64338 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: USB: misc: uss720: unregister parport on probe failure uss720_probe() registers a parport… |
CVE-2026-64337 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: unmap request DMA on queue failure mtu3_gadget_queue() maps the request before… |
CVE-2026-64336 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: keyspan_pda: fix information leak The write() callback is supposed to return… |
CVE-2026-64335 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: digi_acceleport: fix broken rx after throttle If the port is closed while th… |
CVE-2026-64334 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: digi_acceleport: fix hard lockup on disconnect If submitting the OOB write u… |
CVE-2026-64332 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: USB: ulpi: fix memory leak on registration failure The allocated device name is never fre… |
CVE-2026-64331 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vep_dequeue() vep_alloc_request() wasn't initializing vreq… |
CVE-2026-64328 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix DMA fence leak In ffs_dmabuf_transfer(), a ffs_dma_fence object is… |
CVE-2026-64327 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks When pars… |
CVE-2026-64326 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: block: skip sync_blockdev() on surprise removal in bdev_mark_dead() bdev_mark_dead()'s @s… |
CVE-2026-64325 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon This patch is based on a BU… |
CVE-2026-64321 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: nvme: target: rdma: fix ndev refcount leak on queue connect nvmet_rdma_queue_connect() ca… |
CVE-2026-64316 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: caam - use print_hex_dump_devel to guard key hex dumps Use print_hex_dump_devel()… |
CVE-2026-64314 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: chacha20poly1305 - validate poly1305 template argument chachapoly_create() still… |
CVE-2026-64310 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for SEV ioctls Sashiko notes: > if SEV initializatio… |
CVE-2026-64309 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) Sashiko notes: > if SEV initia… |
CVE-2026-64308 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD) Sashiko notes: > if SEV ini… |
CVE-2026-64307 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG) Sashiko notes: > if SEV initia… |
CVE-2026-64306 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: drbg - Fix returning success on failure in CTR_DRBG drbg_ctr_generate() sometimes… |
CVE-2026-64302 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix freeing of PMD-sized vmemmap pages Commit bf9e4e30f353 ("x86/mm: use pagetabl… |
CVE-2026-64301 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() scmi_regulator_probe… |
CVE-2026-64297 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: module: decompress: check return value of module_extend_max_pages() module_extend_max_pag… |
CVE-2026-64295 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access The pag… |
CVE-2026-64294 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: mm: do file ownership checks with the proper mount idmap Ever since idmapped mounts were… |
CVE-2026-64292 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Move vevent memory allocation outside spinlock The veventq memory allocation hap… |
CVE-2026-64291 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Set veventq_depth upper bound iommufd_veventq_alloc() accepts any !0 veventq_dep… |
CVE-2026-64290 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufd_fault_fops_read() On a copy_to_user() failu… |
CVE-2026-64289 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Set upper bounds on cache invalidation entry_num and entry_len iommufd_hwpt_inva… |
CVE-2026-64288 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB VNCR TLB invalidation occurs fro… |
CVE-2026-64285 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Pin source page for write when adding CPUID data for SNP guest When populating… |
CVE-2026-64282 | Medium | 4.7 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier In the case that… |
CVE-2026-64278 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: i2c: imx-lpi2c: mark I2C adapter when hardware is powered down On some i.MX platforms, ce… |
CVE-2026-64275 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Input: elan_i2c - prevent division by zero and arithmetic underflow The Elan I2C touchpad… |
CVE-2026-64267 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: fuse: avoid 32-bit prune notification count wrap FUSE_NOTIFY_PRUNE validates the nodeid p… |
CVE-2026-64264 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix EFAULT clobber in fuse_uring_commit copy_from_user() returns the number o… |
CVE-2026-64263 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix moving cancelled entry to ent_in_userspace list fuse_uring_cancel() moves… |
CVE-2026-64262 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: fuse-uring: end fuse_req on io-uring cancel task work When io_uring delivers task work wi… |
CVE-2026-64258 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref If a copy… |
CVE-2026-64256 | Medium | 5.5 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: xfs: don't wrap around quota ids in dqiterate LOLLM noticed that q_id is an unsigned 32-b… |
CVE-2026-15425 | Medium | 6.4 | 2026-07-25 | The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug (post_name… |
CVE-2026-14955 | Medium | 6.5 | 2026-07-25 | The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.7.7 via the '… |
CVE-2026-66339 | Medium | 6.5 | 2026-07-24 | A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subseq… |
CVE-2026-66338 | Medium | 5.4 | 2026-07-24 | A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC… |
CVE-2026-66337 | Medium | 6.5 | 2026-07-24 | A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing mu… |
CVE-2026-61886 | Medium | 6.5 | 2026-07-24 | Weintek cMT3092X HMI stores user account passwords in plaintext. |
CVE-2026-60135 | Medium | 6.5 | 2026-07-24 | An attacker can modify data that should be restricted to read‑only access. |
CVE-2026-55985 | Medium | 4.3 | 2026-07-24 | The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext on a certain configuration page accessibl… |
CVE-2026-66038 | Medium | 6.5 | 2026-07-24 | FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose u… |
CVE-2026-66037 | Medium | 6.5 | 2026-07-24 | FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated a… |
CVE-2026-57531 | Medium | 5.4 | 2026-07-24 | Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allows unauthenticated attackers to execute… |
CVE-2026-57530 | Medium | 5.4 | 2026-07-24 | Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components packages that allows at… |
CVE-2026-65707 | Medium | 6.5 | 2026-07-24 | Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level users to extract arbitrary database contents by submitting… |
CVE-2026-64254 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR When BAR_PE… |
CVE-2026-64253 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: kernel/fork: clear PF_BLOCK_TS in copy_process() PF_BLOCK_TS is only set in blk_time_get_… |
CVE-2026-64252 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: MIPS: DEC: Prevent initial console buffer from landing in XKPHYS In 64-bit configurations… |
CVE-2026-64250 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: Report dying CPU to RCU in stop_this_cpu() This is a port of MIPS commit 9f3f3… |
CVE-2026-64248 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: MIPS: smp: report dying CPU to RCU in stop_this_cpu() smp_send_stop() parks all secondary… |
CVE-2026-64244 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: drivers/base/memory: set mem->altmap after successful device registration If __add_memory… |
CVE-2026-64241 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: gpio: rockchip: teardown bugs and resource leaks Address several teardown issues and reso… |
CVE-2026-64240 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: media: rc: igorplugusb: fix control request setup packet Commit eac69475b01f ("media: rc… |
CVE-2026-64238 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: gpio: shared: fix deadlock on shared proxy's parent removal Commit 710abda58055 ("gpio: s… |
CVE-2026-64236 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: i2c: davinci: fix division by zero on missing clock-frequency When the 'clock-frequency'… |
CVE-2026-64234 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: tty: serial: pch_uart: add check for dma_alloc_coherent() Add a check for dma_alloc_coher… |
CVE-2026-64233 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind uvc_function_bind(… |
CVE-2026-64231 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: don't dump registers past the mapped region On DSI 6G platforms the IO addre… |
CVE-2026-64230 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: regulator: tps65219: fix irq_data.rdev not being assigned Commit 64a6b577490c ("regulator… |
CVE-2026-64229 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: x86/mm: Disable broadcast TLB flush when PCID is disabled Booting with "nopcid" clears X8… |
CVE-2026-64228 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: net: ethtool: phy: avoid NULL deref when PHY driver is unbound phydev->drv can become NUL… |
CVE-2026-64227 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: ACPI: driver: Check ACPI_COMPANION() against NULL during probe Since every platform drive… |
CVE-2026-64220 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: device property: set fwnode->secondary to NULL in fwnode_init() If a firmware node is all… |
CVE-2026-64215 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Check kzalloc return in a8xx_hfi_send_perf_table Check the return value of… |
CVE-2026-64214 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() … |
CVE-2026-64213 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (lm90) Add lock protection to lm90_alert Sashiko reports: lm90_alert() executes i… |
CVE-2026-64212 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it In iwl_mld_remove… |
CVE-2026-64211 | Medium | 5.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: srcu: Don't queue workqueue handlers to never-online CPUs While an srcu_struct structure… |
CVE-2026-8308 | Medium | 6.1 | 2026-07-24 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Polen Media Software and Information Services Website Tem… |
CVE-2026-7007 | Medium | 4.6 | 2026-07-24 | The Zephyr ext2 file system validates the on-disk superblock in ext2_verify_disk_superblock() (subsys/fs/ext2/ext2_impl.c) before completing a mount. The valid… |
CVE-2026-66007 | Medium | 6.5 | 2026-07-24 | Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is… |
CVE-2026-66006 | Medium | 5.3 | 2026-07-24 | lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setup_comm_prefs endpoint that allows unauthenticated a… |
CVE-2026-66005 | Medium | 6.3 | 2026-07-24 | Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to by… |
CVE-2026-66004 | Medium | 5.3 | 2026-07-24 | BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the download_polyhaven_asset method that allows attackers to write arbitrary files… |
CVE-2026-49326 | Medium | 6.5 | 2026-07-24 | Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open, fetch(possi… |
CVE-2026-17059 | Medium | 6.5 | 2026-07-24 | A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management soluti… |
CVE-2026-16802 | Medium | 6.5 | 2026-07-24 | Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file sys… |
CVE-2026-16799 | Medium | 5.0 | 2026-07-24 | Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user wi… |
CVE-2026-16798 | Medium | 6.5 | 2026-07-24 | Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated u… |
CVE-2026-17048 | Medium | 5.5 | 2026-07-24 | A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for r… |
CVE-2026-7484 | Medium | 5.3 | 2026-07-24 | External control of Assumed-Immutable web parameter vulnerability in ABIS Technology Ltd. Co. AVESİS allows Accessing Functionality Not Properly Constrained by… |
CVE-2026-66010 | Medium | 6.1 | 2026-07-24 | DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck, allowing attributes t… |
CVE-2026-46452 | Medium | 5.3 | 2026-07-24 | Improper Input Validation vulnerability in Apache NimBLE in Mesh Proxy SAR reassembly could result in passing broken data toward application resulting in memor… |
CVE-2026-45812 | Medium | 6.5 | 2026-07-24 | Incorrect Calculation of Buffer Size vulnerability in Apache NimBLE when processing Legacy Advertising Report HCI event. When a single HCI advertising report… |
CVE-2026-16743 | Medium | 5.5 | 2026-07-24 | A flaw was found in accountsservice. The systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validation and privilege dr… |
CVE-2026-16730 | Medium | 5.5 | 2026-07-24 | A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled a… |