Low-severity CVEs (page 10)
Page 10 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-70437 | Low | 3.7 | 2026-08-05 | Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a constant-time comparison function when checking whether the pro… |
CVE-2026-70430 | Low | 2.7 | 2026-08-05 | Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy confi… |
CVE-2026-70600 | Low | 3.1 | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the… |
CVE-2026-70598 | Low | 3.9 | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3, of… |
CVE-2026-12730 | Low | 3.8 | 2026-08-05 | IBM Business Automation Workflow containers and traditional 26.0.0, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 007, and 24.0.0 th… |
CVE-2026-8029 | Low | 3.9 | 2026-08-05 | The ZTE Smart Life app contains an SQL injection vulnerability that allows attackers to execute UNION SELECT statements to query sensitive data in the feedback… |
CVE-2026-16993 | Low | 3.7 | 2026-08-05 | The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not protect its shipping-label storage directory with server-independent access con… |
CVE-2026-16746 | Low | 2.7 | 2026-08-05 | The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowin… |
CVE-2025-15677 | Low | 3.5 | 2026-08-05 | The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing hi… |
CVE-2026-18852 | Low | 3.3 | 2026-08-05 | A vulnerability has been found in epsilla-cloud vectordb up to 0.3.18/df5a5f5afb85a2376a0f2f316c79dea9b2c6ac7a. This impacts the function SplitTokens/ShuntingY… |
CVE-2026-18817 | Low | 2.2 | 2026-08-04 | A security flaw has been discovered in Baserow up to 2.3.2. Affected by this issue is the function BaserowImpersonateAuthTokenSerializer of the file backend/sr… |
CVE-2026-70483 | Low | 3.1 | 2026-08-04 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, DELETE /api/v1/chats/{id} cancelled a chat's in-… |
CVE-2026-16791 | Low | 3.9 | 2026-08-04 | A temporary file creation vulnerability in the Linux version of Lenovo XClarity Essentials OneCLI 5.5.0 and below could allow a local low-privileged attacker t… |
CVE-2026-18790 | Low | 3.3 | 2026-08-04 | A weakness has been identified in Systerel S2OPC up to 1.7.3. This affects the function LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse of the file src/Cl… |
CVE-2026-16070 | Low | 2.7 | 2026-08-04 | The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template's type meta, validatin… |
CVE-2026-16068 | Low | 3.5 | 2026-08-04 | The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before… |
CVE-2026-11366 | Low | 3.7 | 2026-08-04 | The MonsterInsights WordPress plugin before 11.1.0 does not correctly validate the signature on one of its unauthenticated AJAX actions: when the MonsterInsig… |
CVE-2026-68744 | Low | 3.3 | 2026-08-04 | A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink… |
CVE-2026-18739 | Low | 2.5 | 2026-08-04 | A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host applicatio… |
CVE-2026-18569 | Low | 3.7 | 2026-08-04 | A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles… |
CVE-2026-58044 | Low | 3.7 | 2026-08-04 | A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `Incomi… |
CVE-2026-18682 | Low | 3.1 | 2026-08-03 | A security flaw has been discovered in OpenAkita up to 1.27.12. This vulnerability affects unknown code of the file /api/upload of the component File Upload AP… |
CVE-2026-56608 | Low | 3.7 | 2026-08-03 | HCL iControl is affected by Missing Access Control vulnerability. The application failed to enforce proper granular access controls, allowing users to access o… |
CVE-2026-63545 | Low | 2.4 | 2026-08-03 | Sharp and Toshiba Tec MFPs (multifunction printers) caches data internally when printing, and leave them uncleared. They may be accessed later by other users. |
CVE-2026-18591 | Low | 2.1 | 2026-08-03 | A vulnerability was identified in Meesho Online Shopping App up to 20260607 on Android. Affected by this vulnerability is an unknown functionality of the compo… |
CVE-2026-16276 | Low | 2.7 | 2026-08-03 | The Classified Listing WordPress plugin before 5.4.4 does not perform a capability check on an AJAX action that returns aggregated store revenue totals, allow… |
CVE-2026-16274 | Low | 2.7 | 2026-08-03 | The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowin… |
CVE-2026-15231 | Low | 2.7 | 2026-08-03 | The Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 does not verify that a user is authorized to access a referenced post before processing… |
CVE-2026-18581 | Low | 3.3 | 2026-08-03 | A vulnerability was determined in ggml-org llama.cpp e15efe0. Affected by this issue is some unknown functionality of the file common/jinja/parser.cpp of the c… |
CVE-2026-10774 | Low | 2.4 | 2026-08-02 | Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-key teardown. In subsys/bluetooth/mesh/subnet.c, net_keys_create()… |
CVE-2026-15939 | Low | 2.7 | 2026-08-02 | The Simple Restrict WordPress plugin before 1.2.9 does not enforce its content-restriction permission check on the REST API the way it does on the front end, r… |
CVE-2026-67334 | Low | 3.8 | 2026-08-01 | better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configur… |
CVE-2026-67319 | Low | 3.7 | 2026-08-01 | axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype… |
CVE-2026-66401 | Low | 2.1 | 2026-08-01 | FreeRDP before 3.29.0 contains an out-of-bounds heap read vulnerability in the UVC H.264 extension-unit parser that fails to validate descriptor length before… |
CVE-2026-14823 | Low | 2.2 | 2026-08-01 | The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not properly verify authorization on some of its seating actions, allowing users with… |
CVE-2026-14214 | Low | 2.7 | 2026-08-01 | The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allo… |
CVE-2026-14197 | Low | 3.8 | 2026-08-01 | The Fluent Support WordPress plugin before 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer, allowing a restricted supp… |
CVE-2026-14195 | Low | 2.7 | 2026-08-01 | The Brizy WordPress plugin before 2.8.18 does not properly verify authorization on a request handler before returning post content, allowing users with the Co… |
CVE-2026-11882 | Low | 3.7 | 2026-08-01 | The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowi… |
CVE-2026-10827 | Low | 3.5 | 2026-08-01 | The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on… |
CVE-2026-54787 | Low | 3.1 | 2026-07-31 | sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity w… |
CVE-2026-55825 | Low | 3.1 | 2026-07-31 | Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachment identifier contai… |
CVE-2026-57232 | Low | 3.1 | 2026-07-31 | Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs fro… |
CVE-2026-55824 | Low | 2.6 | 2026-07-31 | Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external hosts. Contao's cr… |
CVE-2026-25552 | Low | 3.7 | 2026-07-31 | Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rate-limiting controls by manipulating the… |
CVE-2026-56571 | Low | 3.7 | 2026-07-31 | HCL iControl was affected by Improper Error Handling vulnerabilities. It involves Out of memory, null pointer exceptions, system call failure, database unavail… |
CVE-2026-56570 | Low | 3.7 | 2026-07-31 | HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive information such as: Valid usernames, Email addresses used for… |
CVE-2026-56568 | Low | 3.7 | 2026-07-31 | HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It involves application displays raw server/A… |
CVE-2026-18217 | Low | 3.4 | 2026-07-31 | A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs when Keycloak handle… |
CVE-2026-18209 | Low | 3.4 | 2026-07-31 | A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs because the securit… |
CVE-2026-18206 | Low | 3.7 | 2026-07-31 | A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services. The issue occurs when a realm administ… |
CVE-2026-15381 | Low | 3.7 | 2026-07-31 | The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated user… |
CVE-2026-14927 | Low | 3.7 | 2026-07-31 | The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership check before rendering customer order docu… |
CVE-2026-14862 | Low | 3.7 | 2026-07-31 | The Support Genix WordPress plugin before 1.4.48 does not properly authorize access to support-ticket attachment downloads, allowing unauthenticated users who… |
CVE-2026-14849 | Low | 3.7 | 2026-07-31 | The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it writes to a predictable location in th… |
CVE-2026-13393 | Low | 3.5 | 2026-07-31 | The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not sanitize or escape certain megamenu menu-item settings before storing them and outpu… |
CVE-2026-58039 | Low | 3.3 | 2026-07-31 | A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. This can lead to confidenti… |
CVE-2026-41709 | Low | 2.7 | 2026-07-30 | VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being… |
CVE-2026-59326 | Low | 3.3 | 2026-07-30 | The Spring Boot language server logs the raw value of the https_proxy/HTTPS_PROXY/http_proxy/HTTP_PROXY environment variable at INFO level whenever it creates… |
CVE-2026-15054 | Low | 3.7 | 2026-07-30 | The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated… |
CVE-2026-14222 | Low | 3.8 | 2026-07-30 | The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users… |
CVE-2026-14221 | Low | 3.8 | 2026-07-30 | The Easy Appointments WordPress plugin through 4.0 does not perform capability checks in several of its appointment-management actions, relying only on a nonce… |
CVE-2026-14188 | Low | 2.7 | 2026-07-30 | The Easy Appointments WordPress plugin before 3.12.28 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowin… |
CVE-2026-18011 | Low | 2.4 | 2026-07-30 | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a local attacker to obtain potentially sensitive informat… |
CVE-2026-18000 | Low | 3.1 | 2026-07-30 | Insufficient policy enforcement in USB in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-17997 | Low | 3.1 | 2026-07-30 | Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cr… |
CVE-2026-17984 | Low | 3.3 | 2026-07-30 | Inappropriate implementation in Browser in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-origin data via a crafted HTM… |
CVE-2026-17980 | Low | 3.1 | 2026-07-30 | Inappropriate implementation in UI in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI g… |
CVE-2026-17957 | Low | 3.1 | 2026-07-30 | Inappropriate implementation in CORS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-o… |
CVE-2026-17902 | Low | 3.5 | 2026-07-30 | Inappropriate implementation in Editing in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2026-17860 | Low | 3.3 | 2026-07-30 | Insufficient validation of untrusted input in Mobile in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to spoof the contents of the O… |
CVE-2026-17826 | Low | 3.1 | 2026-07-30 | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in speci… |
CVE-2026-17766 | Low | 3.3 | 2026-07-30 | Insufficient validation of untrusted input in Clipboard in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-origin data v… |
CVE-2026-17732 | Low | 3.1 | 2026-07-30 | Inappropriate implementation in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chrom… |
CVE-2026-17720 | Low | 3.1 | 2026-07-30 | Insufficient policy enforcement in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak… |
CVE-2026-17715 | Low | 3.1 | 2026-07-30 | Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestu… |
CVE-2026-17702 | Low | 3.1 | 2026-07-30 | Inappropriate implementation in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-o… |
CVE-2025-14562 | Low | 3.1 | 2026-07-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain co… |
CVE-2026-2482 | Low | 3.1 | 2026-07-29 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to execute malic… |
CVE-2026-10684 | Low | 3.0 | 2026-07-29 | In subsys/debug/coredump/coredump_shell.c, print_coredump_hdr() used the 16-bit tgt_code field of a stored Zephyr coredump header directly as an index into cor… |
CVE-2026-58187 | Low | 3.7 | 2026-07-29 | The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service. This issue affects Apache Traffic… |
CVE-2026-63241 | Low | 3.1 | 2026-07-29 | An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user withou… |
CVE-2026-63236 | Low | 3.7 | 2026-07-29 | An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to read another user's name, internal identifier, scores, lesson st… |
CVE-2026-63235 | Low | 3.7 | 2026-07-29 | An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to forcibly terminate the session of any user given their email add… |
CVE-2026-63228 | Low | 2.6 | 2026-07-29 | An unrestricted image upload vulnerability in Koollab LMS allowed an authenticated attacker to upload malicious content disguised as an image file via the feed… |
CVE-2026-55403 | Low | 3.7 | 2026-07-28 | datamodel-code-generator generates Python data models from schema definitions. Prior to 0.63.0, src/datamodel_code_generator/http.py get_body reuses Authorizat… |
CVE-2026-66753 | Low | 3.7 | 2026-07-28 | tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to inject carriage return (0x0D) and line feed (0x0A) bytes into… |
CVE-2026-17072 | Low | 3.3 | 2026-07-28 | A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Mat… |
CVE-2026-55977 | Low | 3.3 | 2026-07-28 | Successful exploitation of this vulnerability could allow an attacker with local network access to bypass the application's rate-limiting mechanism, enabling b… |
CVE-2026-14821 | Low | 2.7 | 2026-07-28 | The Quiz and Survey Master (QSM) WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with cont… |
CVE-2026-14819 | Low | 3.5 | 2026-07-28 | The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowin… |
CVE-2026-64745 | Low | 2.4 | 2026-07-27 | This issue was addressed with additional restrictions on the lock screen. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. A person with physical… |
CVE-2026-10683 | Low | 2.4 | 2026-07-27 | In the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) operating in target/slave mode, the rx_full interrupt handler gates the write_requested() callback… |
CVE-2026-48051 | Low | 3.5 | 2026-07-27 | Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's webhook delivery system contains an SSRF protection bypass… |
CVE-2026-17513 | Low | 3.3 | 2026-07-27 | A vulnerability was found in ggml-org whisper.cpp 95ea8f9b. Affected is the function ggml_ftype_to_ggml_type of the file ggml/src/ggml.c. The manipulation of t… |
CVE-2026-56538 | Low | 3.5 | 2026-07-27 | An endpoint in HCL Connections is vulnerable to information disclosure. In certain scenarios this might lead to disclosing sensitive information to unauthorize… |
CVE-2026-56537 | Low | 3.5 | 2026-07-27 | HCL Connections is vulnerable to information disclosure which could allow a user to obtain sensitive information they are not entitled to, caused by improper h… |
CVE-2026-17512 | Low | 3.3 | 2026-07-27 | A vulnerability has been found in ggml-org whisper.cpp 1.8.4-58. This impacts the function log_mel_spectrogram of the file src/whisper.cpp. The manipulation le… |
CVE-2026-40000 | Low | 1.8 | 2026-07-27 | The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files. Third-party applications ca… |
CVE-2026-14189 | Low | 3.8 | 2026-07-27 | The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with adm… |