Low-severity CVEs (page 10)
Page 10 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-42445 | Low | 3.3 | 2026-05-12 | NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the UFS/UFS2 filesystem image p… |
CVE-2026-42444 | Low | 3.3 | 2026-05-12 | NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a denial-of-service vulnerability exists in the littlefs filesystem image parser… |
CVE-2026-42443 | Low | 3.3 | 2026-05-12 | NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an integer divide-by-zero exists in the UFS/UFS2 filesystem image parser in NanaZ… |
CVE-2026-42442 | Low | 3.3 | 2026-05-12 | NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a null-pointer dereference exists in the UFS/UFS2 filesystem image parser in Nana… |
CVE-2026-42355 | Low | 3.3 | 2026-05-12 | NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the Electron Archive (ASAR) par… |
CVE-2026-34685 | Low | 3.4 | 2026-05-12 | Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Improper Input Validation vulnerability… |
CVE-2026-44278 | Low | 2.3 | 2026-05-12 | A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.2, FortiClientWindows 7.2 all versions may allow attacker… |
CVE-2026-20793 | Low | 3.3 | 2026-05-12 | Unchecked return value for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applications may allow a denial of service. U… |
CVE-2026-43514 | Low | 3.7 | 2026-05-12 | Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from… |
CVE-2026-40020 | Low | 3.1 | 2026-05-12 | Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no. This causes folders to be… |
CVE-2026-32684 | Low | 2.9 | 2026-05-12 | The application does not impose strict enough restrictions on directory access permissions, posing a risk that other malicious applications could obtain sensit… |
CVE-2026-41530 | Low | 3.3 | 2026-05-12 | The automatic folder creation feature of Lhaz and Lhaz+ provided by Chitora soft contains a path traversal vulnerability. When the affected product is configur… |
CVE-2026-40131 | Low | 3.4 | 2026-05-12 | SQL injection vulnerability exists in @sap/hdi-deploy package, where SQL queries are dynamically constructed using user input without proper parameterization o… |
CVE-2026-45362 | Low | 3.2 | 2026-05-12 | Sangoma Switchvox before 8.4 places cleartext SIP authentication credentials in a backup file. |
CVE-2026-42188 | Low | 2.4 | 2026-05-11 | Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Prior to 2.9.3, a server-side request forgery (SSRF) vulnerability exists in… |
CVE-2026-28957 | Low | 3.3 | 2026-05-11 | An issue with app access to camera metadata was addressed with improved logic. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, v… |
CVE-2026-28910 | Low | 3.3 | 2026-05-11 | This issue was addressed with improved permissions checking. This issue is fixed in macOS Tahoe 26.4. A malicious app may be able to access arbitrary files. |
CVE-2026-42874 | Low | 3.7 | 2026-05-11 | Microdot is a minimalistic Python web framework. Prior to 2.6.1, the Response.set_cookie() method does not sanitize its string arguments, and in particular wil… |
CVE-2026-43969 | Low | 3.2 | 2026-05-11 | Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows HTTP request splitting and cookie smuggling via unvalidat… |
CVE-2026-44996 | Low | 3.7 | 2026-05-11 | OpenClaw before 2026.4.15 contains an arbitrary local file read vulnerability in the webchat audio embedding helper that fails to apply local media root contai… |
CVE-2026-44658 | Low | 2.4 | 2026-05-11 | Zen is a firefox-based browser. Prior to 1.19.12b, RSS feed URLs entered by the user are validated to http: or https: in promptForFeedUrl, but item links insid… |
CVE-2026-34094 | Low | 3.8 | 2026-05-11 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Page/Article.Php. This issue affects MediaWi… |
CVE-2026-8276 | Low | 3.7 | 2026-05-11 | A flaw has been found in bettercap up to 2.41.5. Affected by this issue is some unknown functionality of the file modules/mysql_server/mysql_server.go of the c… |
CVE-2026-8275 | Low | 3.7 | 2026-05-11 | A vulnerability was detected in bettercap up to 2.41.5. Affected by this vulnerability is the function ippReadChunkedBody of the file modules/zerogod/zerogod_i… |
CVE-2026-8262 | Low | 2.4 | 2026-05-11 | A vulnerability was identified in Devs Palace ERP Online up to 4.0.0. This impacts an unknown function of the file /accounts/chart-save. Such manipulation lead… |
CVE-2026-8257 | Low | 3.3 | 2026-05-11 | A vulnerability was detected in WebAssembly Binaryen up to 117. This issue affects the function IRBuilder::makeBrOn of the file src/wasm/wasm-ir-builder.cpp of… |
CVE-2026-8256 | Low | 2.4 | 2026-05-11 | A security vulnerability has been detected in Devs Palace ERP Online up to 4.0.0. This vulnerability affects unknown code of the file /accounts/mr-save. Such m… |
CVE-2026-8255 | Low | 2.4 | 2026-05-11 | A weakness has been identified in Devs Palace ERP Online up to 4.0.0. This affects an unknown part of the file /inventory/add_new_customer. This manipulation c… |
CVE-2026-8254 | Low | 2.4 | 2026-05-11 | A security flaw has been discovered in Devs Palace ERP Online up to 4.0.0. Affected by this issue is some unknown functionality of the file /inventory/sales_sa… |
CVE-2026-8253 | Low | 2.4 | 2026-05-11 | A vulnerability was identified in Devs Palace ERP Online up to 4.0.0. Affected by this vulnerability is an unknown functionality of the file /inventory/purchas… |
CVE-2026-8242 | Low | 3.7 | 2026-05-10 | A vulnerability was found in Industrial Application Software IAS Canias ERP 8.03. The impacted element is the function doAction of the component Login RMI Inte… |
CVE-2026-45186 | Low | 2.9 | 2026-05-10 | In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input. |
CVE-2026-8232 | Low | 3.5 | 2026-05-10 | A vulnerability was found in Dotouch XproUPF 2.0.0-release-088aa7c4. This impacts the function vlib_worker_loop in the library /usr/xpro/upf/tools/libs/libvlib… |
CVE-2026-8221 | Low | 2.4 | 2026-05-10 | A flaw has been found in Devs Palace ERP Online up to 4.0.0. This impacts an unknown function of the file /inventory/item-save. This manipulation causes cross… |
CVE-2026-8220 | Low | 2.4 | 2026-05-10 | A vulnerability was detected in Devs Palace ERP Online up to 4.0.0. This affects an unknown function of the file /inventory/customer-save. The manipulation res… |
CVE-2026-8219 | Low | 2.4 | 2026-05-10 | A security vulnerability has been detected in Devs Palace ERP Online up to 4.0.0. The impacted element is an unknown function of the file /inventory/supplier-s… |
CVE-2026-8218 | Low | 2.4 | 2026-05-10 | A weakness has been identified in Devs Palace ERP Online up to 4.0.0. The affected element is an unknown function of the file /inventory/purchase_return_save… |
CVE-2026-45182 | Low | 2.2 | 2026-05-09 | GrapheneOS before 2026050400 allows attackers to discover the real IP address of a VPN user as a consequence of a registerQuicConnectionClosePayload optimizati… |
CVE-2026-8196 | Low | 3.7 | 2026-05-09 | A flaw has been found in JeecgBoot 3.9.1. The impacted element is an unknown function of the file jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/… |
CVE-2026-44987 | Low | 3.8 | 2026-05-08 | SysReptor is a fully customizable pentest reporting platform. Prior to version 2026.29, users with "User Admin" permissions can change the email addresses of u… |
CVE-2026-42195 | Low | 3.4 | 2026-05-08 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that override… |
CVE-2026-32803 | Low | 3.3 | 2026-05-08 | Dell PowerScale OneFS versions 9.5.0.0 through 9.5.1.6, 9.6.0.0 through 9.7.1.13, 9.8.0.0 through 9.10.1.5 and 9.11.0.0 through 9.12.0.1 contains an Insufficie… |
CVE-2026-44928 | Low | 2.9 | 2026-05-08 | In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal. |
CVE-2026-44927 | Low | 2.9 | 2026-05-08 | In uriparser before 1.0.2, there is pointer difference truncation to int in various places. |
CVE-2026-44916 | Low | 3.0 | 2026-05-08 | In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered without sandboxing. |
CVE-2026-8136 | Low | 2.4 | 2026-05-08 | A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects an unknown part of the file /index.php?page=users. Executing a ma… |
CVE-2026-41498 | Low | 3.3 | 2026-05-08 | Kimai is an open-source time tracking application. Prior to version 2.54.0, the Team API endpoints use #[IsGranted('edit_team')] instead of #[IsGranted('edit'… |
CVE-2026-8124 | Low | 3.3 | 2026-05-08 | A security vulnerability has been detected in GPAC up to 26.02.0. This affects the function sidx_box_read of the file src/isomedia/box_code_base.c. The manipul… |
CVE-2026-8119 | Low | 3.3 | 2026-05-08 | A vulnerability was detected in Open5GS up to 2.7.7. Impacted is the function ogs_sbi_stream_find_by_id in the library /lib/sbi/nghttp2-server.c of the compone… |
CVE-2026-8088 | Low | 3.3 | 2026-05-07 | A weakness has been identified in OSGeo gdal up to 3.13.0dev-4. The affected element is the function GDfieldinfo of the file frmts/hdf4/hdf-eos/GDapi.c. Execut… |
CVE-2026-8084 | Low | 3.3 | 2026-05-07 | A vulnerability was determined in OSGeo gdal up to 3.13.0dev-4. This vulnerability affects the function memmove of the file frmts/hdf4/hdf-eos/SWapi.c of the c… |
CVE-2026-44603 | Low | 3.7 | 2026-05-07 | Tor before 0.4.9.7 has an out-of-bounds read by one byte via a malformed BEGIN cell, aka TROVE-2026-007. |
CVE-2026-44602 | Low | 3.7 | 2026-05-07 | Tor before 0.4.9.7 has a NULL pointer dereference when a CERT cell is received out of order, aka TROVE-2026-006. |
CVE-2026-44601 | Low | 3.7 | 2026-05-07 | Tor before 0.4.9.7, when circuit queue memory pressure exists, can experience a client crash because of a double close of a circuit, aka TROVE-2026-009. |
CVE-2026-41663 | Low | 3.5 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, several administrative operations in Admidio's preferences module (database backup… |
CVE-2026-41659 | Low | 2.7 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, the member assignment DataTables endpoint (members_assignment_data.php) includes hi… |
CVE-2026-44600 | Low | 3.7 | 2026-05-07 | Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the clearing of a queue, aka TROVE-2026-010. |
CVE-2026-44599 | Low | 3.7 | 2026-05-07 | Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008. |
CVE-2026-44597 | Low | 3.7 | 2026-05-07 | Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell lacks a reason in its payload, aka TROVE-2026-011. |
CVE-2026-8022 | Low | 3.1 | 2026-05-06 | Inappropriate implementation in MHTML in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage in specific UI gestures… |
CVE-2026-8017 | Low | 3.1 | 2026-05-06 | Side-channel information leakage in Media in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page… |
CVE-2026-7968 | Low | 3.1 | 2026-05-06 | Insufficient validation of untrusted input in CORS in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process t… |
CVE-2026-7966 | Low | 3.1 | 2026-05-06 | Insufficient validation of untrusted input in SiteIsolation in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer… |
CVE-2026-7965 | Low | 3.1 | 2026-05-06 | Insufficient validation of untrusted input in DevTools in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer proce… |
CVE-2026-7959 | Low | 3.1 | 2026-05-06 | Inappropriate implementation in Navigation in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass… |
CVE-2026-7954 | Low | 3.1 | 2026-05-06 | Race in Shared Storage in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via… |
CVE-2026-7949 | Low | 3.1 | 2026-05-06 | Out of bounds read in Skia in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to leak cross-origin data… |
CVE-2026-7945 | Low | 3.1 | 2026-05-06 | Insufficient validation of untrusted input in COOP in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process t… |
CVE-2026-7944 | Low | 3.1 | 2026-05-06 | Insufficient validation of untrusted input in Persistent Cache in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the render… |
CVE-2026-7937 | Low | 3.1 | 2026-05-06 | Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension t… |
CVE-2026-7909 | Low | 3.1 | 2026-05-06 | Inappropriate implementation in ServiceWorker in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to byp… |
CVE-2025-31974 | Low | 3.9 | 2026-05-06 | HCL BigFix Service Management (SM) is susceptible to a Root File System Not Mounted as Read-Only. An improperly configured root file system may allow unintend… |
CVE-2026-8028 | Low | 3.7 | 2026-05-06 | A vulnerability was detected in FlowiseAI Flowise up to 3.0.12. This affects the function verify of the file packages/server/src/enterprise/services/account.se… |
CVE-2025-31984 | Low | 3.7 | 2026-05-06 | HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header. This could allow b… |
CVE-2025-31983 | Low | 3.7 | 2026-05-06 | HCL BigFix Service Management (SM) is affected by a security misconfiguration vulnerability due to CSP header. This could allow attackers to inject malicious… |
CVE-2025-31982 | Low | 3.7 | 2026-05-06 | HCL BigFix Service Management (SM) had directories that were not linked or publicly visible but could be accessed directly. This could allow an increased risk… |
CVE-2025-31975 | Low | 2.6 | 2026-05-06 | HCL BigFix Service Management (SM) is affected by an Information Disclosure – Server Banner issue was identified. Exposed server banners may reveal software ve… |
CVE-2025-31959 | Low | 3.5 | 2026-05-06 | HCL BigFix Service Management (SM) application fails to strip EXIF metadata from uploaded images. This could lead to confidentiality and privacy risks if sens… |
CVE-2025-31957 | Low | 2.6 | 2026-05-06 | HHCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability. This could lead to unauthorized changes or exposure of s… |
CVE-2026-8026 | Low | 3.7 | 2026-05-06 | A security flaw has been discovered in FlowiseAI Flowise up to 3.0.12. Affected is the function Login of the file packages/server/src/enterprise/services/accou… |
CVE-2025-62345 | Low | 2.7 | 2026-05-06 | HCL BigFix RunBookAI is affected by a Continued availability of Less-Secure “Input Text” Vulnerability . A component contains a security weakness in its input… |
CVE-2025-59854 | Low | 3.1 | 2026-05-06 | HCL DFXAnalytics is affected by an Insecure Security Header Configuration vulnerability where the application utilizes the outdated X-XSS-Protection header, wh… |
CVE-2025-59853 | Low | 3.1 | 2026-05-06 | HCL DFXAnalytics is affected by an Improper Error Handling vulnerability where the application exposes detailed stack traces in responses, which could allow an… |
CVE-2025-59852 | Low | 3.7 | 2026-05-06 | HCL DFXAnalytics is affected by an Insufficient Transport Layer Protection vulnerability where data is transmitted over the network without encryption, which… |
CVE-2025-59851 | Low | 3.7 | 2026-05-06 | HCL DFXAnalytics is affected by a Using Components with Known Vulnerabilities flaw where the application utilizes unpatched libraries or sub-components, which… |
CVE-2026-44405 | Low | 3.4 | 2026-05-06 | In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm. |
CVE-2026-7847 | Low | 2.6 | 2026-05-05 | A vulnerability was found in chatchat-space Langchain-Chatchat up to 0.3.1.3. The affected element is the function _get_file_id of the file libs/chatchat-serve… |
CVE-2026-7846 | Low | 2.6 | 2026-05-05 | A vulnerability has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3. Impacted is the function files of the file libs/chatchat-server/chatchat/ser… |
CVE-2026-7845 | Low | 2.6 | 2026-05-05 | A flaw has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3. This issue affects the function PIL.Image.tobytes of the file libs/chatchat-server/ch… |
CVE-2026-43529 | Low | 2.5 | 2026-05-05 | OpenClaw before 2026.4.10 contains a time-of-check-time-of-use vulnerability in the validateScriptFileForShellBleed function that allows local attackers to byp… |
CVE-2026-43964 | Low | 3.7 | 2026-05-04 | Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status code that lacks t… |
CVE-2026-7740 | Low | 3.3 | 2026-05-04 | A security vulnerability has been detected in justdan96 tsMuxer up to 2.7.0. This issue affects the function VvcVpsUnit::setFPS of the file tsMuxer/vvc.cpp. Su… |
CVE-2026-7739 | Low | 3.3 | 2026-05-04 | A weakness has been identified in justdan96 tsMuxer up to 2.7.0. This vulnerability affects the function HevcVpsUnit::setFPS of the file /AFLplusplus/tsMuxer_p… |
CVE-2026-43864 | Low | 2.5 | 2026-05-04 | mutt before 2.3.2 has a show_sig_summary NULL pointer dereference. |
CVE-2026-43863 | Low | 3.7 | 2026-05-04 | mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c. |
CVE-2026-43862 | Low | 3.7 | 2026-05-04 | In mutt before 2.3.2, the imap_auth_gss security level is mishandled. |
CVE-2026-43861 | Low | 3.7 | 2026-05-04 | mutt before 2.3.2 does not check for '\0' in url_pct_decode. |
CVE-2026-43860 | Low | 3.7 | 2026-05-04 | mutt before 2.3.2 sometimes truncates the hash_passwd by one byte for IMAP auth_cram MD5 digest. |
CVE-2026-43859 | Low | 3.7 | 2026-05-04 | mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5 digest. |
CVE-2026-7689 | Low | 3.7 | 2026-05-03 | A security flaw has been discovered in Dolibarr ERP CRM up to 23.0.2. This vulnerability affects the function dol_verifyHash in the library htdocs/core/lib/sec… |