Low-severity CVEs (page 12)
Page 12 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-22018 | Low | 3.7 | 2026-04-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported ver… |
CVE-2026-22014 | Low | 3.8 | 2026-04-21 | Vulnerability in the Oracle User Management product of Oracle E-Business Suite (component: Workflow and Business Events). Supported versions that are affected… |
CVE-2026-22008 | Low | 3.7 | 2026-04-21 | Vulnerability in Oracle Java SE (component: Libraries). The supported version that is affected is Oracle Java SE: 25.0.1. Difficult to exploit vulnerability… |
CVE-2026-22007 | Low | 2.9 | 2026-04-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported vers… |
CVE-2026-22001 | Low | 2.7 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.0-8.0.45, 8.4… |
CVE-2026-6745 | Low | 3.5 | 2026-04-21 | A vulnerability was determined in Bagisto up to 2.3.15. Affected by this vulnerability is an unknown functionality of the component Custom Scripts Handler. Thi… |
CVE-2026-6743 | Low | 3.5 | 2026-04-21 | A vulnerability has been found in WebSystems WebTOTUM 2026. This impacts an unknown function of the component Calendar. The manipulation leads to cross site sc… |
CVE-2026-40279 | Low | 3.7 | 2026-04-21 | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, decode_signed32() in src/bacnet/bacint.c reconstructs a 32-… |
CVE-2026-29179 | Low | 3.3 | 2026-04-21 | October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, fine-grained sub-permission checks for asset and blueprint file oper… |
CVE-2026-27937 | Low | 3.1 | 2026-04-21 | October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, a reflected Cross-Site Scripting (XSS) vulnerability was identified… |
CVE-2025-31958 | Low | 3.7 | 2026-04-21 | HCL BigFix Service Management is susceptible to HTTP Request Smuggling. HTTP request smuggling vulnerabilities arise when websites route HTTP requests through… |
CVE-2026-31369 | Low | 3.2 | 2026-04-21 | PcManager is affected by type privilege bypass, successful exploitation of this vulnerability may affect service availability |
CVE-2026-40264 | Low | 2.7 | 2026-04-21 | OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who… |
CVE-2026-39396 | Low | 3.1 | 2026-04-21 | OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, `ExtractPluginFromImage()` in OpenBao's OCI plugin downloader extra… |
CVE-2026-39388 | Low | 3.1 | 2026-04-21 | OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, OpenBao's Certificate authentication method, when a token renewal i… |
CVE-2026-6651 | Low | 2.4 | 2026-04-20 | A security flaw has been discovered in erponline.xyz ERP Online up to 4.0.0. This vulnerability affects unknown code of the component Inventory Edit Item Page… |
CVE-2026-6648 | Low | 3.5 | 2026-04-20 | A vulnerability was found in Qibo CMS 1.0. Affected by this vulnerability is an unknown functionality of the component Internal Message Module. Performing a ma… |
CVE-2026-6633 | Low | 3.5 | 2026-04-20 | A security flaw has been discovered in Yifang CMS up to 2.0.5. The impacted element is the function store of the file plugins/yifang_backend_account/logic/admi… |
CVE-2026-6624 | Low | 2.4 | 2026-04-20 | A weakness has been identified in BichitroGan ISP Billing Software 2025.3.20. Affected is an unknown function of the file /?\_route=pool/add of the component P… |
CVE-2026-6623 | Low | 2.4 | 2026-04-20 | A security flaw has been discovered in BichitroGan ISP Billing Software 2025.3.20. This impacts an unknown function of the file /?_route=settings/users-view/ o… |
CVE-2026-6622 | Low | 2.4 | 2026-04-20 | A vulnerability was identified in BichitroGan ISP Billing Software 2025.3.20. This affects an unknown function of the file /?\_route=customers/edit/ of the com… |
CVE-2026-6619 | Low | 3.5 | 2026-04-20 | A vulnerability has been found in langgenius dify up to 1.13.3. Impacted is the function openInNewTab of the file web/app/components/base/image-uploader/image-… |
CVE-2026-6611 | Low | 3.1 | 2026-04-20 | A vulnerability was found in liangliangyy DjangoBlog up to 2.1.0.0. This affects an unknown function of the file djangoblog/settings.py of the component File U… |
CVE-2024-7083 | Low | 3.5 | 2026-04-20 | The Email Encoder WordPress plugin before 2.3.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per… |
CVE-2026-6610 | Low | 3.7 | 2026-04-20 | A vulnerability has been found in liangliangyy DjangoBlog up to 2.1.0.0. The impacted element is an unknown function of the file djangoblog/settings.py of the… |
CVE-2026-6600 | Low | 3.5 | 2026-04-20 | A flaw has been found in langflow-ai langflow up to 1.8.3. This affects an unknown function of the file src/frontend/src/modals/IOModal/components/chatView/cha… |
CVE-2026-6597 | Low | 2.7 | 2026-04-20 | A weakness has been identified in langflow-ai langflow up to 1.8.3. Impacted is the function remove_api_keys/has_api_terms of the file src/backend/base/langflo… |
CVE-2026-6593 | Low | 3.5 | 2026-04-20 | A vulnerability was found in ComfyUI up to 0.13.0. Affected by this issue is some unknown functionality of the file server.py of the component View Endpoint. P… |
CVE-2026-6592 | Low | 3.5 | 2026-04-20 | A vulnerability has been found in ComfyUI up to 0.13.0. Affected by this vulnerability is the function getuserdata of the file app/user_manager.py of the compo… |
CVE-2026-6570 | Low | 2.7 | 2026-04-19 | A security flaw has been discovered in kodcloud KodExplorer up to 4.52. Affected is the function initInstall of the file /app/controller/systemMember.class.php… |
CVE-2026-32690 | Low | 3.7 | 2026-04-18 | Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fie… |
CVE-2026-40341 | Low | 3.5 | 2026-04-18 | libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, an out of bound read in ptp_unpack_EOS_FocusInfoEx could be used to… |
CVE-2026-40336 | Low | 2.4 | 2026-04-18 | libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have a memory leak in `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack… |
CVE-2026-40334 | Low | 3.5 | 2026-04-18 | libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, a missing null terminator exists in ptp_unpack_Canon_FE() in camlibs… |
CVE-2026-33436 | Low | 3.1 | 2026-04-17 | Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. In versions prior to 2.0.0, file upload endpoints render use… |
CVE-2026-6493 | Low | 3.5 | 2026-04-17 | A flaw has been found in lukevella rallly up to 4.7.4. This affects an unknown function of the file apps/web/src/app/[locale]/(auth)/reset-password/components/… |
CVE-2026-6486 | Low | 3.5 | 2026-04-17 | A vulnerability was detected in classroombookings up to 2.17.0. This impacts the function read of the file crbs-core/application/views/layout.php of the compon… |
CVE-2026-35496 | Low | 2.7 | 2026-04-17 | A path traversal vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to access higher-level directories th… |
CVE-2026-40263 | Low | 3.7 | 2026-04-17 | Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the login endpoint performs bcrypt password verification only when the suppl… |
CVE-2026-41080 | Low | 2.9 | 2026-04-16 | libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document. |
CVE-2026-3155 | Low | 3.1 | 2026-04-16 | The OneSignal – Web Push Notifications plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.8.0. This is due to the p… |
CVE-2024-8010 | Low | 3.5 | 2026-04-16 | The component accepts XML input through the publisher without disabling external entity resolution. This allows malicious actors to submit a crafted XML payloa… |
CVE-2026-40505 | Low | 3.3 | 2026-04-16 | MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metada… |
CVE-2026-40947 | Low | 2.9 | 2026-04-16 | Yubico libfido2 before 1.17.0, python-fido2 before 2.2.0, and yubikey-manager before 5.9.1 have an unintended DLL search path. |
CVE-2026-6313 | Low | 3.1 | 2026-04-15 | Insufficient policy enforcement in CORS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to leak cro… |
CVE-2026-6312 | Low | 3.1 | 2026-04-15 | Insufficient policy enforcement in Passwords in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to lea… |
CVE-2026-33877 | Low | 3.7 | 2026-04-15 | ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a timing side-channel vulnerability in the password reset… |
CVE-2026-21727 | Low | 3.3 | 2026-04-15 | --- title: Cross-Tenant Legacy Correlation Disclosure and Deletion draft: false hero: image: /static/img/heros/hero-legal2.svg content: "# Cross-Tenant Leg… |
CVE-2026-33212 | Low | 3.1 | 2026-04-15 | Weblate is a web based localization tool. In versions prior to 5.17, the tasks API didn't verify user access for pending tasks. This could expose logs of in-pr… |
CVE-2026-27769 | Low | 2.7 | 2026-04-15 | Mattermost versions 10.11.x <= 10.11.12 fail to validate whether users were correctly owned by the correct Connected Workspace which allows a malicious remote… |
CVE-2025-52641 | Low | 2.9 | 2026-04-15 | HCL AION is affected by a vulnerability where certain system behaviours may allow exploration of internal filesystem structures. Exposure of such information m… |
CVE-2026-34454 | Low | 3.5 | 2026-04-14 | OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. A regression introduced in 7.11.0 prevents OAuth2 Proxy from clearing the… |
CVE-2026-27308 | Low | 2.4 | 2026-04-14 | ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-ser… |
CVE-2026-27307 | Low | 2.4 | 2026-04-14 | ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-ser… |
CVE-2026-27316 | Low | 2.7 | 2026-04-14 | A insufficiently protected credentials vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4 all versions, FortiSandbox PaaS 5.0.1 throu… |
CVE-2026-21741 | Low | 2.4 | 2026-04-14 | An URL Redirection to Untrusted Site ('Open Redirect') vulnerability [CWE-601] vulnerability in Fortinet FortiNAC-F 7.6.0 through 7.6.5, FortiNAC-F 7.4 all ver… |
CVE-2026-37602 | Low | 2.7 | 2026-04-14 | SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/user/manage_user.php. |
CVE-2026-37601 | Low | 2.7 | 2026-04-14 | SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/appointments/manage_appointment.php. |
CVE-2026-37600 | Low | 2.7 | 2026-04-14 | SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/appointments/view_details.php. |
CVE-2026-37598 | Low | 2.7 | 2026-04-14 | SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to arbitrary code execution (RCE) via /scheduler/classes/SystemSettings.php?f=update_set… |
CVE-2026-37597 | Low | 2.7 | 2026-04-14 | SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/attendance_list.php. |
CVE-2026-37596 | Low | 2.7 | 2026-04-14 | SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/manage_department.php. |
CVE-2026-37595 | Low | 2.7 | 2026-04-14 | SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/manage_employee.php. |
CVE-2026-37594 | Low | 2.7 | 2026-04-14 | SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/view_employee.php. |
CVE-2026-37593 | Low | 2.7 | 2026-04-14 | SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/view_att.php. |
CVE-2026-37592 | Low | 2.7 | 2026-04-14 | Sourcecodester Storage Unit Rental Management System v1.0 is vulnerable to SQL in the file /storage/admin/maintenance/manage_pricing.php. |
CVE-2026-37591 | Low | 2.7 | 2026-04-14 | Sourcecodester Storage Unit Rental Management System v1.0 is vulnerable to SQL injection in the file /storage/admin/tenants/view_details.php. |
CVE-2026-37590 | Low | 2.7 | 2026-04-14 | SourceCodester Storage Unit Rental Management System v1.0 is vulnerable to SQL Injection in the file /storage/admin/rents/manage_rent.php. |
CVE-2026-37589 | Low | 2.7 | 2026-04-14 | SourceCodester Storage Unit Rental Management System v1.0 is vulnerable to SQL Injection in the file /storage/admin/maintenance/manage_storage_unit.php. |
CVE-2025-40745 | Low | 3.7 | 2026-04-14 | A vulnerability has been identified in Siemens Software Center (All versions < V3.5.8.2), Simcenter 3D (All versions < V2506.6000), Simcenter Femap (All versio… |
CVE-2026-39419 | Low | 3.1 | 2026-04-14 | MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, an authenticated user can bypass sandbox result validation and spoof tool exe… |
CVE-2026-27675 | Low | 2.0 | 2026-04-14 | SAP Landscape Transformation contains a vulnerability in an RFC-exposed function module that could allow a high privileged adversary to inject arbitrary ABAP c… |
CVE-2026-6216 | Low | 3.5 | 2026-04-13 | A security vulnerability has been detected in DbGate up to 7.1.4. This affects an unknown function of the file packages/web/src/icons/FontIcon.svelte of the co… |
CVE-2026-33659 | Low | 3.5 | 2026-04-13 | EspoCRM is an open source customer relationship management application. In versions 9.3.3 and below, the POST /api/v1/Attachment/fromImageUrl endpoint is vulne… |
CVE-2026-6192 | Low | 3.3 | 2026-04-13 | A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This impacts the function opj_pi_initialise_encode in the library src/lib/openjp2/pi.c. The m… |
CVE-2026-36952 | Low | 2.7 | 2026-04-13 | Sourcecodester Online Thesis Archiving System v1.0 is vulnerable to SQL injection in the file /otas/admin/curriculum/manage_curriculum.php. |
CVE-2026-36950 | Low | 2.7 | 2026-04-13 | Sourcecodester Online Thesis Archiving System v1.0 is vulnerable to SQL injection in /otas/projects_per_department.php. |
CVE-2026-6184 | Low | 2.4 | 2026-04-13 | A weakness has been identified in code-projects Simple Content Management System 1.0. This affects an unknown part of the file /web/admin/welcome.php. Executin… |
CVE-2026-36938 | Low | 2.7 | 2026-04-13 | Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injection in /orms/admin/rooms/view_room.php. |
CVE-2026-36937 | Low | 2.7 | 2026-04-13 | Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injection in /orms/admin/reservations/view_details.php. |
CVE-2026-36945 | Low | 2.7 | 2026-04-13 | Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL injection in the file /rsms/admin/clients/manage_client.php |
CVE-2026-36944 | Low | 2.7 | 2026-04-13 | Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerale to SQL injection in the file/rsms/admin/repairs/view_details.php. |
CVE-2026-36943 | Low | 2.7 | 2026-04-13 | Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL injection in the file /rsms/admin/repairs/manage_repair.php. |
CVE-2026-36942 | Low | 2.7 | 2026-04-13 | Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injection in the file /orms/admin/activities/manage_activity.php. |
CVE-2026-36941 | Low | 2.7 | 2026-04-13 | Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL Injection in the file /orms/admin/rooms/manage_room.php. |
CVE-2026-36947 | Low | 2.7 | 2026-04-13 | Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL Injection in the file /rsms/admin/services/view_service.php. |
CVE-2026-36946 | Low | 2.7 | 2026-04-13 | Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL injection in the file /rsms/admin/inquiries/view_details.php. |
CVE-2026-36923 | Low | 2.7 | 2026-04-13 | Sourcecodester Cab Management System 1.0 is vulnerable to SQL Injection in the file /cms/admin/bookings/view_booking.php. |
CVE-2026-36922 | Low | 2.7 | 2026-04-13 | Sourcecodester Cab Management System v1.0 is vulnerable to SQL injection in the file /cms/admin/categories/view_category.php. |
CVE-2026-36920 | Low | 2.7 | 2026-04-13 | Sourcecodester Online Reviewer System v1.0 is vulnerable to SQL Injection in the file /system/system/admins/assessments/examproper/questions-view.php. |
CVE-2026-36919 | Low | 2.7 | 2026-04-13 | Sourcecodester Online Reviewer System v1.0 is vulnerale to SQL Injection in the file /system/system/admins/assessments/examproper/exam-update.php. |
CVE-2026-36874 | Low | 2.7 | 2026-04-13 | Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/load_student.php. |
CVE-2026-36873 | Low | 2.7 | 2026-04-13 | Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/load_admin.php. |
CVE-2026-36872 | Low | 2.7 | 2026-04-13 | Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/load_book.php. |
CVE-2025-15632 | Low | 3.5 | 2026-04-13 | A vulnerability has been found in 1Panel-dev MaxKB up to 2.4.2. Impacted is an unknown function of the file ui/src/chat.ts of the component MdPreview. Such man… |
CVE-2026-21014 | Low | 2.8 | 2026-04-13 | Improper access control in Samsung Camera prior to version 16.5.00.28 allows local attacker to access location data. User interaction is required for triggerin… |
CVE-2026-21012 | Low | 3.3 | 2026-04-13 | External control of file name in AODManager prior to SMR Apr-2026 Release 1 allows privileged local attacker to create file with system privilege. |
CVE-2026-21006 | Low | 2.4 | 2026-04-13 | Improper access control in Samsung DeX prior to SMR Apr-2026 Release 1 allows physical attackers to access to hidden notification contents. |
CVE-2026-6162 | Low | 3.5 | 2026-04-13 | A vulnerability has been found in PHPGurukul Company Visitor Management System 2.0. This impacts an unknown function of the file /bwdates-reports-details.php… |
CVE-2026-34849 | Low | 2.5 | 2026-04-13 | UAF vulnerability in the screen management module. Impact: Successful exploitation of this vulnerability may affect availability. |