Low-severity CVEs (page 13)
Page 13 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-34851 | Low | 2.2 | 2026-04-13 | Race condition vulnerability in the event notification module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-34850 | Low | 1.9 | 2026-04-13 | Race condition vulnerability in the notification service. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-6107 | Low | 3.5 | 2026-04-12 | A flaw has been found in 1Panel-dev MaxKB up to 2.6.1. This issue affects some unknown processing of the file apps/common/middleware/chat_headers_middleware.py… |
CVE-2026-6106 | Low | 3.5 | 2026-04-11 | A vulnerability was detected in 1Panel-dev MaxKB up to 2.2.1. This vulnerability affects the function StaticHeadersMiddleware of the file apps/common/middlewar… |
CVE-2026-40354 | Low | 2.9 | 2026-04-11 | Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on g_file_t… |
CVE-2026-40194 | Low | 3.7 | 2026-04-10 | phpseclib is a PHP secure communications library. Starting in 0.1.1 and prior to 3.0.51, 2.0.53, and 1.0.28, phpseclib\Net\SSH2::get_binary_packet() uses PHP's… |
CVE-2026-40184 | Low | 3.7 | 2026-04-10 | TREK is a collaborative travel planner. Prior to 2.7.2, TREK served uploaded photos without requiring authentication. This vulnerability is fixed in 2.7.2. |
CVE-2026-40097 | Low | 3.7 | 2026-04-10 | Step CA is an online certificate authority for secure, automated certificate management for DevOps. From 0.24.0 to before 0.30.0-rc3, an attacker can trigger a… |
CVE-2026-35648 | Low | 3.7 | 2026-04-10 | OpenClaw before 2026.3.22 contains a policy bypass vulnerability where queued node actions are not revalidated against current command policy when delivered. A… |
CVE-2026-40228 | Low | 2.9 | 2026-04-10 | In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p emerg" command is executed, if ForwardToW… |
CVE-2026-6042 | Low | 3.3 | 2026-04-10 | A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the file src/locale/iconv.c of the component GB18030 4-byte Dec… |
CVE-2026-6003 | Low | 2.4 | 2026-04-10 | A security vulnerability has been detected in code-projects Simple IT Discussion Forum 1.0. This issue affects some unknown processing of the file /admin/user… |
CVE-2026-33551 | Low | 3.5 | 2026-04-10 | An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 creden… |
CVE-2026-40109 | Low | 3.1 | 2026-04-09 | Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Fl… |
CVE-2026-40077 | Low | 3.5 | 2026-04-09 | Beszel is a server monitoring platform. Prior to 0.18.7, some API endpoints in the Beszel hub accept a user-supplied system ID and proceed without further chec… |
CVE-2026-24661 | Low | 3.7 | 2026-04-09 | Mattermost Plugins versions <=2.1.3.0 fail to limit the request body size on the {{/changes}} webhook endpoint which allows an authenticated attacker to cause… |
CVE-2026-21388 | Low | 3.7 | 2026-04-09 | Mattermost Plugins versions <=2.3.1 fail to limit the request body size on the {{/lifecycle}} webhook endpoint which allows an authenticated attacker to cause… |
CVE-2026-5836 | Low | 2.4 | 2026-04-09 | A vulnerability has been found in code-projects Online Shoe Store 1.0. Affected by this issue is some unknown functionality of the file /admin/admin_product.ph… |
CVE-2026-5835 | Low | 2.4 | 2026-04-09 | A flaw has been found in code-projects Online Shoe Store 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/admin_football.php… |
CVE-2026-5834 | Low | 2.4 | 2026-04-09 | A vulnerability was detected in code-projects Online Shoe Store 1.0. Affected is an unknown function of the file /admin/admin_running.php. Performing a manipul… |
CVE-2026-4916 | Low | 2.7 | 2026-04-08 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have all… |
CVE-2026-5810 | Low | 3.5 | 2026-04-08 | A flaw has been found in SourceCodester Sales and Inventory System 1.0. Affected is an unknown function of the file /delete.php of the component GET Parameter… |
CVE-2026-5806 | Low | 3.5 | 2026-04-08 | A security vulnerability has been detected in code-projects Easy Blog Site 1.0. This affects an unknown function of the file /posts/update.php. The manipulatio… |
CVE-2026-35400 | Low | 3.5 | 2026-04-08 | LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research… |
CVE-2026-34166 | Low | 3.7 | 2026-04-08 | LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.3, the replace filter in LiquidJS incorrectly accounts for m… |
CVE-2026-28264 | Low | 3.3 | 2026-04-08 | Dell PowerProtect Agent Service, version(s) prior to 20.1, contain(s) an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged… |
CVE-2026-39510 | Low | 2.7 | 2026-04-08 | Authorization Bypass Through User-Controlled Key vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Exploiting… |
CVE-2026-34781 | Low | 2.8 | 2026-04-07 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, ap… |
CVE-2026-27949 | Low | 2.0 | 2026-04-07 | Plane is an an open-source project management tool. Prior to 1.3.0, a vulnerability was identified in Plane's authentication flow where a user's email address… |
CVE-2026-39349 | Low | 2.7 | 2026-04-07 | OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source encrypts certain sensitive fields with AES in ECB m… |
CVE-2026-39347 | Low | 2.7 | 2026-04-07 | OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source accepts changes to self-appraisal submissions for a… |
CVE-2026-39321 | Low | 3.7 | 2026-04-07 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.8.0-alpha.6 and 8.6.74, he login endpoint re… |
CVE-2026-5382 | Low | 3.0 | 2026-04-07 | An issue that could expose records outside of the authorized organization scope through the MCP endpoints has been resolved. This is an instance of CWE-863: In… |
CVE-2026-5381 | Low | 2.2 | 2026-04-07 | An issue that could expose task information outside of the authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authoriza… |
CVE-2026-5379 | Low | 3.0 | 2026-04-07 | An issue that allowed MCP agents to access certificate information from outside of their authorized organization scope has been resolved. This is an instance o… |
CVE-2026-5375 | Low | 2.7 | 2026-04-07 | An issue that could allow a user with access to a credential to view sensitive fields through an API response has been resolved. This is an instance of CWE-200… |
CVE-2026-4292 | Low | 2.7 | 2026-04-07 | An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using `ModelAdmin.list_editable` incorrectly allo… |
CVE-2026-28810 | Low | 3.7 | 2026-04-07 | Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning. The built-in DNS r… |
CVE-2026-35448 | Low | 3.7 | 2026-04-06 | WWBN AVideo is an open source video platform. In versions 26.0 and prior, the BlockonomicsYPT plugin's check.php endpoint returns payment order data for any Bi… |
CVE-2026-5682 | Low | 3.7 | 2026-04-06 | A vulnerability has been found in Meesho Online Shopping App up to 27.3 on Android. Affected is an unknown function of the file /api/endpoint of the component… |
CVE-2026-5668 | Low | 2.4 | 2026-04-06 | A flaw has been found in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This affects an unknown part of the file /admin/Ad… |
CVE-2026-34764 | Low | 2.3 | 2026-04-06 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 33.0.0-alpha.1 to before 39.8.5, 40.8.5, 41.1.0, a… |
CVE-2026-33405 | Low | 3.1 | 2026-04-06 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, the form… |
CVE-2026-33404 | Low | 3.4 | 2026-04-06 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, client h… |
CVE-2026-5647 | Low | 2.4 | 2026-04-06 | A vulnerability was detected in code-projects Online Shoe Store 1.0. This affects an unknown part of the file /admin/admin_feature.php of the component Add Pro… |
CVE-2026-5644 | Low | 2.4 | 2026-04-06 | A security flaw has been discovered in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. Affected is an unknown function of t… |
CVE-2026-5643 | Low | 2.4 | 2026-04-06 | A vulnerability was identified in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This impacts an unknown function of the f… |
CVE-2026-37977 | Low | 3.7 | 2026-04-06 | A flaw was found in Keycloak. A remote attacker can exploit a Cross-Origin Resource Sharing (CORS) header injection vulnerability in Keycloak's User-Managed Ac… |
CVE-2026-5622 | Low | 3.7 | 2026-04-06 | A vulnerability was determined in hcengineering Huly Platform 0.7.382. Affected by this issue is some unknown functionality of the file foundations/core/packag… |
CVE-2026-35679 | Low | 3.5 | 2026-04-05 | Zcash zcashd before 6.12.0 allows invalid transactions to be accepted under certain conditions, which potentially could have resulted in the draining of user f… |
CVE-2026-5568 | Low | 3.5 | 2026-04-05 | A vulnerability has been found in Akaunting up to 3.1.21. This issue affects some unknown processing of the component Invoice/Billing. The manipulation of the… |
CVE-2026-34768 | Low | 3.9 | 2026-04-04 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-be… |
CVE-2026-34766 | Low | 3.3 | 2026-04-04 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-be… |
CVE-2026-3184 | Low | 3.7 | 2026-04-03 | A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote… |
CVE-2026-5471 | Low | 3.3 | 2026-04-03 | A vulnerability was detected in Investory Toy Planet Trouble App up to 1.5.5 on Android. Impacted is an unknown function of the file assets/google-services-des… |
CVE-2026-5468 | Low | 3.5 | 2026-04-03 | A security flaw has been discovered in Casdoor 2.356.0. This affects the function dangerouslySetInnerHTML. Performing a manipulation of the argument formCss/fo… |
CVE-2026-5462 | Low | 3.3 | 2026-04-03 | A vulnerability was identified in Wahoo Fitness SYSTM App up to 7.2.1 on Android. Impacted is an unknown function of the file com/WahooFitness/SYSTM/BuildConfi… |
CVE-2026-5458 | Low | 3.3 | 2026-04-03 | A weakness has been identified in Noelse Individuals & Pro App up to 2.1.7 on Android. This impacts an unknown function of the file com/reactnative/antelop/Bui… |
CVE-2026-5457 | Low | 3.3 | 2026-04-03 | A security flaw has been discovered in PropertyGuru AgentNet Singapore App up to 23.7.10 on Android. This affects an unknown function of the file com/allproper… |
CVE-2026-5456 | Low | 3.3 | 2026-04-03 | A vulnerability was identified in Align Technology My Invisalign App 3.12.4 on Android. The impacted element is an unknown function of the file com/aligntech/m… |
CVE-2026-5455 | Low | 3.3 | 2026-04-03 | A vulnerability was determined in Dialogue App up to 4.3.2 on Android. The affected element is an unknown function of the file file res/raw/config.json of the… |
CVE-2026-5454 | Low | 3.3 | 2026-04-03 | A vulnerability was found in GRID Organiser App up to 1.0.5 on Android. Impacted is an unknown function of the file file res/raw/app.json of the component co.g… |
CVE-2026-5453 | Low | 3.3 | 2026-04-03 | A vulnerability has been found in Rico só vantagem pra investir App up to 4.58.32.12421 on Android. This issue affects some unknown processing of the file br/c… |
CVE-2026-35538 | Low | 3.1 | 2026-04-03 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass du… |
CVE-2026-5452 | Low | 3.3 | 2026-04-03 | A flaw has been found in UCC CampusConnect App up to 14.3.5 on Android. This vulnerability affects unknown code of the file campusconnect/BuildConfig.java of t… |
CVE-2026-35537 | Low | 3.7 | 2026-04-03 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file… |
CVE-2026-5420 | Low | 2.5 | 2026-04-02 | A security flaw has been discovered in Shinrays Games Goods Triple App up to 1.200. The affected element is an unknown function of the file jRwTX.java of the c… |
CVE-2026-34762 | Low | 2.7 | 2026-04-02 | Ella Core is a 5G core designed for private networks. Prior to version 1.8.0, the PUT /api/v1/subscriber/{imsi} API accepts an IMSI identifier from both the UR… |
CVE-2025-43236 | Low | 3.3 | 2026-04-02 | A type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An at… |
CVE-2026-5413 | Low | 3.7 | 2026-04-02 | A vulnerability was identified in Newgen OmniDocs up to 12.0.00. Affected by this vulnerability is an unknown functionality of the file /omnidocs/GetWebApiConf… |
CVE-2026-5370 | Low | 3.5 | 2026-04-02 | A vulnerability was identified in krayin laravel-crm up to 2.2. Impacted is the function composeMail of the file packages/Webkul/Admin/tests/e2e-pw/tests/mail/… |
CVE-2026-5360 | Low | 3.7 | 2026-04-02 | A vulnerability has been found in Free5GC 4.2.0. The affected element is an unknown function of the component aper. Such manipulation leads to type confusion… |
CVE-2026-35388 | Low | 2.5 | 2026-04-02 | OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions. |
CVE-2026-35387 | Low | 3.1 | 2026-04-02 | OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterp… |
CVE-2026-35386 | Low | 3.6 | 2026-04-02 | In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username o… |
CVE-2026-26961 | Low | 3.7 | 2026-04-02 | Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser extracts the boundary parameter from multipar… |
CVE-2026-5332 | Low | 3.5 | 2026-04-02 | A vulnerability was identified in Xiaopi Panel 1.0.0. This vulnerability affects unknown code of the file /demo.php of the component WAF Firewall. The manipula… |
CVE-2026-5325 | Low | 3.5 | 2026-04-02 | A vulnerability was determined in SourceCodester Simple Customer Relationship Management System 1.0. This issue affects some unknown processing of the file /cr… |
CVE-2025-66487 | Low | 2.7 | 2026-04-01 | IBM Aspera Shares 1.9.9 through 1.11.0 does not properly rate limit the frequency that an authenticated user can send emails, which could result in email flood… |
CVE-2026-2475 | Low | 3.1 | 2026-04-01 | IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 thr… |
CVE-2026-5310 | Low | 2.5 | 2026-04-01 | A vulnerability was identified in Enter Software Iperius Backup up to 8.7.2. This impacts an unknown function of the file IperiusAccounts.ini. Such manipulatio… |
CVE-2025-67806 | Low | 3.7 | 2026-04-01 | The login mechanism of Sage DPW 2021_06_004 displays distinct responses for valid and invalid usernames, allowing enumeration of existing accounts in versions… |
CVE-2026-35094 | Low | 3.3 | 2026-04-01 | A flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directories can exploit a dangling pointer vulnerability. T… |
CVE-2026-5254 | Low | 3.5 | 2026-04-01 | A security vulnerability has been detected in welovemedia FFmate up to 2.0.15. Affected by this issue is some unknown functionality of the file /ui/app/compone… |
CVE-2026-5253 | Low | 3.5 | 2026-04-01 | A weakness has been identified in bufanyun HotGo 1.0/2.0. Affected by this vulnerability is an unknown functionality of the file /web/src/layout/components/Hea… |
CVE-2026-5252 | Low | 3.5 | 2026-04-01 | A security flaw has been discovered in z-9527 admin 1.0/2.0. Affected is an unknown function of the file /server/routes/message.js of the component Message Cre… |
CVE-2026-5249 | Low | 3.5 | 2026-04-01 | A vulnerability was found in gougucms 4.08.18. This impacts an unknown function of the file \gougucms-master\app\admin\view\user\record.html of the component R… |
CVE-2026-3470 | Low | 3.8 | 2026-03-31 | A vulnerability exists in the SonicWall Email Security appliance due to improper input sanitization that may lead to data corruption, allowing a remote authent… |
CVE-2026-3469 | Low | 2.7 | 2026-03-31 | A denial-of-service (DoS) vulnerability exists due to improper input validation in the SonicWall Email Security appliance, allowing a remote authenticated atta… |
CVE-2026-34372 | Low | 2.7 | 2026-03-31 | Sulu is an open-source PHP content management system based on the Symfony framework. From versions 1.0.0 to before 2.6.22, and 3.0.0 to before 3.0.5, a user wh… |
CVE-2026-34203 | Low | 2.7 | 2026-03-31 | Nautobot is a Network Source of Truth and Network Automation Platform. Prior to versions 2.4.30 and 3.0.10, user creation and editing via the REST API fails to… |
CVE-2026-5209 | Low | 2.4 | 2026-03-31 | A security vulnerability has been detected in SourceCodester Leave Application System 1.0. Affected by this issue is some unknown functionality of the componen… |
CVE-2026-33415 | Low | 2.7 | 2026-03-31 | Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to b… |
CVE-2025-62184 | Low | 3.4 | 2026-03-31 | Pega Platform versions 8.1.0 through 25.1.0 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. Requires an administrat… |
CVE-2026-33762 | Low | 2.8 | 2026-03-31 | go-git is an extensible git implementation library written in pure Go. Prior to version 5.17.1, go-git’s index decoder for format version 4 fails to validate t… |
CVE-2026-32970 | Low | 2.5 | 2026-03-31 | OpenClaw before 2026.3.11 contains a credential fallback vulnerability where unavailable local gateway.auth.token and gateway.auth.password SecretRefs are trea… |
CVE-2026-0397 | Low | 3.1 | 2026-03-31 | When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malic… |
CVE-2026-0396 | Low | 3.1 | 2026-03-31 | An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynami… |
CVE-2026-32696 | Low | 3.1 | 2026-03-30 | NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In NanoMQ version 0.24.6, after enabling auth.http_auth (HTTP authentication), when a cli… |
CVE-2026-21716 | Low | 3.3 | 2026-03-30 | An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while the… |