Low-severity CVEs (page 15)
Page 15 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-32006 | Low | 3.1 | 2026-03-19 | OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where DM pairing-store identities are incorrectly treated as group allowlist… |
CVE-2026-3230 | Low | 2.7 | 2026-03-19 | Missing required cryptographic step in the TLS 1.3 client HelloRetryRequest handshake logic in wolfSSL could lead to a compromise in the confidentiality of TLS… |
CVE-2026-31991 | Low | 3.7 | 2026-03-19 | OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where Signal group allowlist policy incorrectly accepts sender identities fr… |
CVE-2026-32943 | Low | 3.1 | 2026-03-18 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.28 and 8.6.48, the password reset… |
CVE-2026-32722 | Low | 3.6 | 2026-03-18 | Memray is a memory profiler for Python. Prior to Memray 1.19.2, Memray rendered the command line of the tracked process directly into generated HTML reports wi… |
CVE-2026-32638 | Low | 2.7 | 2026-03-18 | StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.4, the REST API `getUsers` endpoint in StudioCMS uses the a… |
CVE-2026-4356 | Low | 2.4 | 2026-03-18 | A flaw has been found in itsourcecode University Management System 1.0. Affected is an unknown function of the file /add_result.php. Executing a manipulation o… |
CVE-2026-4355 | Low | 3.5 | 2026-03-18 | A vulnerability was detected in Portabilis i-Educar 2.11. This impacts an unknown function of the file /intranet/educar_servidor_curso_lst.php of the component… |
CVE-2026-4354 | Low | 3.5 | 2026-03-18 | A vulnerability was identified in TRENDnet TEW-824DRU 1.010B01/1.04B01. The impacted element is the function sub_420A78 of the file apply_sec.cgi of the compon… |
CVE-2026-4359 | Low | 2.0 | 2026-03-17 | A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C… |
CVE-2026-32293 | Low | 3.7 | 2026-03-17 | The GL-iNet Comet (GL-RM1) KVM connects to a GL-iNet site during boot-up to provision client and CA certificates. The GL-RM1 does not verify certificates used… |
CVE-2025-31966 | Low | 2.7 | 2026-03-17 | HCL Sametime is vulnerable to broken server-side validation. While the application performs client-side input checks, these are not enforced by the web server… |
CVE-2026-3634 | Low | 3.9 | 2026-03-17 | A flaw was found in libsoup. An attacker controlling the value used to set the Content-Type header can inject a Carriage Return Line Feed (CRLF) sequence due t… |
CVE-2026-3633 | Low | 3.9 | 2026-03-17 | A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and ad… |
CVE-2026-3632 | Low | 3.9 | 2026-03-17 | A flaw was found in libsoup, a library used by applications to send network requests. This vulnerability occurs because libsoup does not properly validate host… |
CVE-2026-4285 | Low | 2.7 | 2026-03-17 | A vulnerability was identified in taoofagi easegen-admin up to 8f87936ac774065b92fb20aab55b274a6ea76433. Impacted is the function recognizeMarkdown of the file… |
CVE-2026-26230 | Low | 3.8 | 2026-03-16 | Mattermost versions 10.11.x <= 10.11.10 fail to properly validate permission requirements in the team member roles API endpoint which allows team administrator… |
CVE-2026-4251 | Low | 2.5 | 2026-03-16 | A vulnerability was determined in CityData CityChat up to 0.12.6 on Android. Affected by this vulnerability is an unknown functionality of the file resources/a… |
CVE-2026-4250 | Low | 2.5 | 2026-03-16 | A vulnerability was found in Albert Sağlık Hizmetleri ve Ticaret Albert Health up to 1.7.3 on Android. Affected is an unknown function of the file resources/as… |
CVE-2026-4243 | Low | 2.5 | 2026-03-16 | A weakness has been identified in La Nacion App 10.2.25 on Android. This impacts an unknown function of the file source/app/lanacion/clublanacion/BuildConfig.j… |
CVE-2026-4242 | Low | 2.5 | 2026-03-16 | A security flaw has been discovered in BabyChakra Pregnancy & Parenting App up to 5.4.3.0 on Android. This affects an unknown function of the file file app/bab… |
CVE-2026-22545 | Low | 3.1 | 2026-03-16 | Mattermost versions 10.11.x <= 10.11.10 fail to validate user's authentication method when processing account auth type switch which allows an authenticated at… |
CVE-2025-52649 | Low | 1.8 | 2026-03-16 | HCL AION is affected by a vulnerability where certain identifiers may be predictable in nature. Predictable identifiers may allow an attacker to infer or guess… |
CVE-2025-52646 | Low | 2.2 | 2026-03-16 | HCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries. Improper validation or r… |
CVE-2025-52645 | Low | 1.9 | 2026-03-16 | HCL AION is affected by a vulnerability where model packaging and distribution mechanisms may not include sufficient authenticity verification. This may allow… |
CVE-2025-52642 | Low | 3.3 | 2026-03-16 | HCL AION is affected by a vulnerability where internal filesystem paths may be exposed through application responses or system behaviour. Exposure of internal… |
CVE-2025-52636 | Low | 1.8 | 2026-03-16 | HCL AION is affected by a vulnerability related to the handling of upload size limits. Improper control or validation of upload sizes may allow excessive resou… |
CVE-2026-4239 | Low | 3.5 | 2026-03-16 | A vulnerability was found in Lagom WHMCS Template up to 2.3.7. Impacted is an unknown function of the component Datatables. The manipulation results in imprope… |
CVE-2026-4225 | Low | 2.4 | 2026-03-16 | A security flaw has been discovered in CMS Made Simple up to 2.2.21. Impacted is an unknown function of the file admin/listusers.php of the component User Mana… |
CVE-2026-4222 | Low | 3.8 | 2026-03-16 | A vulnerability was determined in SSCMS up to 7.4.0. This vulnerability affects the function PathUtils.RemoveParentPath of the file /api/admin/plugins/install/… |
CVE-2026-4219 | Low | 3.3 | 2026-03-16 | A flaw has been found in INDEX Conferences & Exhibitions Organization YWF BPOF APGCS App up to 1.0.2 on Android. Affected by this vulnerability is an unknown f… |
CVE-2026-4218 | Low | 2.5 | 2026-03-16 | A vulnerability was detected in myAEDES App up to 1.18.4 on Android. Affected is an unknown function of the file aedes/me/beta/utils/EngageBayUtils.java of the… |
CVE-2026-4217 | Low | 2.5 | 2026-03-16 | A security vulnerability has been detected in XREAL Nebula App up to 3.2.1 on Android. This impacts an unknown function of the file in ai/nreal/nebula/flutterP… |
CVE-2026-4186 | Low | 3.5 | 2026-03-16 | A vulnerability was determined in UEditor up to 1.4.3.2. This issue affects some unknown processing of the file php/controller.php?action=uploadimage of the co… |
CVE-2026-4175 | Low | 3.5 | 2026-03-16 | A vulnerability was determined in Aureus ERP up to 1.3.0-BETA2. The affected element is an unknown function of the file plugins/webkul/chatter/resources/views/… |
CVE-2026-4174 | Low | 3.3 | 2026-03-16 | A vulnerability has been found in Radare2 5.9.9. This issue affects the function walk_exports_trie of the file libr/bin/format/mach0/mach0.c of the component M… |
CVE-2026-4169 | Low | 2.4 | 2026-03-16 | A security flaw has been discovered in Tecnick TCExam up to 16.6.0. Affected is the function F_xml_export_users of the file admin/code/tce_xml_users.php of the… |
CVE-2026-4168 | Low | 2.4 | 2026-03-16 | A vulnerability was identified in Tecnick TCExam 16.5.0. This impacts an unknown function of the file /admin/code/tce_edit_group.php of the component Group Han… |
CVE-2026-4166 | Low | 3.5 | 2026-03-16 | A vulnerability was found in Wavlink WL-NU516U1 240425. The impacted element is the function sub_404F68 of the file /cgi-bin/login.cgi. The manipulation of the… |
CVE-2026-4165 | Low | 2.4 | 2026-03-16 | A vulnerability has been found in Worksuite HR, CRM and Project Management up to 5.5.25. The affected element is an unknown function of the file /account/order… |
CVE-2026-32778 | Low | 2.9 | 2026-03-16 | libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition. |
CVE-2026-32772 | Low | 3.4 | 2026-03-16 | telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON SEND USERVAR. |
CVE-2026-32717 | Low | 2.7 | 2026-03-16 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, in multi-use… |
CVE-2026-32715 | Low | 3.8 | 2026-03-16 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, The two gene… |
CVE-2026-20992 | Low | 3.3 | 2026-03-16 | Improper authorization in Settings prior to SMR Mar-2026 Release 1 allows local attacker to disable configuring the background data usage of application. |
CVE-2026-20989 | Low | 2.4 | 2026-03-16 | Improper verification of cryptographic signature in Font Settings prior to SMR Mar-2026 Release 1 allows physical attackers to use custom font. |
CVE-2026-0849 | Low | 3.8 | 2026-03-16 | Malformed ATAES132A responses with an oversized length field overflow a 52-byte stack buffer in the Zephyr crypto driver, allowing a compromised device or bus… |
CVE-2026-0639 | Low | 3.3 | 2026-03-16 | in OpenHarmony v6.0 and prior versions allow a local attacker case DOS through missing release of memory. |
CVE-2025-71264 | Low | 3.7 | 2026-03-16 | Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service (client crash). |
CVE-2025-69239 | Low | 2.7 | 2026-03-16 | Raytha CMS is vulnerable to Server-Side Request Forgery in the “Themes - Import from URL” feature. It allows an attacker with high privileges to provide the UR… |
CVE-2025-26474 | Low | 3.3 | 2026-03-16 | in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information improper input. This vulnerability can be exploited only in restricted scenar… |
CVE-2025-13459 | Low | 2.7 | 2026-03-16 | IBM Aspera Console 3.3.0 through 3.4.8 could allow a privileged user to cause a denial of service due to improper enforcement of behavioral workflow. |
CVE-2026-32445 | Low | 2.7 | 2026-03-13 | Missing Authorization vulnerability in Elementor Elementor Website Builder elementor allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2026-29776 | Low | 3.1 | 2026-03-13 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Cor… |
CVE-2026-22204 | Low | 3.7 | 2026-03-13 | wpDiscuz before 7.6.47 contains an email header injection vulnerability that allows attackers to manipulate mail recipients by injecting malicious data into th… |
CVE-2025-14811 | Low | 3.1 | 2026-03-13 | IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow an attacker to obtain sensitive information from the qu… |
CVE-2025-13718 | Low | 3.7 | 2026-03-13 | IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow a remote attacker to obtain sensitive information in cl… |
CVE-2025-13462 | Low | 3.3 | 2026-03-12 | The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME… |
CVE-2026-4045 | Low | 3.7 | 2026-03-12 | A flaw has been found in projectsend up to r1945. This impacts an unknown function of the file includes/Classes/Auth.php. Executing a manipulation of the argum… |
CVE-2026-4044 | Low | 3.8 | 2026-03-12 | A vulnerability was detected in projectsend up to r1945. This affects the function realpath of the file /import-orphans.php of the component Delete Handler. Pe… |
CVE-2026-4040 | Low | 3.3 | 2026-03-12 | A vulnerability was identified in OpenClaw up to 2026.2.17. This issue affects the function tools.exec.safeBins of the component File Existence Handler. The ma… |
CVE-2026-2366 | Low | 3.1 | 2026-03-12 | A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative… |
CVE-2026-4012 | Low | 3.3 | 2026-03-12 | A vulnerability was determined in rxi fe up to ed4cda96bd582cbb08520964ba627efb40f3dd91. The impacted element is the function read_ of the file src/fe.c. This… |
CVE-2026-4010 | Low | 3.3 | 2026-03-12 | A vulnerability was found in ThakeeNathees pocketlang up to cc73ca61b113d48ee130d837a7a8b145e41de5ce. The affected element is the function pkByteBufferAddStrin… |
CVE-2026-4009 | Low | 3.3 | 2026-03-12 | A vulnerability has been found in jarikomppa soloud up to 20200207. Impacted is the function drwav_read_pcm_frames_s16__msadpcm in the library src/audiosource/… |
CVE-2026-3984 | Low | 3.5 | 2026-03-12 | A weakness has been identified in Campcodes Division Regional Athletic Meet Game Result Matrix System 2.1. This vulnerability affects unknown code of the file… |
CVE-2026-3983 | Low | 3.5 | 2026-03-12 | A security flaw has been discovered in Campcodes Division Regional Athletic Meet Game Result Matrix System 2.1. This affects an unknown part of the file save-g… |
CVE-2026-3963 | Low | 3.7 | 2026-03-11 | A security flaw has been discovered in perfree go-fastdfs-web up to 1.3.7. This affects the function rememberMeManager of the file src/main/java/com/perfree/co… |
CVE-2026-3929 | Low | 3.1 | 2026-03-11 | Side-channel information leakage in ResourceTiming in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to leak cross-origin data via a crafted HT… |
CVE-2025-62328 | Low | 3.7 | 2026-03-11 | HCL Nomad server on Domino did not configure the frame-ancestors directive in the Content-Security-Policy header by default which could allow an attacker to ob… |
CVE-2026-32109 | Low | 3.7 | 2026-03-11 | Copyparty is a portable file server. Prior to 1.20.12, if an attacker has been given both read- and write-permissions to the server, they can upload a maliciou… |
CVE-2026-0520 | Low | 2.8 | 2026-03-11 | A potential vulnerability was reported in the Lenovo FileZ Android application that, under certain conditions, could allow a local authenticated user to retrie… |
CVE-2026-3950 | Low | 3.3 | 2026-03-11 | A vulnerability was identified in strukturag libheif up to 1.21.2. This impacts the function Track::load of the file libheif/sequences/track.cc of the componen… |
CVE-2026-31974 | Low | 3.0 | 2026-03-11 | OpenProject is an open-source, web-based project management software. Prior to 17.2.0, OpenProject SMTP test endpoint (POST /admin/settings/mail_notifications)… |
CVE-2026-24508 | Low | 2.5 | 2026-03-11 | Dell Alienware Command Center (AWCC), versions prior to 6.12.24.0, contain an Improper Certificate Validation vulnerability. A low privileged attacker with loc… |
CVE-2026-3949 | Low | 3.3 | 2026-03-11 | A vulnerability was determined in strukturag libheif up to 1.21.2. This affects the function vvdec_push_data2 of the file libheif/plugins/decoder_vvdec.cc of t… |
CVE-2026-24509 | Low | 3.6 | 2026-03-11 | Dell Alienware Command Center (AWCC), versions prior to 6.12.24.0, contain an Improper Access Control vulnerability. A low privileged attacker with local acces… |
CVE-2026-31863 | Low | 3.6 | 2026-03-11 | Anytype Heart is the middleware library for Anytype. The challenge-based authentication for the local gRPC client API can be bypassed, allowing an attacker to… |
CVE-2025-12704 | Low | 3.5 | 2026-03-11 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed… |
CVE-2025-12697 | Low | 2.2 | 2026-03-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.5 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allow… |
CVE-2026-3946 | Low | 3.5 | 2026-03-11 | A vulnerability was detected in PHPEMS 11.0. The affected element is an unknown function of the file /index.php?ask=app-ask. Performing a manipulation of the a… |
CVE-2025-70330 | Low | 3.3 | 2026-03-11 | Easy Grade Pro 4.1.0.2 contains a file parsing logic flaw in the handling of proprietary .EGP gradebook files. By modifying specific fields at precise offsets… |
CVE-2026-3911 | Low | 2.7 | 2026-03-11 | A flaw was found in Keycloak. An authenticated user with the view-users role could exploit a vulnerability in the UserResource component. By accessing a specif… |
CVE-2026-21295 | Low | 3.1 | 2026-03-11 | Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a URL Redirection to Untrusted Site ('Ope… |
CVE-2026-0121 | Low | 2.9 | 2026-03-10 | In VPU, there is a possible use-after-free read due to a race condition. This could lead to local information disclosure with no additional execution privilege… |
CVE-2026-0115 | Low | 2.1 | 2026-03-10 | In Trusted Execution Environment, there is a possible key leak due to side channel information disclosure. This could lead to physical information disclosure w… |
CVE-2026-24641 | Low | 2.7 | 2026-03-10 | A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4 all versi… |
CVE-2026-22629 | Low | 3.7 | 2026-03-10 | An improper restriction of excessive authentication attempts vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4 all versions, Forti… |
CVE-2026-21791 | Low | 3.3 | 2026-03-10 | HCL Sametime for Android is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URL |
CVE-2025-27769 | Low | 2.6 | 2026-03-10 | A vulnerability has been identified in Heliox Flex 180 kW EV Charging Station (All versions < F4.11.1), Heliox Mobile DC 40 kW EV Charging Station (All version… |
CVE-2026-24310 | Low | 3.5 | 2026-03-10 | Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP function module and read… |
CVE-2026-3819 | Low | 3.5 | 2026-03-09 | A vulnerability has been found in SourceCodester Resort Reservation System 1.0. The affected element is an unknown function of the file /?page=manage_reservati… |
CVE-2026-3766 | Low | 3.5 | 2026-03-08 | A security flaw has been discovered in SourceCodester Web-based Pharmacy Product Management System 1.0. This impacts an unknown function of the file edit-profi… |
CVE-2026-3743 | Low | 3.5 | 2026-03-08 | A flaw has been found in YiFang CMS 2.0.5. This affects the function update of the file app/db/admin/D_singlePageGroup.php. Executing a manipulation of the arg… |
CVE-2026-3742 | Low | 3.5 | 2026-03-08 | A vulnerability was detected in YiFang CMS 2.0.5. The impacted element is the function update of the file app/db/admin/D_singlePage.php. Performing a manipulat… |
CVE-2026-3741 | Low | 3.5 | 2026-03-08 | A security vulnerability has been detected in YiFang CMS 2.0.5. The affected element is the function update of the file app/db/admin/D_friendLink.php. Such man… |
CVE-2026-3721 | Low | 3.5 | 2026-03-08 | A weakness has been identified in 1024-lab/lab1024 SmartAdmin up to 3.29. The affected element is an unknown function of the file sa-base/src/main/java/net/lab… |
CVE-2026-3720 | Low | 3.5 | 2026-03-08 | A security flaw has been discovered in 1024-lab/lab1024 SmartAdmin up to 3.29. Impacted is an unknown function of the file smart-admin-web-javascript/src/views… |
CVE-2026-3716 | Low | 2.4 | 2026-03-08 | A vulnerability was determined in Wavlink WL-WN579X3-C 231124. This vulnerability affects the function sub_401AD4 of the file /cgi-bin/adm.cgi. Executing a man… |
CVE-2026-3706 | Low | 3.7 | 2026-03-08 | A vulnerability was determined in mkj Dropbear up to 2025.89. Impacted is the function unpackneg of the file src/curve25519.c of the component S Range Check. T… |