Low-severity CVEs (page 17)
Page 17 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-48191 | Low | 3.5 | 2026-06-01 | An incorrect handling of permissions in STORM powered by OTRS and in OTRS (2026.x and above) Document Search Article Meta Filters modules allows gaining knowle… |
CVE-2026-48190 | Low | 3.5 | 2026-06-01 | An incorrect handling of permissions in OTRS External Interface and the ConfigItem List module allows an authenticated customer to query the system for CI info… |
CVE-2026-10216 | Low | 3.7 | 2026-06-01 | A vulnerability was detected in unitedbyai droidclaw up to 0.5.3. The affected element is an unknown function of the file server/src/routes/pairing.ts of the c… |
CVE-2026-10201 | Low | 3.3 | 2026-06-01 | A vulnerability was determined in Assimp up to 6.0.4. This vulnerability affects the function FBXExporter::WriteObjects of the file FBXExporter.cpp of the comp… |
CVE-2026-10199 | Low | 3.3 | 2026-05-31 | A vulnerability has been found in Assimp up to 6.0.4. Affected by this issue is the function glTF2::LazyDict in the library glTF2Asset.h. Such manipulation of… |
CVE-2026-10198 | Low | 3.3 | 2026-05-31 | A flaw has been found in Assimp up to 6.0.4. Affected by this vulnerability is the function Assimp::glTFImporter::ImportMeshes of the file glTFImporter.cpp of… |
CVE-2026-10197 | Low | 3.3 | 2026-05-31 | A vulnerability was detected in Assimp up to 6.0.4. Affected is the function glTF2Importer::ImportEmbeddedTextures in the library code/AssetLib/glTF2/glTF2Impo… |
CVE-2026-10169 | Low | 3.7 | 2026-05-31 | A vulnerability was detected in OUSL-GROUP-BrinaryBrains School Student Management System up to 1e70e5ad1125b86dca4ee086eb6bb121f17708b6. Affected by this vuln… |
CVE-2026-10112 | Low | 2.4 | 2026-05-30 | A vulnerability has been found in sambitraj STUDENT-MANAGEMENT-SYSTEM 1.0. Affected is an unknown function of the component Dashboard Page. The manipulation of… |
CVE-2026-45613 | Low | 3.3 | 2026-05-29 | Rizin is a UNIX-like reverse engineering framework and command-line toolset. There is a heap-buffer-overflow in librz/bin/format/omf/omf.c. This vulnerability… |
CVE-2026-45324 | Low | 3.3 | 2026-05-29 | Rizin is a UNIX-like reverse engineering framework and command-line toolset. There is a double free in librz/core/cmd/cmd_search.c:byte_pattern_search() due wr… |
CVE-2026-49383 | Low | 3.3 | 2026-05-29 | In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible |
CVE-2026-49381 | Low | 3.4 | 2026-05-29 | In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible |
CVE-2026-49380 | Low | 3.1 | 2026-05-29 | In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible |
CVE-2026-49370 | Low | 3.4 | 2026-05-29 | In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests |
CVE-2026-49318 | Low | 2.4 | 2026-05-29 | Incorrect behavior order in the Infotainment / Digital Round display of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network at… |
CVE-2026-49317 | Low | 2.4 | 2026-05-29 | Incorrect behavior order in the Infotainment / Digital Round display of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network at… |
CVE-2026-40528 | Low | 3.8 | 2026-05-29 | OpenSC before 0.27.0, fixed in commit 0358817, contains a stack and heap buffer overrun vulnerability in the do_key_value() function in src/pkcs15init/profile… |
CVE-2026-40510 | Low | 3.8 | 2026-05-29 | OpenSC before 0.27.0-rc1, fixed in commit 3f24f0b, contains a stack buffer overflow vulnerability in piv_process_history() in src/libopensc/card-piv.c that all… |
CVE-2026-10078 | Low | 2.7 | 2026-05-29 | A flaw was found in the Quay config-tool's GitLab OAuth validator. This vulnerability causes sensitive credentials, specifically client_id and client_secret, t… |
CVE-2026-9991 | Low | 3.1 | 2026-05-28 | Inappropriate implementation in Media in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-9959 | Low | 3.1 | 2026-05-28 | Race in WebRTC in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium secur… |
CVE-2026-9950 | Low | 3.1 | 2026-05-28 | Insufficient validation of untrusted input in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer pr… |
CVE-2026-9944 | Low | 3.1 | 2026-05-28 | Uninitialized Use in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to leak cross-origin dat… |
CVE-2026-9920 | Low | 3.1 | 2026-05-28 | Uninitialized Use in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to leak cross-o… |
CVE-2026-6816 | Low | 3.8 | 2026-05-28 | An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the administer users permission to view or generate recovery codes for other users… |
CVE-2026-10011 | Low | 3.1 | 2026-05-28 | Inappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to leak cross-… |
CVE-2026-47713 | Low | 2.0 | 2026-05-28 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0, an approved mobile… |
CVE-2026-45403 | Low | 2.0 | 2026-05-28 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0, the AnythingLLM ag… |
CVE-2026-47337 | Low | 3.3 | 2026-05-28 | Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket mediation. The bug can… |
CVE-2026-47336 | Low | 3.3 | 2026-05-28 | Ubuntu Linux 6.8 contains SAUCE patches with a possible use of an uninitialized variable in AppArmor AF_INET/AF_INET6 socket mediation code. The bug can be tri… |
CVE-2026-47330 | Low | 3.3 | 2026-05-28 | Ubuntu Linux 6.8, 7.17 and 7.0 contain AppArmor SAUCE patches which can, under certain circumstances, use an uninitialized variable in notification handling co… |
CVE-2026-47329 | Low | 3.3 | 2026-05-28 | Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notification responses. The bug can be t… |
CVE-2026-47327 | Low | 3.3 | 2026-05-28 | Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be trigger… |
CVE-2026-45076 | Low | 2.7 | 2026-05-28 | Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, in federated rooms, malicious homeservers can craft room events in such a way tha… |
CVE-2026-48524 | Low | 3.7 | 2026-05-28 | PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every J… |
CVE-2026-48156 | Low | 3.3 | 2026-05-28 | pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes… |
CVE-2026-49009 | Low | 3.1 | 2026-05-27 | Northern.tech Mender Server v4.1.0, v4.0.1 and below, and fixed in v4.1.1 and v4.0.2 allows Directory Traversal. |
CVE-2026-33552 | Low | 3.7 | 2026-05-27 | Northern.tech Mender Enterprise Server before 4.1.1 has Incorrect Access Control. |
CVE-2026-44474 | Low | 3.7 | 2026-05-27 | Ella Core is a 5G core designed for private networks. Prior to 1.10.0, Ella Core didn't enforce security rules on concurrent running of security procedures def… |
CVE-2026-42082 | Low | 3.7 | 2026-05-27 | free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the AMF in Free5GC does not enforce the concurrent security procedure rules de… |
CVE-2026-46057 | Low | 3.3 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: landlock: Fix LOG_SUBDOMAINS_OFF inheritance across fork() hook_cred_transfer() only copi… |
CVE-2026-42791 | Low | 3.7 | 2026-05-27 | Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows forged OCSP responses signed with an expired responder certi… |
CVE-2024-47272 | Low | 2.7 | 2026-05-27 | Incorrect authorization vulnerability in IO Module functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated… |
CVE-2024-47270 | Low | 2.7 | 2026-05-27 | Improper preservation of permissions vulnerability in Archiving Push functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows re… |
CVE-2024-47267 | Low | 2.7 | 2026-05-27 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Archiving Pull functionality in Synology Surveillance Station b… |
CVE-2026-9608 | Low | 2.4 | 2026-05-27 | A vulnerability was determined in QianFox FoxCMS up to 1.2.6. The impacted element is an unknown function of the file /Tag/edit of the component Administrator… |
CVE-2025-68711 | Low | 2.4 | 2026-05-26 | AppLockZ App Lock and Fingerprint Lock (applock.passwordfingerprint.applockz) 4.2.11 for Android allows a local attacker with physical access to bypass the PIN… |
CVE-2025-68708 | Low | 2.4 | 2026-05-26 | SailingLab AppLock (aka com.alpha.applock) 4.3.8 for Android allows a local attacker with physical access to bypass the PIN lock. The lock is implemented as an… |
CVE-2025-68710 | Low | 2.4 | 2026-05-26 | Easyelife App lock (aka Fingerprint,Applock or locker.app.safe.applocker) 1.9.2 for Android allows a local attacker with physical access to bypass the PIN lock… |
CVE-2026-9572 | Low | 3.3 | 2026-05-26 | A security vulnerability has been detected in GPAC up to 2.4.0. Affected by this issue is the function Media_GetSample of the file src/isomedia/media.c of the… |
CVE-2026-9567 | Low | 3.3 | 2026-05-26 | A security flaw has been discovered in GPAC up to 2.4.0. Affected is the function MergeFragment of the file src/isomedia/isom_intern.c of the component MP4Box… |
CVE-2026-42448 | Low | 3.5 | 2026-05-26 | Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. Prior to 0.24.0, there is a path traversal when a r… |
CVE-2026-9564 | Low | 2.4 | 2026-05-26 | A vulnerability was found in SourceCodester/oretnom23 Hospitals Patient Records Management System 1.0. The impacted element is an unknown function of the file… |
CVE-2026-47716 | Low | 3.1 | 2026-05-26 | Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, In affected versions, the issue list view authorizes access through the project in the URL, but a… |
CVE-2026-47715 | Low | 3.1 | 2026-05-26 | Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, Bugsink issue event pages accept a direct event identifier from the URL and, in affected versions… |
CVE-2026-44410 | Low | 3.8 | 2026-05-26 | This vulnerability stems from a business logic flaw.Attackers can exploit legitimate application functions in unintended and abnormal ways, deviating from the… |
CVE-2026-9530 | Low | 3.3 | 2026-05-26 | A weakness has been identified in GNU LibreDWG up to 0.14. The impacted element is the function read_2004_compressed_section of the file src/decode.c of the co… |
CVE-2026-9529 | Low | 3.3 | 2026-05-26 | A security flaw has been discovered in GNU LibreDWG up to 0.14. The affected element is the function match_BLOCK_HEADER of the file dwggrep.c of the component… |
CVE-2026-9504 | Low | 3.3 | 2026-05-25 | A weakness has been identified in GNU LibreDWG up to 0.14. Affected is the function bit_convert_TU of the file programs/dwggrep.c of the component Dwggrep Util… |
CVE-2026-9503 | Low | 3.3 | 2026-05-25 | A security flaw has been discovered in GNU LibreDWG up to 0.14. This impacts the function dwg_next_entity of the file src/decode.c of the component DWG File Ha… |
CVE-2026-9501 | Low | 3.3 | 2026-05-25 | A vulnerability was determined in GNU LibreDWG up to 0.14. The impacted element is the function decompress_R2004_section of the file src/decode.c of the compon… |
CVE-2026-48852 | Low | 3.7 | 2026-05-25 | PuTTY 0.71 before 0.84 has an assertion failure in ECDSA signature verification. |
CVE-2026-48851 | Low | 3.1 | 2026-05-25 | PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but the trust status is not cleared between proxy authentication and… |
CVE-2026-48850 | Low | 3.7 | 2026-05-25 | PuTTY 0.72 before 0.84 has a double free in RSA KEX. |
CVE-2026-9485 | Low | 3.5 | 2026-05-25 | A vulnerability was identified in SourceCodester Student Grades Management System 1.0. Affected by this issue is some unknown functionality of the file student… |
CVE-2026-48847 | Low | 3.7 | 2026-05-25 | Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via redis/memcache session poisoning bypass. |
CVE-2026-9471 | Low | 3.5 | 2026-05-25 | A vulnerability was detected in yashpokharna2555 StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203. This impacts an unknown function of the file… |
CVE-2026-9414 | Low | 3.5 | 2026-05-25 | A security flaw has been discovered in SourceCodester Indian Invoicing System up to 0.x/1.0. The impacted element is an unknown function of the file /Invoicing… |
CVE-2026-48832 | Low | 3.5 | 2026-05-24 | action/cookie.php in ecrire in SPIP before 4.4.15 is prone to an open redirect vulnerability. |
CVE-2026-9398 | Low | 3.1 | 2026-05-24 | A security vulnerability has been detected in Besen BS20 EV Charging Station up to 20260426. This affects an unknown part of the component BLE/WiFi. Such manip… |
CVE-2026-9396 | Low | 3.7 | 2026-05-24 | A security flaw has been discovered in Besen BS20 EV Charging Station up to 20260426. Affected by this vulnerability is an unknown functionality of the compone… |
CVE-2026-9395 | Low | 3.5 | 2026-05-24 | A vulnerability was identified in Besen BS20 EV Charging Station up to 20260426. Affected is an unknown function of the component BLE/UDP. The manipulation lea… |
CVE-2026-9394 | Low | 3.1 | 2026-05-24 | A vulnerability was determined in Besen BS20 EV Charging Station up to 20260426. This impacts an unknown function of the component Bluetooth Low Energy Handler… |
CVE-2026-9377 | Low | 2.4 | 2026-05-24 | A vulnerability was identified in SourceCodester SUP Online Shopping 1.0. The impacted element is an unknown function of the file /admin/productedit.php. The m… |
CVE-2026-9373 | Low | 3.7 | 2026-05-24 | A vulnerability has been found in JeecgBoot 3.9.1. This issue affects some unknown processing of the file /openapi/call/ of the component OpenAPI Endpoint. Suc… |
CVE-2026-9370 | Low | 3.7 | 2026-05-24 | A weakness has been identified in ulisesbocchio jasypt-spring-boot up to 3.0.5/4.0.4. Affected by this vulnerability is the function getSecretKeySaltGenerator… |
CVE-2026-9357 | Low | 3.5 | 2026-05-24 | A vulnerability was found in vBulletin 6.x. This impacts an unknown function of the component Login. Performing a manipulation results in cross site scripting… |
CVE-2026-9306 | Low | 3.7 | 2026-05-23 | A security vulnerability has been detected in QuantumNous new-api up to 0.12.1. This affects the function RelayMidjourneyImage/GetByOnlyMJId of the file router… |
CVE-2026-39824 | Low | 3.3 | 2026-05-22 | NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number… |
CVE-2026-39967 | Low | 3.1 | 2026-05-22 | TypeBot is a chatbot builder tool. In versions 3.15.2 and prior, the bot engine's the findResult query does not filter results by typebotId, allowing an authen… |
CVE-2026-9249 | Low | 3.1 | 2026-05-22 | Unverified password change in Devolutions Server allows an attacker to change a user's password without providing the previous one via a crafted password chang… |
CVE-2026-9248 | Low | 2.6 | 2026-05-22 | Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write access to any vault to copy documentation a… |
CVE-2026-9247 | Low | 2.4 | 2026-05-22 | Insufficient logging in the entry export feature in Devolutions Server allows an authenticated user with export permissions to export a sealed entry without tr… |
CVE-2026-8477 | Low | 2.7 | 2026-05-22 | Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server allows an authenticated user with access… |
CVE-2025-46371 | Low | 3.6 | 2026-05-22 | Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) a Use of a Broken or Risky Cryptographic Algorithm vulnerability in the ssh. A low privileged attacker w… |
CVE-2026-7837 | Low | 3.7 | 2026-05-21 | A time-of-check time-of-use (TOCTOU) condition in the ad_flush function in Netatalk 3.0.0 through 4.4.2 involves root-privileged file operations, which may all… |
CVE-2026-44075 | Low | 3.7 | 2026-05-21 | A missing break statement in DSI OpenSession processing in Netatalk 1.5.0 through 4.4.2 causes a DSIOPT_ATTNQUANT switch case to fall through into DSIOPT_SERVQ… |
CVE-2026-44074 | Low | 3.7 | 2026-05-21 | Netatalk 2.1.0 through 4.4.2 combines multiple errno values using bitwise OR, resulting in incorrect error codes when multiple error conditions occur simultane… |
CVE-2026-44071 | Low | 3.7 | 2026-05-21 | Netatalk 3.1.2 through 4.4.2 is compiled without FORTIFY_SOURCE, which disables built-in buffer overflow detection at runtime, potentially allowing a remote at… |
CVE-2026-44057 | Low | 3.1 | 2026-05-21 | A dead bounds check in the Spotlight RPC unmarshaller in Netatalk 3.0.0 through 4.4.2 results in an unreachable code path that provides no effective bounds pro… |
CVE-2026-7836 | Low | 3.1 | 2026-05-21 | An incorrect calculation in the hextoint macro in Netatalk 2.0.0 through 4.4.2 due to improper uppercase character handling allows a remote authenticated attac… |
CVE-2026-7835 | Low | 3.1 | 2026-05-21 | A format string argument mismatch in Netatalk 3.0.3 through 4.4.2 allows a remote authenticated attacker to cause a minor denial of service via crafted input t… |
CVE-2026-44072 | Low | 3.0 | 2026-05-21 | Netatalk 2.2.1 through 4.4.2 calls system() after a failed chdir() without properly handling the error condition, which allows a local privileged user to execu… |
CVE-2026-44070 | Low | 3.1 | 2026-05-21 | An unbounded memory reallocation in the charset conversion code in Netatalk 2.0.0 through 4.4.2 allows a remote authenticated attacker to cause a minor denial… |
CVE-2026-44069 | Low | 3.9 | 2026-05-21 | An integer underflow in the volxlate function in Netatalk 3.0.0 through 4.4.2 allows a local privileged user to obtain limited information, modify limited data… |
CVE-2026-47782 | Low | 3.3 | 2026-05-20 | Android App "RoboForm Password Manager" provided by Siber Systems, Inc. handles Android intents without sufficient URL validation, user confirmation nor notifi… |
CVE-2025-31985 | Low | 3.7 | 2026-05-20 | HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header. This could allow b… |
CVE-2026-25602 | Low | 2.3 | 2026-05-20 | Insufficient Verification of Data Authenticity in the feedback function of Mesalvo MEONA (MEONA Client and MEONA Server). The MEONA Client transmits the recipi… |
CVE-2026-45232 | Low | 3.1 | 2026-05-20 | Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows… |