Low-severity CVEs (page 18)
Page 18 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-8492 | Low | 2.7 | 2026-05-19 | Modification of Assumed-Immutable Data (MAID) vulnerability in Drupal Translate Drupal with GTranslate allows Resource Location Spoofing. This issue affects T… |
CVE-2026-8491 | Low | 3.7 | 2026-05-19 | Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Node View Permissions allows Forceful Browsing. This issue affects Node View Perm… |
CVE-2026-5511 | Low | 2.7 | 2026-05-19 | In the web management interface of Archer AX72 (SG) v1, the network diagnostic feature improperly handles invalid user input, resulting in limited exposure of… |
CVE-2026-33565 | Low | 3.3 | 2026-05-19 | in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS. |
CVE-2026-28751 | Low | 3.3 | 2026-05-19 | in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS. |
CVE-2026-27781 | Low | 3.3 | 2026-05-19 | in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS. |
CVE-2026-25110 | Low | 3.3 | 2026-05-19 | in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS. |
CVE-2026-27964 | Low | 3.9 | 2026-05-18 | FacturaScripts is an open source accounting and invoicing software. Versions 2025.7 and prior contain a Reflected Cross-Site Scripting (XSS) vulnerability thro… |
CVE-2026-47091 | Low | 3.3 | 2026-05-18 | Claude HUD through 0.0.12, patched in commit 234d9aa, contains a path traversal vulnerability that allows attackers to read arbitrary files by supplying an unv… |
CVE-2026-8803 | Low | 3.7 | 2026-05-18 | A flaw has been found in opensourcepos Open Source Point of Sale up to 3.4.2. Impacted is the function Login of the file app/Models/Employee.php of the compone… |
CVE-2026-6333 | Low | 3.5 | 2026-05-18 | Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate the Host header when constructing response URLs for custom slash commands which allo… |
CVE-2026-4643 | Low | 3.5 | 2026-05-18 | Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to prevent server-rendered content from closing an underlying application view in the Mattermost Desk… |
CVE-2026-4286 | Low | 3.1 | 2026-05-18 | Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to check if {{team_id}} was being changed when updating playbooks, allowing users with only {{Ma… |
CVE-2026-6334 | Low | 3.1 | 2026-05-18 | Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce client identity binding during the OAuth authorization code redemption flow which all… |
CVE-2026-4273 | Low | 3.7 | 2026-05-18 | Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate that the RefreshedToken differs from the original invite token during remote cluster… |
CVE-2026-3495 | Low | 3.8 | 2026-05-18 | Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to escape some variables that could contain malicious content during error page composition whic… |
CVE-2026-8770 | Low | 3.3 | 2026-05-18 | A vulnerability was identified in continuedev continue up to 1.2.22. This affects the function lsTool of the file core/tools/implementations/lsTool.ts of the c… |
CVE-2026-8741 | Low | 3.1 | 2026-05-17 | A vulnerability has been found in EMQX up to 6.2.0. This affects an unknown function of the file apps/emqx/src/emqx_persistent_session_ds.erl of the component… |
CVE-2026-45316 | Low | 3.5 | 2026-05-15 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, the POST /api/v1/notes/{id}/pin endpoint per… |
CVE-2026-4053 | Low | 3.1 | 2026-05-15 | Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce the PostEditTimeLimit on non-message post fields which allows an authenticated user t… |
CVE-2026-45803 | Low | 3.5 | 2026-05-15 | `gh` is GitHub’s official command line tool. From 1.6.0 to before 2.92.0, a security vulnerability has been identified in GitHub CLI that could allow terminal… |
CVE-2026-46483 | Low | 3.6 | 2026-05-15 | Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tar#Vimuntar() in runtime/autoload/tar.vim when… |
CVE-2026-41963 | Low | 2.8 | 2026-05-15 | Stack overflow vulnerability in the media platform. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-41962 | Low | 3.6 | 2026-05-15 | Permission control vulnerability in the app management and control module. Impact: Successful exploitation of this vulnerability may affect service confidentia… |
CVE-2026-45781 | Low | 3.5 | 2026-05-14 | The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.9, OCI ownership validation skips label-match… |
CVE-2026-8579 | Low | 3.1 | 2026-05-14 | Insufficient validation of untrusted input in Skia in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-8578 | Low | 3.1 | 2026-05-14 | Out of bounds read in GPU in Google Chrome on Linux prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to leak cross-or… |
CVE-2026-8572 | Low | 3.1 | 2026-05-14 | Insufficient policy enforcement in Network in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer proce… |
CVE-2026-8556 | Low | 3.1 | 2026-05-14 | Inappropriate implementation in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-8554 | Low | 3.1 | 2026-05-14 | Type Confusion in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an ou… |
CVE-2026-8553 | Low | 3.1 | 2026-05-14 | Use after free in GPU in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds m… |
CVE-2026-8545 | Low | 3.1 | 2026-05-14 | Object corruption in Compositing in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to leak cross-orig… |
CVE-2026-8536 | Low | 3.1 | 2026-05-14 | Insufficient validation of untrusted input in ReadingMode in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who had compromised the ren… |
CVE-2026-44638 | Low | 2.5 | 2026-05-14 | libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, a wrong NULL check after an allocation call in sixel_decode_r… |
CVE-2026-44589 | Low | 3.7 | 2026-05-14 | Nuxt OG Image generates OG Images with Vue templates in Nuxt. The isBlockedUrl() denylist introduced in nuxt-og-image@6.2.5 to remediate GHSA-pqhr-mp3f-hrpp (D… |
CVE-2026-27680 | Low | 3.1 | 2026-05-14 | Due to improper input handling under certain conditions, SAP NetWeaver Application Server ABAP allows an attacker to inject custom Cascading Style Sheets (CSS)… |
CVE-2026-6923 | Low | 3.8 | 2026-05-14 | A side-channel attack, which requires a physical presence to the TPM, can lead to extraction of an Elliptic Curve Diffie-Hellman (ECDH) key. |
CVE-2026-44348 | Low | 2.5 | 2026-05-14 | PoDoFo is a C++17 PDF manipulation library. From 1.0.0 to before 1.0.4, a double-free vulnerability exists in compute_hash_to_sign() in src/podofo/private/Open… |
CVE-2025-62317 | Low | 2.6 | 2026-05-14 | HCL AION is affected by a vulnerability where sensitive information may be included in URL parameters. Passing sensitive data in URLs may expose it through bro… |
CVE-2025-62316 | Low | 2.3 | 2026-05-14 | HCL AION is affected by a vulnerability where certain security-related HTTP response headers are not properly configured. Absence of these headers may reduce t… |
CVE-2025-62312 | Low | 3.0 | 2026-05-14 | HCL AION is affected by a vulnerability where basic authorization tokens are used for authentication. Use of basic authorization mechanisms may expose credenti… |
CVE-2025-62309 | Low | 2.6 | 2026-05-14 | HCL AION is affected by a vulnerability where auto-complete functionality is enabled for certain input fields. This may allow sensitive information to be store… |
CVE-2026-6638 | Low | 3.7 | 2026-05-14 | SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the… |
CVE-2026-7471 | Low | 3.5 | 2026-05-14 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allo… |
CVE-2026-6883 | Low | 2.6 | 2026-05-14 | GitLab has remediated an issue in GitLab EE affecting all versions from 15.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allo… |
CVE-2026-2900 | Low | 2.7 | 2026-05-14 | GitLab has remediated an issue in GitLab EE affecting all versions from 16.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that when instance-… |
CVE-2026-33585 | Low | 3.8 | 2026-05-13 | Improper management of the idle timeout parameter in the Keycloak interface of the Arqit SKA-Platform enables an attacker to impersonate an authenticated tenan… |
CVE-2026-30904 | Low | 1.8 | 2026-05-13 | Protection Mechanism Failure in Zoom Workplace for iOS before version 7.0.0 may allow an authenticated user to conduct a disclosure of information via physical… |
CVE-2026-0238 | Low | 3.2 | 2026-05-13 | A vulnerability in Palo Alto Networks Broker VM allows an authenticated administrator to inject arbitrary content into certain Broker VM fields. |
CVE-2026-44582 | Low | 3.7 | 2026-05-13 | Next.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulner… |
CVE-2026-44572 | Low | 3.7 | 2026-05-13 | Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an external client could send a x-nextjs-data… |
CVE-2026-44459 | Low | 3.8 | 2026-05-13 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, improper validation of the JWT NumericDate claims exp… |
CVE-2026-8200 | Low | 2.7 | 2026-05-13 | When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generated may not… |
CVE-2026-44242 | Low | 3.7 | 2026-05-12 | Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Prior to 4.10.22, the bundleCache… |
CVE-2026-44220 | Low | 3.2 | 2026-05-12 | ciguard is a static security auditor for CI/CD pipelines. From 0.8.0 to 0.8.1 , the discover_pipeline_files() function in src/ciguard/discovery.py walks a dire… |
CVE-2026-44219 | Low | 3.7 | 2026-05-12 | ciguard is a static security auditor for CI/CD pipelines. From 0.6.0 to 0.8.1, both SCA HTTP clients (src/ciguard/analyzer/sca/osv.py and src/ciguard/analyzer/… |
CVE-2026-44218 | Low | 3.0 | 2026-05-12 | ciguard is a static security auditor for CI/CD pipelines. From 0.1.0 to 0.8.1, the published ghcr.io/jo-jo98/ciguard container image inherits the default root… |
CVE-2026-42445 | Low | 3.3 | 2026-05-12 | NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the UFS/UFS2 filesystem image p… |
CVE-2026-42444 | Low | 3.3 | 2026-05-12 | NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a denial-of-service vulnerability exists in the littlefs filesystem image parser… |
CVE-2026-42443 | Low | 3.3 | 2026-05-12 | NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an integer divide-by-zero exists in the UFS/UFS2 filesystem image parser in NanaZ… |
CVE-2026-42442 | Low | 3.3 | 2026-05-12 | NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a null-pointer dereference exists in the UFS/UFS2 filesystem image parser in Nana… |
CVE-2026-42355 | Low | 3.3 | 2026-05-12 | NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the Electron Archive (ASAR) par… |
CVE-2026-34685 | Low | 3.4 | 2026-05-12 | Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Improper Input Validation vulnerability… |
CVE-2026-44278 | Low | 2.3 | 2026-05-12 | A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.2, FortiClientWindows 7.2 all versions may allow attacker… |
CVE-2026-20793 | Low | 3.3 | 2026-05-12 | Unchecked return value for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applications may allow a denial of service. U… |
CVE-2026-43514 | Low | 3.7 | 2026-05-12 | Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from… |
CVE-2026-40020 | Low | 3.1 | 2026-05-12 | Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no. This causes folders to be… |
CVE-2026-32684 | Low | 2.9 | 2026-05-12 | The application does not impose strict enough restrictions on directory access permissions, posing a risk that other malicious applications could obtain sensit… |
CVE-2026-41530 | Low | 3.3 | 2026-05-12 | The automatic folder creation feature of Lhaz and Lhaz+ provided by Chitora soft contains a path traversal vulnerability. When the affected product is configur… |
CVE-2026-40131 | Low | 3.4 | 2026-05-12 | SQL injection vulnerability exists in @sap/hdi-deploy package, where SQL queries are dynamically constructed using user input without proper parameterization o… |
CVE-2026-45362 | Low | 3.2 | 2026-05-12 | Sangoma Switchvox before 8.4 places cleartext SIP authentication credentials in a backup file. |
CVE-2026-42188 | Low | 2.4 | 2026-05-11 | Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Prior to 2.9.3, a server-side request forgery (SSRF) vulnerability exists in… |
CVE-2026-28957 | Low | 3.3 | 2026-05-11 | An issue with app access to camera metadata was addressed with improved logic. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, v… |
CVE-2026-28910 | Low | 3.3 | 2026-05-11 | This issue was addressed with improved permissions checking. This issue is fixed in macOS Tahoe 26.4. A malicious app may be able to access arbitrary files. |
CVE-2026-42874 | Low | 3.7 | 2026-05-11 | Microdot is a minimalistic Python web framework. Prior to 2.6.1, the Response.set_cookie() method does not sanitize its string arguments, and in particular wil… |
CVE-2026-43969 | Low | 3.2 | 2026-05-11 | Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows HTTP request splitting and cookie smuggling via unvalidat… |
CVE-2026-44996 | Low | 3.7 | 2026-05-11 | OpenClaw before 2026.4.15 contains an arbitrary local file read vulnerability in the webchat audio embedding helper that fails to apply local media root contai… |
CVE-2026-44658 | Low | 2.4 | 2026-05-11 | Zen is a firefox-based browser. Prior to 1.19.12b, RSS feed URLs entered by the user are validated to http: or https: in promptForFeedUrl, but item links insid… |
CVE-2026-3048 | Low | 3.8 | 2026-05-11 | An authenticated administrator who configures or tests LDAP connectivity in Sonatype Nexus Repository Manager versions 3.0.0 through 3.91.1 may be able to init… |
CVE-2026-34094 | Low | 3.8 | 2026-05-11 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Page/Article.Php. This issue affects MediaWi… |
CVE-2026-8276 | Low | 3.7 | 2026-05-11 | A flaw has been found in bettercap up to 2.41.5. Affected by this issue is some unknown functionality of the file modules/mysql_server/mysql_server.go of the c… |
CVE-2026-8275 | Low | 3.7 | 2026-05-11 | A vulnerability was detected in bettercap up to 2.41.5. Affected by this vulnerability is the function ippReadChunkedBody of the file modules/zerogod/zerogod_i… |
CVE-2026-8262 | Low | 2.4 | 2026-05-11 | A vulnerability was identified in Devs Palace ERP Online up to 4.0.0. This impacts an unknown function of the file /accounts/chart-save. Such manipulation lead… |
CVE-2026-8257 | Low | 3.3 | 2026-05-11 | A vulnerability was detected in WebAssembly Binaryen up to 117. This issue affects the function IRBuilder::makeBrOn of the file src/wasm/wasm-ir-builder.cpp of… |
CVE-2026-8256 | Low | 2.4 | 2026-05-11 | A security vulnerability has been detected in Devs Palace ERP Online up to 4.0.0. This vulnerability affects unknown code of the file /accounts/mr-save. Such m… |
CVE-2026-8255 | Low | 2.4 | 2026-05-11 | A weakness has been identified in Devs Palace ERP Online up to 4.0.0. This affects an unknown part of the file /inventory/add_new_customer. This manipulation c… |
CVE-2026-8254 | Low | 2.4 | 2026-05-11 | A security flaw has been discovered in Devs Palace ERP Online up to 4.0.0. Affected by this issue is some unknown functionality of the file /inventory/sales_sa… |
CVE-2026-8253 | Low | 2.4 | 2026-05-11 | A vulnerability was identified in Devs Palace ERP Online up to 4.0.0. Affected by this vulnerability is an unknown functionality of the file /inventory/purchas… |
CVE-2026-8242 | Low | 3.7 | 2026-05-10 | A vulnerability was found in Industrial Application Software IAS Canias ERP 8.03. The impacted element is the function doAction of the component Login RMI Inte… |
CVE-2026-45186 | Low | 2.9 | 2026-05-10 | In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input. |
CVE-2026-8232 | Low | 3.5 | 2026-05-10 | A vulnerability was found in Dotouch XproUPF 2.0.0-release-088aa7c4. This impacts the function vlib_worker_loop in the library /usr/xpro/upf/tools/libs/libvlib… |
CVE-2026-8221 | Low | 2.4 | 2026-05-10 | A flaw has been found in Devs Palace ERP Online up to 4.0.0. This impacts an unknown function of the file /inventory/item-save. This manipulation causes cross… |
CVE-2026-8220 | Low | 2.4 | 2026-05-10 | A vulnerability was detected in Devs Palace ERP Online up to 4.0.0. This affects an unknown function of the file /inventory/customer-save. The manipulation res… |
CVE-2026-8219 | Low | 2.4 | 2026-05-10 | A security vulnerability has been detected in Devs Palace ERP Online up to 4.0.0. The impacted element is an unknown function of the file /inventory/supplier-s… |
CVE-2026-8218 | Low | 2.4 | 2026-05-10 | A weakness has been identified in Devs Palace ERP Online up to 4.0.0. The affected element is an unknown function of the file /inventory/purchase_return_save… |
CVE-2026-45182 | Low | 2.2 | 2026-05-09 | GrapheneOS before 2026050400 allows attackers to discover the real IP address of a VPN user as a consequence of a registerQuicConnectionClosePayload optimizati… |
CVE-2026-8196 | Low | 3.7 | 2026-05-09 | A flaw has been found in JeecgBoot 3.9.1. The impacted element is an unknown function of the file jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/… |
CVE-2026-44987 | Low | 3.8 | 2026-05-08 | SysReptor is a fully customizable pentest reporting platform. Prior to version 2026.29, users with "User Admin" permissions can change the email addresses of u… |
CVE-2026-42195 | Low | 3.4 | 2026-05-08 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that override… |
CVE-2026-32803 | Low | 3.3 | 2026-05-08 | Dell PowerScale OneFS versions 9.5.0.0 through 9.5.1.6, 9.6.0.0 through 9.7.1.13, 9.8.0.0 through 9.10.1.5 and 9.11.0.0 through 9.12.0.1 contains an Insufficie… |