Low-severity CVEs (page 18)
Page 18 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-23738 | Low | 3.5 | 2026-02-06 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, user supplied/con… |
CVE-2026-1998 | Low | 3.3 | 2026-02-06 | A flaw has been found in micropython up to 1.27.0. This vulnerability affects the function mp_import_all of the file py/runtime.c. This manipulation causes mem… |
CVE-2026-1991 | Low | 3.3 | 2026-02-06 | A vulnerability was detected in libuvc up to 0.0.7. Affected is the function uvc_scan_streaming of the file src/device.c of the component UVC Descriptor Handle… |
CVE-2026-1990 | Low | 3.3 | 2026-02-06 | A security vulnerability has been detected in oatpp up to 1.3.1. This impacts the function oatpp::data::type::ObjectWrapper::ObjectWrapper of the file src/oatp… |
CVE-2026-1971 | Low | 2.4 | 2026-02-06 | A vulnerability has been found in Edimax BR-6288ACL up to 1.12. Impacted is the function wiz_WISP24gmanual of the file wiz_WISP24gmanual.asp. Such manipulation… |
CVE-2025-68458 | Low | 3.7 | 2026-02-05 | Webpack is a module bundler. From version 5.49.0 to before 5.104.1, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) can be by… |
CVE-2025-68157 | Low | 3.7 | 2026-02-05 | Webpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces… |
CVE-2026-25815 | Low | 3.2 | 2026-02-05 | Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials stored in device configuration files, as exploited in the wild from 2025-12-16 thro… |
CVE-2026-1970 | Low | 3.5 | 2026-02-05 | A flaw has been found in Edimax BR-6258n up to 1.18. This issue affects the function formStaDrvSetup of the file /goform/formStaDrvSetup. This manipulation of… |
CVE-2025-15323 | Low | 3.7 | 2026-02-05 | Tanium addressed an improper certificate validation vulnerability in Tanium Appliance. |
CVE-2025-15321 | Low | 2.7 | 2026-02-05 | Tanium addressed an improper input validation vulnerability in Tanium Appliance. |
CVE-2025-15289 | Low | 3.1 | 2026-02-05 | Tanium addressed an improper access controls vulnerability in Interact. |
CVE-2020-37148 | Low | 3.5 | 2026-02-05 | P5 FNIP-8x16A/FNIP-4xSH versions 1.0.20 and 1.0.11 suffer from a stored cross-site scripting vulnerability. Input passed to several GET/POST parameters is not… |
CVE-2020-37118 | Low | 3.5 | 2026-02-05 | P5 FNIP-8x16A FNIP-4xSH 1.0.20 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user interac… |
CVE-2025-22873 | Low | 3.8 | 2026-02-04 | It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the par… |
CVE-2026-25517 | Low | 2.7 | 2026-02-04 | Wagtail is an open source content management system built on Django. Prior to versions 6.3.6, 7.0.4, 7.1.3, 7.2.2, and 7.3, due to a missing permission check o… |
CVE-2025-2134 | Low | 3.5 | 2026-02-04 | IBM Jazz Reporting Service could allow an authenticated user on the network to affect the system's performance using complicated queries due to insufficient re… |
CVE-2025-27550 | Low | 3.5 | 2026-02-04 | IBM Jazz Reporting Service could allow an authenticated user on the host network to obtain sensitive information about other projects that reside on the server. |
CVE-2025-1823 | Low | 3.5 | 2026-02-04 | IBM Jazz Reporting Service could allow an authenticated user on the host network to cause a denial of service using specially crafted SQL query that consumes e… |
CVE-2026-20732 | Low | 3.1 | 2026-02-04 | A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages. Note: Software versions which h… |
CVE-2026-20730 | Low | 3.3 | 2026-02-04 | A vulnerability exists in BIG-IP Edge Client and browser VPN clients on Windows that may allow attackers to gain access to sensitive information. Note: Softwa… |
CVE-2026-1791 | Low | 2.7 | 2026-02-04 | Unrestricted Upload of File with Dangerous Type vulnerability in Hillstone Networks Operation and Maintenance Security Gateway on Linux allows Upload a Web She… |
CVE-2026-24513 | Low | 3.1 | 2026-02-03 | A security issue was discovered in ingress-nginx where the protection afforded by the `auth-url` Ingress annotation may not be effective in the presence of a s… |
CVE-2025-33081 | Low | 3.3 | 2026-02-03 | IBM Concert 1.0.0 through 2.1.0 stores potentially sensitive information in log files that could be read by a local user. |
CVE-2026-25224 | Low | 3.7 | 2026-02-03 | Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.3, a denial-of-service vulnerability in Fastify’s Web Streams response hand… |
CVE-2025-52633 | Low | 3.1 | 2026-02-03 | HCL AION is affected by a Permanent Cookie Containing Sensitive Session Information vulnerability. It is storing sensitive session data in persistent cookies m… |
CVE-2025-52631 | Low | 3.7 | 2026-02-03 | HCL AION is affected by a Missing or Insecure HTTP Strict-Transport-Security (HSTS) Header vulnerability. This can allow insecure connections, potentially expo… |
CVE-2025-52623 | Low | 3.7 | 2026-02-03 | HCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerability. This can allow autocomplete on password fields may lead… |
CVE-2025-52629 | Low | 3.7 | 2026-02-03 | HCL AION is susceptible to Missing Content-Security-Policy. An The absence of a CSP header may increase the risk of cross-site scripting and other content in… |
CVE-2025-67852 | Low | 3.5 | 2026-02-03 | A flaw was found in Moodle. An open redirect vulnerability in the OAuth login flow allows a remote attacker to redirect users to attacker-controlled pages afte… |
CVE-2025-58381 | Low | 2.3 | 2026-02-03 | A vulnerability in Brocade Fabric OS before 9.2.1c2 could allow an authenticated attacker with admin privileges using the shell commands “source, ping6, sle… |
CVE-2025-58380 | Low | 2.3 | 2026-02-03 | A vulnerability in Brocade Fabric OS before 9.2.1 could allow an authenticated attacker with admin privileges using the shell command “grep” to modify the path… |
CVE-2026-24934 | Low | 3.7 | 2026-02-03 | The DDNS function uses an insecure HTTP connection or fails to validate the SSL/TLS certificate when querying an external server for the device's WAN IP addres… |
CVE-2025-61634 | Low | 3.1 | 2026-02-03 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Rest/Handler/PageHTMLHandler.Php. This issue aff… |
CVE-2025-36194 | Low | 2.8 | 2026-02-02 | IBM PowerVM Hypervisor FW1110.00 through FW1110.03, FW1060.00 through FW1060.51, and FW950.00 through FW950.F0 may expose a limited amount of data to a peer pa… |
CVE-2026-1751 | Low | 3.1 | 2026-02-02 | A vulnerability has been discovered in GitLab CE/EE affecting all versions starting with 16.8 before 18.5.0 that could have allowed unauthorized edits to merge… |
CVE-2025-13881 | Low | 2.7 | 2026-02-02 | A flaw was found in Keycloak Admin API. This vulnerability allows an administrator with limited privileges to retrieve sensitive custom attributes via the /unm… |
CVE-2026-1744 | Low | 2.4 | 2026-02-02 | A vulnerability was found in D-Link DSL-6641K N8.TR069.20131126. Affected by this issue is the function doSubmitPPP of the file sp_pppoe_user.js. The manipulat… |
CVE-2026-1743 | Low | 3.1 | 2026-02-02 | A vulnerability has been found in DJI Mavic Mini, Air, Spark and Mini SE up to 01.00.0500. Affected by this vulnerability is an unknown functionality of the co… |
CVE-2026-1705 | Low | 2.4 | 2026-01-30 | A vulnerability was detected in D-Link DSL-6641K N8.TR069.20131126. Affected by this issue is the function ad_virtual_server_vdsl of the component Web Interfac… |
CVE-2026-1700 | Low | 3.5 | 2026-01-30 | A weakness has been identified in projectworlds House Rental and Property Listing 1.0. This vulnerability affects unknown code of the file /app/sms.php. This m… |
CVE-2026-1685 | Low | 3.7 | 2026-01-30 | A vulnerability was identified in D-Link DIR-823X 250416. This vulnerability affects the function sub_40AC74 of the component Login. Such manipulation leads to… |
CVE-2026-25211 | Low | 3.2 | 2026-01-30 | Llama Stack (aka llama-stack) before 0.4.0rc3 does not censor the pgvector password in the initialization log. |
CVE-2026-25046 | Low | 2.9 | 2026-01-29 | Kimi Agent SDK is a set of libraries that expose the Kimi Code (Kimi CLI) agent runtime in applications. The vsix-publish.js and ovsx-publish.js scripts pass f… |
CVE-2025-15288 | Low | 3.1 | 2026-01-29 | Tanium addressed an improper access controls vulnerability in Interact. |
CVE-2026-1598 | Low | 3.5 | 2026-01-29 | A vulnerability was found in Bdtask Bhojon All-In-One Restaurant Management System up to 20260116. Impacted is an unknown function of the file /dashboard/home/… |
CVE-2026-1588 | Low | 2.7 | 2026-01-29 | A vulnerability was found in jishenghua jshERP up to 3.6. The impacted element is the function install of the file /jshERP-boot/plugin/installByPath of the com… |
CVE-2025-53869 | Low | 3.7 | 2026-01-29 | Multiple MFPs provided by Brother Industries, Ltd. does not properly validate server certificates, which may allow a man-in-the-middle attacker to replace the… |
CVE-2026-1532 | Low | 2.4 | 2026-01-28 | A vulnerability was identified in D-Link DCS-700L 1.03.09. The affected element is the function uploadmusic of the file /setUploadMusic of the component Music… |
CVE-2026-23553 | Low | 2.9 | 2026-01-28 | In the context switch logic Xen attempts to skip an IBPB in the case of a vCPU returning to a CPU on which it was the previous vCPU to run. While safe for Xen'… |
CVE-2026-1520 | Low | 2.4 | 2026-01-28 | A vulnerability was identified in rethinkdb up to 2.4.3. Affected by this issue is some unknown functionality of the component Secondary Index Handler. Such ma… |
CVE-2026-24883 | Low | 3.7 | 2026-01-27 | In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set to a NULL value, leading to a denial of se… |
CVE-2026-22261 | Low | 3.7 | 2026-01-27 | Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, various inefficiencies in xff handling, especially for alerts not triggered… |
CVE-2026-24870 | Low | 3.7 | 2026-01-27 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ixray-team ixray-1.6-stcop.This issue affects ixray-1.6-stcop: before 1.3. |
CVE-2026-1485 | Low | 2.8 | 2026-01-27 | A flaw was found in Glib's content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is stored in a signed int… |
CVE-2026-1444 | Low | 2.4 | 2026-01-26 | A vulnerability has been found in iJason-Liu Books_Manager up to 298ba736387ca37810466349af13a0fdf828e99c. This affects an unknown part of the file controllers… |
CVE-2026-1190 | Low | 3.1 | 2026-01-26 | A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language (SAML) setup, it f… |
CVE-2025-9615 | Low | 3.3 | 2026-01-26 | A flaw was found in NetworkManager. The NetworkManager package allows access to files that may belong to other users. NetworkManager allows non-root users to c… |
CVE-2026-0925 | Low | 2.7 | 2026-01-26 | Tanium addressed an improper input validation vulnerability in Discover. |
CVE-2025-57784 | Low | 3.3 | 2026-01-26 | Tomahawk auth timing attack due to usage of `strcmp` has been identified in Hiawatha webserver version 11.7 which allows a local attacker to access the managem… |
CVE-2026-24656 | Low | 3.7 | 2026-01-26 | Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter. The Decanter log socket collector exposes the port 4560, without authentication. If… |
CVE-2026-1421 | Low | 3.5 | 2026-01-26 | A vulnerability has been found in code-projects Online Examination System 1.0. Affected is an unknown function of the component Add Pages. Such manipulation le… |
CVE-2026-1417 | Low | 3.3 | 2026-01-26 | A weakness has been identified in GPAC up to 2.4.0. Affected by this issue is the function dump_isom_rtp of the file applications/mp4box/filedump.c. This manip… |
CVE-2026-1416 | Low | 3.3 | 2026-01-26 | A security flaw has been discovered in GPAC up to 2.4.0. Affected by this vulnerability is the function DumpMovieInfo of the file applications/mp4box/filedump… |
CVE-2026-1415 | Low | 3.3 | 2026-01-26 | A vulnerability was identified in GPAC up to 2.4.0. Affected is the function gf_media_export_webvtt_metadata of the file src/media_tools/media_export.c. The ma… |
CVE-2026-1409 | Low | 2.0 | 2026-01-26 | A security vulnerability has been detected in Beetel 777VR1 up to 01.00.09/01.00.09_55. This issue affects some unknown processing of the component UART Interf… |
CVE-2026-1408 | Low | 2.0 | 2026-01-25 | A weakness has been identified in Beetel 777VR1 up to 01.00.09/01.00.09_55. This vulnerability affects unknown code of the component UART Interface. Executing… |
CVE-2026-1407 | Low | 2.0 | 2026-01-25 | A security flaw has been discovered in Beetel 777VR1 up to 01.00.09/01.00.09_55. This affects an unknown part of the component UART Interface. Performing a man… |
CVE-2026-1406 | Low | 3.5 | 2026-01-25 | A vulnerability was determined in lcg0124 BootDo up to 5ccd963c74058036b466e038cff37de4056c1600. Affected by this vulnerability is the function redirectToLogin… |
CVE-2026-0633 | Low | 3.7 | 2026-01-24 | The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions… |
CVE-2026-24140 | Low | 2.7 | 2026-01-24 | MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below have a Mass Assignment vulnerability in the settings manage… |
CVE-2026-22978 | Low | 3.3 | 2026-01-23 | In the Linux kernel, the following vulnerability has been resolved: wifi: avoid kernel-infoleak from struct iw_point struct iw_point has a 32bit hole on 64bi… |
CVE-2025-71148 | Low | 3.3 | 2026-01-23 | In the Linux kernel, the following vulnerability has been resolved: net/handshake: restore destructor on submit failure handshake_req_submit() replaces sk->s… |
CVE-2026-24515 | Low | 2.9 | 2026-01-23 | In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data. |
CVE-2026-0798 | Low | 3.5 | 2026-01-22 | Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private… |
CVE-2026-22281 | Low | 3.5 | 2026-01-22 | Dell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.10.1.3, versions starting from 9.11.0.0… |
CVE-2026-22411 | Low | 3.8 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Dolcino dolcino allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2026-22409 | Low | 3.8 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Justicia justicia allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2026-22407 | Low | 3.8 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Roam roam allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2026-22406 | Low | 3.8 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Overton overton allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2026-22404 | Low | 3.8 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Innovio innovio allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2025-47555 | Low | 3.8 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2026-24048 | Low | 3.5 | 2026-01-21 | Backstage is an open framework for building developer portals, and @backstage/backend-defaults provides the default implementations and setup for a standard Ba… |
CVE-2026-23996 | Low | 3.7 | 2026-01-21 | FastAPI Api Key provides a backend-agnostic library that provides an API key system. Version 1.1.0 has a timing side-channel vulnerability in verify_key(). The… |
CVE-2025-14083 | Low | 2.7 | 2026-01-21 | A flaw was found in the Keycloak Admin REST API. This vulnerability allows the exposure of backend schema and rules, potentially leading to targeted attacks or… |
CVE-2026-0988 | Low | 3.7 | 2026-01-21 | A flaw was found in glib. Missing validation of offset and count parameters in the g_buffered_input_stream_peek() function can lead to an integer overflow duri… |
CVE-2026-1035 | Low | 3.1 | 2026-01-21 | A flaw was found in the Keycloak server during refresh token processing, specifically in the TokenManager class responsible for enforcing refresh token reuse p… |
CVE-2026-21977 | Low | 3.1 | 2026-01-20 | Vulnerability in the Oracle Zero Data Loss Recovery Appliance Software product of Oracle Zero Data Loss Recovery Appliance (component: Security). Supported ve… |
CVE-2026-21965 | Low | 2.7 | 2026-01-20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are affected are 9.0.0-9.5.0. Easily ex… |
CVE-2026-21947 | Low | 3.1 | 2026-01-20 | Vulnerability in Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u471-b50. Difficult to exploit vulnerability al… |
CVE-2026-21930 | Low | 2.3 | 2026-01-20 | Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Filesystems). The supported version that is affected is 8.8. Easi… |
CVE-2026-21640 | Low | 2.7 | 2026-01-20 | HackerOne community member Faraz Ahmed (PakCyberbot) has reported a format string injection in the Revive Adserver settings. When specific character combinatio… |
CVE-2025-36411 | Low | 3.5 | 2026-01-20 | IBM ApplinX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a use… |
CVE-2025-36410 | Low | 3.1 | 2026-01-20 | IBM ApplinX 11.1 could allow an authenticated user to perform unauthorized administrative actions on the server due to server-side enforcement of client-side s… |
CVE-2026-1197 | Low | 3.1 | 2026-01-20 | A vulnerability was detected in MineAdmin 1.x/2.x. Affected by this vulnerability is an unknown functionality of the file /system/downloadById. Performing a ma… |
CVE-2026-1196 | Low | 3.1 | 2026-01-20 | A security vulnerability has been detected in MineAdmin 1.x/2.x. Affected is an unknown function of the file /system/getFileInfoById. Such manipulation of the… |
CVE-2025-55252 | Low | 3.1 | 2026-01-19 | HCL AION version 2 is affected by a Weak Password Policy vulnerability. This can allow the use of easily guessable passwords, potentially resulting in unauth… |
CVE-2025-55250 | Low | 1.8 | 2026-01-19 | HCL AION version 2 is affected by a Technical Error Disclosure vulnerability. This can expose sensitive technical details, potentially resulting in information… |
CVE-2025-55251 | Low | 3.1 | 2026-01-19 | HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution… |
CVE-2025-55249 | Low | 3.5 | 2026-01-19 | HCL AION is affected by a Missing Security Response Headers vulnerability. The absence of standard security headers may weaken the application’s overall securi… |