Low-severity CVEs (page 2)
Page 2 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-81881 | Low | 3.3 | 2026-09-22 | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O Swift field-metadata parser was vulnerable beca… |
CVE-2026-77637 | Low | 3.8 | 2026-09-22 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, tool.GET("wopi") and tool.POST("mail") in routers/router.go inherit ScopeAdminR… |
CVE-2026-95272 | Low | 3.7 | 2026-09-22 | A vulnerability was found in dgtlmoon changedetection.io up to 0.60.7. This affects the function static_content of the file changedetectionio/flask_app.py of t… |
CVE-2026-95270 | Low | 3.7 | 2026-09-22 | A flaw has been found in dgtlmoon changedetection.io up to 0.60.7. The affected element is the function check_password of the file changedetectionio/flask_app… |
CVE-2026-94426 | Low | 3.5 | 2026-09-21 | A vulnerability was determined in xuxueli xxl-job up to 3.5.0. The impacted element is an unknown function of the file /jobgroup/insert. This manipulation of t… |
CVE-2026-49449 | Low | 2.5 | 2026-09-21 | Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. From 1.4.0 until 3.7.2, packages/renderer/MdToHtml/ru… |
CVE-2026-85219 | Low | 3.7 | 2026-09-21 | Denial-of-Service in Redis module in Thinkst Canary's OpenCanary 0.9.9 allows an unauthenticated remote attacker cause unconstrained memory usage. |
CVE-2026-91165 | Low | 2.4 | 2026-09-21 | Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.27.6, the response_mode=form_post SSO return path in warpgate-protocol-http/… |
CVE-2026-63416 | Low | 3.7 | 2026-09-21 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/main/java/com/mxgraph/online/ExportProxyServlet.java uses req… |
CVE-2026-84298 | Low | 3.1 | 2026-09-21 | Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.95.3, the V1 DurableTask stream handler stores… |
CVE-2026-77166 | Low | 2.4 | 2026-09-21 | The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes bro… |
CVE-2026-55060 | Low | 3.7 | 2026-09-21 | GoCD is a continuous deliver server. From 13.1.0 until 26.1.0, the /go/api/support/process_list endpoint does not enforce its intended administrator-only autho… |
CVE-2026-85220 | Low | 3.7 | 2026-09-21 | A vulnerability in the Thinkst Canary honeypot Redis service allows an unauthenticated remote attacker to execute a Denial-of-Service attack against the honeyp… |
CVE-2026-94211 | Low | 2.4 | 2026-09-21 | A vulnerability has been found in Hyve5 Leantime up to 3.9.8. Affected by this issue is some unknown functionality of the file /app/Domain/Dashboard/Templates/… |
CVE-2026-94210 | Low | 3.5 | 2026-09-21 | A flaw has been found in Hyve5 Leantime up to 3.9.8. Affected by this vulnerability is the function getAllGrouped of the file app/Domain/Tickets/Services/Ticke… |
CVE-2026-94150 | Low | 2.4 | 2026-09-21 | A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is an unknown function of the file /media/view/ of the compon… |
CVE-2026-86802 | Low | 3.7 | 2026-09-21 | The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetc… |
CVE-2026-94218 | Low | 3.1 | 2026-09-21 | A flaw was found in the authentication session management of Keycloak, an identity and access management solution. The issue occurs when an administrator enfor… |
CVE-2026-94217 | Low | 3.5 | 2026-09-21 | A flaw was found in the User-Managed Access (UMA) implementation of Keycloak. The issue occurs in the authorization token endpoint when processing permission t… |
CVE-2026-94145 | Low | 3.5 | 2026-09-21 | A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. This vulnerability affects unknown code of the file xxl-job-admin/src/main/java/com/xxl/jo… |
CVE-2026-94137 | Low | 3.3 | 2026-09-21 | A vulnerability was identified in Hangzhou Shunwang Technology shzh 10.7.2.693. This affects the function sub_180004AC0 of the file shdrv_x64.sys of the compon… |
CVE-2026-94045 | Low | 3.5 | 2026-09-20 | A security flaw has been discovered in newbee-ltd newbee-mall up to 1.0.0. Impacted is an unknown function of the file controller/common/UploadController.java… |
CVE-2026-94034 | Low | 3.5 | 2026-09-20 | A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing of the file /drug_recommender/Admin/chan… |
CVE-2026-94033 | Low | 3.5 | 2026-09-20 | A vulnerability has been found in SourceCodester Drug Recommendation System 1.0. This vulnerability affects unknown code of the file /drug_recommender/Admin/ad… |
CVE-2026-94030 | Low | 3.1 | 2026-09-20 | A security vulnerability has been detected in SerenityOS up to 3d83e4509fd20d7438e1ae8470ffe668c136229c. Affected by this vulnerability is the function decode_… |
CVE-2026-94016 | Low | 2.4 | 2026-09-20 | A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. This impacts an unknown function of the file /drug_recommender/Admin/add_… |
CVE-2026-93977 | Low | 3.5 | 2026-09-20 | A vulnerability was determined in code-projects Assessment Management 1.0. Affected by this vulnerability is an unknown functionality of the file lecturer/add-… |
CVE-2026-93976 | Low | 2.4 | 2026-09-20 | A vulnerability was found in code-projects Assessment Management 1.0. Affected is an unknown function of the file admin/add-user.php. The manipulation of the a… |
CVE-2026-93975 | Low | 2.4 | 2026-09-20 | A vulnerability has been found in code-projects Assessment Management 1.0. This impacts an unknown function of the file admin/edit-user.php of the component Us… |
CVE-2026-93968 | Low | 3.8 | 2026-09-20 | A vulnerability was determined in aiyiyi121 SxDevOps 1.0/1.1. This affects the function update of the file backend/rbac/serializers.py of the component UserSer… |
CVE-2026-92965 | Low | 3.7 | 2026-09-20 | The TikTok WordPress plugin before 1.4.2 does not check that a request is authorised before acting on a sign-in code supplied in the URL, so any visitor can ma… |
CVE-2026-92423 | Low | 2.7 | 2026-09-20 | The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user's own posts before returni… |
CVE-2026-81654 | Low | 3.1 | 2026-09-20 | The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing set… |
CVE-2026-81652 | Low | 2.7 | 2026-09-20 | The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before re… |
CVE-2026-81651 | Low | 3.1 | 2026-09-20 | The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its… |
CVE-2026-86551 | Low | 3.3 | 2026-09-20 | The Z80Ultra (NX741J) product contains a vulnerability where non-privileged programs can retrieve the Wi-Fi MAC address by querying the read-only field factory… |
CVE-2026-94055 | Low | 3.7 | 2026-09-19 | Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free. |
CVE-2026-93989 | Low | 3.1 | 2026-09-19 | vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). A… |
CVE-2026-93956 | Low | 3.5 | 2026-09-19 | A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by this issue is the function SearchEngine::buildHighlights of the file src/SearchEngine.php… |
CVE-2026-93987 | Low | 3.4 | 2026-09-19 | rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the `rclone serve docker` volume plugin. newVolume() in cmd/serve/docker/volume… |
CVE-2026-93986 | Low | 3.1 | 2026-09-19 | rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object… |
CVE-2026-93982 | Low | 3.3 | 2026-09-19 | OpenPanel through commit bad75bdd writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction… |
CVE-2026-92420 | Low | 3.8 | 2026-09-19 | The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user befor… |
CVE-2026-92403 | Low | 3.7 | 2026-09-19 | The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify that a front-end form submission corresponds to the form that was rendered to t… |
CVE-2025-15698 | Low | 3.5 | 2026-09-19 | The Business Name Generator WordPress plugin through 1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2026-63451 | Low | 3.3 | 2026-09-18 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, a locally supplie… |
CVE-2026-63450 | Low | 3.7 | 2026-09-18 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 8.0.6, the FTP parser in src/app… |
CVE-2026-63449 | Low | 3.7 | 2026-09-18 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SIP parser in… |
CVE-2026-57225 | Low | 3.3 | 2026-09-18 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, src/datasets-cont… |
CVE-2026-93841 | Low | 3.7 | 2026-09-18 | vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs index the penalty prompt-presence bitset w… |
CVE-2026-93840 | Low | 3.7 | 2026-09-18 | vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output logits width in SamplingParams._validate_allowed_token_ids(). A… |
CVE-2026-57226 | Low | 3.7 | 2026-09-18 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, HTTP SWF decom… |
CVE-2026-11545 | Low | 3.7 | 2026-09-18 | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to obtain sensitive information from the administrative console due to missing autho… |
CVE-2026-93650 | Low | 3.7 | 2026-09-18 | A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This vulnerability affects the function get_client_ip of the file saleor/accou… |
CVE-2026-11538 | Low | 3.7 | 2026-09-18 | IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token cookies. |
CVE-2026-81181 | Low | 3.7 | 2026-09-18 | SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, the password authentication flow for protected shared notes does not rotate the… |
CVE-2026-81178 | Low | 3.5 | 2026-09-18 | SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public note share link receives project-wide col… |
CVE-2026-91142 | Low | 3.6 | 2026-09-18 | A flaw was found in Cockpit. An integer overflow vulnerability in the `do_lastlog()` function, specifically in the offset calculation for `lastlog` entries on… |
CVE-2026-85478 | Low | 3.5 | 2026-09-18 | A CM2507 IP camera running firmware version HMT.CM2507 v251211.1507 exposes an interactive bootloader through a physical debug interface without requiring auth… |
CVE-2026-61633 | Low | 2.0 | 2026-09-18 | NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ client function nni_mqtt_msg_decode_unsubscribe() in nng/src/supplemental/mqtt/mqtt_codec.c does not han… |
CVE-2026-44639 | Low | 3.7 | 2026-09-18 | NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's MQTT v5 property decoder in nng/src/supplemental/mqtt/mqtt_codec.c uses property_append() to walk the enti… |
CVE-2026-84449 | Low | 3.7 | 2026-09-18 | libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.19.6, Op_RGB24_32_to_YCbCr::convert_colorspace() stores image-plane strides in an intege… |
CVE-2026-84400 | Low | 3.1 | 2026-09-18 | CareCam CM2507 IP cameras contain an insufficiently protected network maintenance mechanism that can activate a remote debugging service. An attacker on the sa… |
CVE-2026-93676 | Low | 3.2 | 2026-09-18 | xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak app… |
CVE-2026-93505 | Low | 3.5 | 2026-09-18 | A vulnerability was found in SveltyCMS 0.0.6. This vulnerability affects unknown code of the file src/utils/media/media-service.server.ts of the component SVG… |
CVE-2026-16512 | Low | 3.1 | 2026-09-18 | gptp_handle_msg() in subsys/net/l2/ethernet/gptp/gptp.c dereferenced the gPTP header returned by GPTP_HDR() and switched on hdr->message_type without first che… |
CVE-2026-93601 | Low | 2.2 | 2026-09-18 | rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS na… |
CVE-2026-93600 | Low | 2.2 | 2026-09-18 | rustls-webpki (rustls/webpki) versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to U… |
CVE-2026-93590 | Low | 3.7 | 2026-09-18 | ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image p… |
CVE-2026-93589 | Low | 3.7 | 2026-09-18 | ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being enco… |
CVE-2026-93588 | Low | 3.1 | 2026-09-18 | ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder. When the coder reaches a memory (resource) limit at a sp… |
CVE-2026-93587 | Low | 3.3 | 2026-09-18 | ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD (and, per the upstream advisory, CUBE and HALD) coder: when a specific com… |
CVE-2026-93586 | Low | 2.9 | 2026-09-18 | ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated co… |
CVE-2026-28199 | Low | 3.3 | 2026-09-18 | An authenticated user with access to the NetBackup Flex OS management shell could read arbitrary files from the underlying operating system by supplying a sp… |
CVE-2026-21806 | Low | 3.1 | 2026-09-18 | HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneous authenticated se… |
CVE-2026-56597 | Low | 3.1 | 2026-09-18 | HCL BigFix Service Management is affected by a Sensitive Information Leakage vulnerability, which could allow an unauthenticated attacker to extract internal I… |
CVE-2026-56595 | Low | 3.1 | 2026-09-18 | HCL BigFix Service Management is affected by a CORS Misconfiguration vulnerability due to improperly validated origin headers, which could allow an attacker to… |
CVE-2026-40538 | Low | 3.7 | 2026-09-18 | An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-728… |
CVE-2026-13683 | Low | 2.7 | 2026-09-18 | An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in EventScheduler API in Synology DiskStation Manager (DS… |
CVE-2026-13666 | Low | 3.5 | 2026-09-18 | An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2… |
CVE-2026-89008 | Low | 2.7 | 2026-09-18 | The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions… |
CVE-2026-89007 | Low | 2.7 | 2026-09-18 | The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, a… |
CVE-2026-88844 | Low | 2.7 | 2026-09-18 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-stu… |
CVE-2026-84904 | Low | 3.8 | 2026-09-18 | The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gatin… |
CVE-2026-84903 | Low | 2.7 | 2026-09-18 | The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of… |
CVE-2026-81340 | Low | 3.8 | 2026-09-18 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through it… |
CVE-2026-68493 | Low | 3.1 | 2026-09-18 | After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of. |
CVE-2026-93394 | Low | 3.7 | 2026-09-17 | A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a… |
CVE-2026-93384 | Low | 3.7 | 2026-09-17 | Server-side request forgery in Omnibox in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to bypass… |
CVE-2026-93380 | Low | 3.1 | 2026-09-17 | Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process and leveraged social en… |
CVE-2026-93378 | Low | 3.1 | 2026-09-17 | Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process to bypass site isol… |
CVE-2026-45723 | Low | 2.7 | 2026-09-17 | Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/sch… |
CVE-2026-85716 | Low | 3.7 | 2026-09-17 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12… |
CVE-2026-75588 | Low | 2.6 | 2026-09-17 | Mattermost Desktop App versions <=6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which all… |
CVE-2026-61700 | Low | 3.7 | 2026-09-17 | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, ClientMessage.r… |
CVE-2026-12284 | Low | 3.7 | 2026-09-17 | Mattermost Desktop App versions <=6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a malicious or compromised Mattermost serv… |
CVE-2026-54471 | Low | 3.5 | 2026-09-17 | Dell SmartFabric Manager, versions prior to 2.2.1, contains an Improper Handling of Insufficient Permissions or Privileges vulnerability. A low privileged atta… |
CVE-2026-81439 | Low | 3.7 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Incorrect Authorization vulnerability. A low privileged attacker with remote acce… |
CVE-2026-81438 | Low | 3.7 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains Use of a Broken or Risky Cryptographic Algorithm vulnerability. An unauthenticated a… |
CVE-2026-78426 | Low | 3.7 | 2026-09-17 | The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding a valid JWT that has not expired, but… |