Low-severity CVEs (page 20)
Page 20 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-7001 | Low | 2.4 | 2026-04-25 | A vulnerability was found in Datacom DM4100 1.3.6.1.4.1.3709. This affects an unknown part of the component Ethernet Configuration Page. Performing a manipulat… |
CVE-2026-7000 | Low | 2.4 | 2026-04-25 | A vulnerability has been found in Datacom DM4100 1.3.6.1.4.1.3709. Affected by this issue is some unknown functionality of the component VLAN Page. Such manipu… |
CVE-2026-6999 | Low | 2.4 | 2026-04-25 | A flaw has been found in BIVOCOM TR321 21.1.1.50. Affected by this vulnerability is an unknown functionality of the component Wireless Setting. This manipulati… |
CVE-2026-6998 | Low | 2.4 | 2026-04-25 | A vulnerability was detected in BDCOM P3310D 0.4.2 10.1.0F Build 86345. Affected is an unknown function of the component New RMON Statistics Page. The manipula… |
CVE-2026-6997 | Low | 2.4 | 2026-04-25 | A security vulnerability has been detected in BDCOM P3310D 0.4.2 10.1.0F Build 86345. This impacts an unknown function of the component New RMON History Page… |
CVE-2026-6996 | Low | 2.4 | 2026-04-25 | A weakness has been identified in BDCOM P3310D 0.4.2 10.1.0F Build 86345. This affects an unknown function of the component rmon event Tab. Executing a manipul… |
CVE-2026-6995 | Low | 2.4 | 2026-04-25 | A security flaw has been discovered in BDCOM P3310D 0.4.2 10.1.0F Build 86345. The impacted element is an unknown function of the file /index.asp of the compon… |
CVE-2026-6990 | Low | 3.5 | 2026-04-25 | A vulnerability was found in projeto-siga siga 11.0.3.18. The affected element is an unknown function of the file /sigawf/app/responsavel/novo. Performing a ma… |
CVE-2026-6986 | Low | 3.7 | 2026-04-25 | A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This issue affects the function mg_aes_gcm_decrypt of the file /src/tls_aes128.c of… |
CVE-2026-41488 | Low | 3.1 | 2026-04-24 | LangChain is a framework for building agents and LLM-powered applications. Prior to 1.1.14, langchain-openai's _url_to_size() helper (used by get_num_tokens_fr… |
CVE-2026-42040 | Low | 3.7 | 2026-04-24 | Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the encode() function in lib/helpers/AxiosURLSearchParams.js cont… |
CVE-2026-41321 | Low | 2.2 | 2026-04-24 | @astrojs/cloudflare is an SSR adapter for use with Cloudflare Workers targets. Prior to 13.1.10, the fetch() call for remote images in packages/integrations/cl… |
CVE-2026-31051 | Low | 3.8 | 2026-04-24 | An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to cause a denial of service via the Client Balance component |
CVE-2026-41357 | Low | 3.3 | 2026-04-23 | OpenClaw before 2026.3.31 contains an environment variable leakage vulnerability in SSH-based sandbox backends that pass unsanitized process.env to child proce… |
CVE-2026-41354 | Low | 3.7 | 2026-04-23 | OpenClaw before 2026.4.2 contains an insufficient scope vulnerability in Zalo webhook replay dedupe keys that allows legitimate events from different conversat… |
CVE-2026-41333 | Low | 3.7 | 2026-04-23 | OpenClaw before 2026.3.31 contains an authentication rate limiting bypass vulnerability that allows attackers to circumvent shared authentication protections u… |
CVE-2026-2708 | Low | 3.7 | 2026-04-23 | A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-he… |
CVE-2026-4512 | Low | 3.5 | 2026-04-23 | The reCaptcha by WebDesignBy WordPress plugin before 2.0 does not sanitize or escape the Site Key setting before outputting it in a JavaScript string context v… |
CVE-2026-41988 | Low | 3.2 | 2026-04-23 | uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which i… |
CVE-2026-1272 | Low | 2.7 | 2026-04-23 | IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to Security Misconfiguration vulnerability in the user access control panel. |
CVE-2026-34067 | Low | 3.1 | 2026-04-22 | nimiq-transaction provides the transaction primitive to be used in Nimiq's Rust implementation. Prior to version 1.3.0, `HistoryTreeProof::verify` panics on a… |
CVE-2026-3254 | Low | 3.5 | 2026-04-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.1 that under certain conditions could have allowed an authenticat… |
CVE-2026-35381 | Low | 3.3 | 2026-04-22 | A logic error in the cut utility of uutils coreutils causes the utility to ignore the -s (only-delimited) flag when using the -z (null-terminated) and -d '' (e… |
CVE-2026-35379 | Low | 3.3 | 2026-04-22 | A logic error in the tr utility of uutils coreutils causes the program to incorrectly define the [:graph:] and [:print:] character classes. The implementation… |
CVE-2026-35378 | Low | 3.3 | 2026-04-22 | A logic error in the expr utility of uutils coreutils causes the program to evaluate parenthesized subexpressions during the parsing phase rather than at the e… |
CVE-2026-35377 | Low | 3.3 | 2026-04-22 | A logic error in the env utility of uutils coreutils causes a failure to correctly parse command-line arguments when utilizing the -S (split-string) option. In… |
CVE-2026-35375 | Low | 3.3 | 2026-04-22 | A logic error in the split utility of uutils coreutils causes the corruption of output filenames when provided with non-UTF-8 prefix or suffix inputs. The impl… |
CVE-2026-35373 | Low | 3.3 | 2026-04-22 | A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-UTF-8 filename bytes when using target-directory f… |
CVE-2026-35371 | Low | 3.3 | 2026-04-22 | The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation inco… |
CVE-2026-35367 | Low | 3.3 | 2026-04-22 | The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This causes the file to i… |
CVE-2026-35362 | Low | 3.6 | 2026-04-22 | The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-rela… |
CVE-2026-35361 | Low | 3.4 | 2026-04-22 | The mknod utility in uutils coreutils fails to handle security labels atomically by creating device nodes before setting the SELinux context. If labeling fails… |
CVE-2026-35353 | Low | 3.3 | 2026-04-22 | The mkdir utility in uutils coreutils incorrectly applies permissions when using the -m flag by creating a directory with umask-derived permissions (typically… |
CVE-2026-35346 | Low | 3.3 | 2026-04-22 | The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. The implementation uses String::from_utf8… |
CVE-2026-35344 | Low | 3.3 | 2026-04-22 | The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While in… |
CVE-2026-35343 | Low | 3.3 | 2026-04-22 | The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementati… |
CVE-2026-35342 | Low | 3.3 | 2026-04-22 | The mktemp utility in uutils coreutils fails to properly handle an empty TMPDIR environment variable. Unlike GNU mktemp, which falls back to /tmp when TMPDIR i… |
CVE-2025-9957 | Low | 2.7 | 2026-04-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under certai… |
CVE-2026-33599 | Low | 3.1 | 2026-04-22 | A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request, when requested via either the autoUpgrade (Lua) option to newS… |
CVE-2026-33597 | Low | 3.7 | 2026-04-22 | PRSD detection denial of service |
CVE-2026-33596 | Low | 3.1 | 2026-04-22 | A client might theoretically be able to cause a mismatch between queries sent to a backend and the received responses by sending a flood of perfectly timed que… |
CVE-2026-6842 | Low | 2.5 | 2026-04-22 | A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) f… |
CVE-2026-22746 | Low | 3.7 | 2026-04-22 | Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to… |
CVE-2026-6416 | Low | 2.7 | 2026-04-22 | Tanium addressed an uncontrolled resource consumption vulnerability in Interact. |
CVE-2026-6408 | Low | 2.7 | 2026-04-22 | Tanium addressed an information disclosure vulnerability in Tanium Server. |
CVE-2026-6392 | Low | 2.7 | 2026-04-22 | Tanium addressed an information disclosure vulnerability in Threat Response. |
CVE-2026-3307 | Low | 2.7 | 2026-04-21 | An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed an attacker with admin access on one repository to modify the sec… |
CVE-2026-6830 | Low | 3.3 | 2026-04-21 | nesquena hermes-webui contains an environment variable leakage vulnerability where profile switching does not clear environment variables from the previously a… |
CVE-2026-35250 | Low | 2.3 | 2026-04-21 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Easily exploit… |
CVE-2026-35249 | Low | 3.2 | 2026-04-21 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Easily exploit… |
CVE-2026-34312 | Low | 2.4 | 2026-04-21 | Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.30. Easily exploitable vulnerability allows h… |
CVE-2026-34268 | Low | 2.9 | 2026-04-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported vers… |
CVE-2026-22018 | Low | 3.7 | 2026-04-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported ver… |
CVE-2026-22014 | Low | 3.8 | 2026-04-21 | Vulnerability in the Oracle User Management product of Oracle E-Business Suite (component: Workflow and Business Events). Supported versions that are affected… |
CVE-2026-22008 | Low | 3.7 | 2026-04-21 | Vulnerability in Oracle Java SE (component: Libraries). The supported version that is affected is Oracle Java SE: 25.0.1. Difficult to exploit vulnerability… |
CVE-2026-22007 | Low | 2.9 | 2026-04-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported vers… |
CVE-2026-22001 | Low | 2.7 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.0-8.0.45, 8.4… |
CVE-2026-6745 | Low | 3.5 | 2026-04-21 | A vulnerability was determined in Bagisto up to 2.3.15. Affected by this vulnerability is an unknown functionality of the component Custom Scripts Handler. Thi… |
CVE-2026-6743 | Low | 3.5 | 2026-04-21 | A vulnerability has been found in WebSystems WebTOTUM 2026. This impacts an unknown function of the component Calendar. The manipulation leads to cross site sc… |
CVE-2026-40279 | Low | 3.7 | 2026-04-21 | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, decode_signed32() in src/bacnet/bacint.c reconstructs a 32-… |
CVE-2026-29179 | Low | 3.3 | 2026-04-21 | October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, fine-grained sub-permission checks for asset and blueprint file oper… |
CVE-2026-27937 | Low | 3.1 | 2026-04-21 | October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, a reflected Cross-Site Scripting (XSS) vulnerability was identified… |
CVE-2025-31958 | Low | 3.7 | 2026-04-21 | HCL BigFix Service Management is susceptible to HTTP Request Smuggling. HTTP request smuggling vulnerabilities arise when websites route HTTP requests through… |
CVE-2026-31369 | Low | 3.2 | 2026-04-21 | PcManager is affected by type privilege bypass, successful exploitation of this vulnerability may affect service availability |
CVE-2026-40264 | Low | 2.7 | 2026-04-21 | OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who… |
CVE-2026-39396 | Low | 3.1 | 2026-04-21 | OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, `ExtractPluginFromImage()` in OpenBao's OCI plugin downloader extra… |
CVE-2026-39388 | Low | 3.1 | 2026-04-21 | OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, OpenBao's Certificate authentication method, when a token renewal i… |
CVE-2026-6651 | Low | 2.4 | 2026-04-20 | A security flaw has been discovered in erponline.xyz ERP Online up to 4.0.0. This vulnerability affects unknown code of the component Inventory Edit Item Page… |
CVE-2026-6648 | Low | 3.5 | 2026-04-20 | A vulnerability was found in Qibo CMS 1.0. Affected by this vulnerability is an unknown functionality of the component Internal Message Module. Performing a ma… |
CVE-2026-6633 | Low | 3.5 | 2026-04-20 | A security flaw has been discovered in Yifang CMS up to 2.0.5. The impacted element is the function store of the file plugins/yifang_backend_account/logic/admi… |
CVE-2026-6624 | Low | 2.4 | 2026-04-20 | A weakness has been identified in BichitroGan ISP Billing Software 2025.3.20. Affected is an unknown function of the file /?\_route=pool/add of the component P… |
CVE-2026-6623 | Low | 2.4 | 2026-04-20 | A security flaw has been discovered in BichitroGan ISP Billing Software 2025.3.20. This impacts an unknown function of the file /?_route=settings/users-view/ o… |
CVE-2026-6622 | Low | 2.4 | 2026-04-20 | A vulnerability was identified in BichitroGan ISP Billing Software 2025.3.20. This affects an unknown function of the file /?\_route=customers/edit/ of the com… |
CVE-2026-6619 | Low | 3.5 | 2026-04-20 | A vulnerability has been found in langgenius dify up to 1.13.3. Impacted is the function openInNewTab of the file web/app/components/base/image-uploader/image-… |
CVE-2026-6611 | Low | 3.1 | 2026-04-20 | A vulnerability was found in liangliangyy DjangoBlog up to 2.1.0.0. This affects an unknown function of the file djangoblog/settings.py of the component File U… |
CVE-2024-7083 | Low | 3.5 | 2026-04-20 | The Email Encoder WordPress plugin before 2.3.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per… |
CVE-2026-6610 | Low | 3.7 | 2026-04-20 | A vulnerability has been found in liangliangyy DjangoBlog up to 2.1.0.0. The impacted element is an unknown function of the file djangoblog/settings.py of the… |
CVE-2026-6600 | Low | 3.5 | 2026-04-20 | A flaw has been found in langflow-ai langflow up to 1.8.3. This affects an unknown function of the file src/frontend/src/modals/IOModal/components/chatView/cha… |
CVE-2026-6597 | Low | 2.7 | 2026-04-20 | A weakness has been identified in langflow-ai langflow up to 1.8.3. Impacted is the function remove_api_keys/has_api_terms of the file src/backend/base/langflo… |
CVE-2026-6593 | Low | 3.5 | 2026-04-20 | A vulnerability was found in ComfyUI up to 0.13.0. Affected by this issue is some unknown functionality of the file server.py of the component View Endpoint. P… |
CVE-2026-6592 | Low | 3.5 | 2026-04-20 | A vulnerability has been found in ComfyUI up to 0.13.0. Affected by this vulnerability is the function getuserdata of the file app/user_manager.py of the compo… |
CVE-2026-6570 | Low | 2.7 | 2026-04-19 | A security flaw has been discovered in kodcloud KodExplorer up to 4.52. Affected is the function initInstall of the file /app/controller/systemMember.class.php… |
CVE-2026-32690 | Low | 3.7 | 2026-04-18 | Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fie… |
CVE-2026-40341 | Low | 3.5 | 2026-04-18 | libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, an out of bound read in ptp_unpack_EOS_FocusInfoEx could be used to… |
CVE-2026-40336 | Low | 2.4 | 2026-04-18 | libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have a memory leak in `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack… |
CVE-2026-40334 | Low | 3.5 | 2026-04-18 | libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, a missing null terminator exists in ptp_unpack_Canon_FE() in camlibs… |
CVE-2026-33436 | Low | 3.1 | 2026-04-17 | Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. In versions prior to 2.0.0, file upload endpoints render use… |
CVE-2026-6493 | Low | 3.5 | 2026-04-17 | A flaw has been found in lukevella rallly up to 4.7.4. This affects an unknown function of the file apps/web/src/app/[locale]/(auth)/reset-password/components/… |
CVE-2026-6486 | Low | 3.5 | 2026-04-17 | A vulnerability was detected in classroombookings up to 2.17.0. This impacts the function read of the file crbs-core/application/views/layout.php of the compon… |
CVE-2026-35496 | Low | 2.7 | 2026-04-17 | A path traversal vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to access higher-level directories th… |
CVE-2026-40263 | Low | 3.7 | 2026-04-17 | Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the login endpoint performs bcrypt password verification only when the suppl… |
CVE-2026-41080 | Low | 2.9 | 2026-04-16 | libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document. |
CVE-2026-3155 | Low | 3.1 | 2026-04-16 | The OneSignal – Web Push Notifications plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.8.0. This is due to the p… |
CVE-2024-8010 | Low | 3.5 | 2026-04-16 | The component accepts XML input through the publisher without disabling external entity resolution. This allows malicious actors to submit a crafted XML payloa… |
CVE-2026-40505 | Low | 3.3 | 2026-04-16 | MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metada… |
CVE-2026-40947 | Low | 2.9 | 2026-04-16 | Yubico libfido2 before 1.17.0, python-fido2 before 2.2.0, and yubikey-manager before 5.9.1 have an unintended DLL search path. |
CVE-2026-6313 | Low | 3.1 | 2026-04-15 | Insufficient policy enforcement in CORS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to leak cro… |
CVE-2026-6312 | Low | 3.1 | 2026-04-15 | Insufficient policy enforcement in Passwords in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to lea… |
CVE-2026-33877 | Low | 3.7 | 2026-04-15 | ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a timing side-channel vulnerability in the password reset… |
CVE-2026-21727 | Low | 3.3 | 2026-04-15 | A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condit… |