Low-severity CVEs (page 21)
Page 21 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-64787 | Low | 3.3 | 2025-12-09 | Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an Improper Verification of Cryptograp… |
CVE-2025-64786 | Low | 3.3 | 2025-12-09 | Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an Improper Verification of Cryptograp… |
CVE-2025-59923 | Low | 2.7 | 2025-12-09 | An improper access control vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all ve… |
CVE-2025-57823 | Low | 2.7 | 2025-12-09 | A direct request ('forced browsing') vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator… |
CVE-2025-64696 | Low | 3.3 | 2025-12-09 | Android App "Brother iPrint&Scan" versions 6.13.7 and earlier improperly uses an external cache directory. If exploited, application-specific files may be acce… |
CVE-2025-64255 | Low | 2.7 | 2025-12-09 | Missing Authorization vulnerability in Bowo Admin and Site Enhancements (ASE) admin-site-enhancements allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-64254 | Low | 2.7 | 2025-12-09 | Missing Authorization vulnerability in Ronald Huereca Photo Block photo-block allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2025-40818 | Low | 3.3 | 2025-12-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP4). Affected applications contain private SSL/TLS keys on the server… |
CVE-2024-56464 | Low | 2.7 | 2025-12-09 | IBM QRadar SIEM 7.5 - 7.5.0 UP14 IF01 is affected by an information disclosure vulnerability involving exposure of directory information. IBM has addressed thi… |
CVE-2025-36102 | Low | 2.7 | 2025-12-08 | IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow a privileged user to bypass validation, passing user input… |
CVE-2025-65228 | Low | 3.5 | 2025-12-08 | A stored cross-site scripting vulnerability exists in the web management interface of the R.V.R. Elettronica TLK302T telemetry controller (firmware 1.5.1799). |
CVE-2025-60912 | Low | 3.3 | 2025-12-08 | phpIPAM v1.7.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the database export functionality. The generate-mysql.php function, located in the… |
CVE-2025-14244 | Low | 2.4 | 2025-12-08 | A flaw has been found in GreenCMS 2.3.0603. Affected by this issue is some unknown functionality of the file /Admin/Controller/CustomController.class.php of th… |
CVE-2025-14228 | Low | 3.5 | 2025-12-08 | A weakness has been identified in Yealink SIP-T21P E2 52.84.0.15. Impacted is an unknown function of the component Local Directory Page. This manipulation caus… |
CVE-2025-66334 | Low | 3.3 | 2025-12-08 | Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-66333 | Low | 3.3 | 2025-12-08 | Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-66332 | Low | 3.3 | 2025-12-08 | Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-66331 | Low | 3.3 | 2025-12-08 | Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-14221 | Low | 3.5 | 2025-12-08 | A vulnerability was detected in SourceCodester Online Banking System 1.0. This impacts an unknown function of the file /?page=user. The manipulation of the arg… |
CVE-2025-14205 | Low | 2.4 | 2025-12-08 | A vulnerability was found in code-projects Chamber of Commerce Membership Management System 1.0. Impacted is an unknown function of the file /membership_profil… |
CVE-2025-14201 | Low | 2.4 | 2025-12-07 | A vulnerability was found in alokjaiswal Hotel-Management-services-using-MYSQL-and-php up to 5f8b60a7aa6c06a5632de569d4e3f6a8cd82f76f. Affected by this vulnera… |
CVE-2025-14200 | Low | 3.5 | 2025-12-07 | A vulnerability has been found in alokjaiswal Hotel-Management-services-using-MYSQL-and-php up to 5f8b60a7aa6c06a5632de569d4e3f6a8cd82f76f. Affected is an unkn… |
CVE-2025-14194 | Low | 3.5 | 2025-12-07 | A vulnerability was identified in code-projects Employee Profile Management System 1.0. This issue affects some unknown processing of the file /view_personnel… |
CVE-2025-14186 | Low | 3.5 | 2025-12-07 | A security flaw has been discovered in Grandstream GXP1625 1.0.7.4. The impacted element is an unknown function of the file /cgi-bin/api.values.post of the com… |
CVE-2025-66629 | Low | 3.7 | 2025-12-05 | HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.4, some of HedgeDoc's OAuth2 endpoints for social login provide… |
CVE-2025-66558 | Low | 3.1 | 2025-12-05 | Nextcloud Twofactor WebAuthn is the WebAuthn Two-Factor Provider for Nextcloud. Prior to 1.4.2 and 2.4.1, a missing ownership check allowed an attack to take-a… |
CVE-2025-66556 | Low | 3.5 | 2025-12-05 | Nextcloud talk is a video & audio conferencing app for Nextcloud. Prior to 20.1.8 and 21.1.2, a participant with chat permissions was able to delete poll draft… |
CVE-2025-66554 | Low | 3.5 | 2025-12-05 | Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. Prior to 5.5.4, 6.0.6, and 7.2.5, a malicious use… |
CVE-2025-66549 | Low | 2.4 | 2025-12-05 | Nextcloud Desktop is the desktop sync client for Nextcloud. Prior to 3.16.5, when trying to manually lock a file inside an end-to-end encrypted directory, the… |
CVE-2025-66548 | Low | 3.3 | 2025-12-05 | Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.12.7, 1… |
CVE-2025-66545 | Low | 3.5 | 2025-12-05 | Nextcloud Groupfolders provides admin-configured folders shared by everyone in a group or team. Prior to 14.0.11, 15.3.12, 16.0.15, 17.0.14, 18.1.8, 19.1.8, an… |
CVE-2025-66515 | Low | 2.7 | 2025-12-05 | The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a w… |
CVE-2025-66514 | Low | 3.5 | 2025-12-05 | Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Prior to 5.5.3, a stored HTML injection in the Mail app's message list allow… |
CVE-2025-66546 | Low | 3.3 | 2025-12-05 | Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential I… |
CVE-2025-12997 | Low | 2.2 | 2025-12-04 | Insecure Direct Object Reference vulnerability in Medtronic CareLink Network which allows an authenticated attacker with access to specific device and user inf… |
CVE-2025-14013 | Low | 2.4 | 2025-12-04 | A vulnerability was identified in JIZHICMS up to 2.5.5. The impacted element is an unknown function of the file /index.php/admins/Comment/addcomment.html of th… |
CVE-2025-14007 | Low | 2.0 | 2025-12-04 | A vulnerability was detected in dayrui XunRuiCMS up to 4.7.1. This affects an unknown part of the file /admin79f2ec220c7e.php?c=api&m=demo&name=mobile of the c… |
CVE-2025-14006 | Low | 3.5 | 2025-12-04 | A security vulnerability has been detected in dayrui XunRuiCMS up to 4.7.1. Affected by this issue is some unknown functionality of the file /admind45f74adbd95… |
CVE-2025-14005 | Low | 2.4 | 2025-12-04 | A weakness has been identified in dayrui XunRuiCMS up to 4.7.1. Affected by this vulnerability is an unknown functionality of the file /admind45f74adbd95.php?c… |
CVE-2025-64763 | Low | 3.7 | 2025-12-03 | Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, when Envoy is configured in TCP proxy mode to handle C… |
CVE-2025-20388 | Low | 2.7 | 2025-12-03 | In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.7, and 9.3.2411.116, a us… |
CVE-2025-20385 | Low | 2.4 | 2025-12-03 | In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.6, 10.0.2503.7, and 9.3.2411.117, a us… |
CVE-2025-20382 | Low | 3.5 | 2025-12-03 | In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.10, 10.0.2503.8, and 9.3.2411.120, a l… |
CVE-2025-12954 | Low | 2.7 | 2025-12-03 | The Timetable and Event Schedule by MotoPress WordPress plugin before 2.4.16 does not verify a user has access to a specific event when duplicating, leading to… |
CVE-2025-13640 | Low | 3.5 | 2025-12-02 | Inappropriate implementation in Passwords in Google Chrome prior to 143.0.7499.41 allowed a local attacker to bypass authentication via physical access to the… |
CVE-2025-59700 | Low | 3.9 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker with root access to modify the Recover… |
CVE-2025-59696 | Low | 3.2 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker to modify or erase tamper events via t… |
CVE-2025-65858 | Low | 3.5 | 2025-12-02 | A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user… |
CVE-2025-13879 | Low | 2.7 | 2025-12-02 | Directory traversal vulnerability in SOLIDserver IPAM v8.2.3. This vulnerability allows an authenticated user with administrator privileges to list directories… |
CVE-2025-13870 | Low | 3.1 | 2025-12-02 | Mattermost versions 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate the user permission when accessing the files and subscribing to the block in Boards… |
CVE-2025-13805 | Low | 3.7 | 2025-12-01 | A weakness has been identified in nutzam NutzBoot up to 2.6.0-SNAPSHOT. This affects the function getInputStream of the file nutzcloud/nutzcloud-literpc/src/ma… |
CVE-2025-13795 | Low | 2.4 | 2025-11-30 | A weakness has been identified in codingWithElias School Management System up to f1ac334bfd89ae9067cc14dea12ec6ff3f078c01. Affected is an unknown function of t… |
CVE-2025-13784 | Low | 2.4 | 2025-11-30 | A weakness has been identified in yungifez Skuul School Management System up to 2.6.5. This vulnerability affects unknown code of the file /dashboard/schools/1… |
CVE-2025-6666 | Low | 2.0 | 2025-11-29 | A vulnerability was determined in motogadget mo.lock Ignition Lock up to 20251125. Affected by this vulnerability is an unknown functionality of the component… |
CVE-2025-66382 | Low | 2.9 | 2025-11-28 | In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time. |
CVE-2025-66372 | Low | 2.8 | 2025-11-28 | Mustang before 2.16.3 allows exfiltrating files via XXE attacks. |
CVE-2025-13758 | Low | 3.5 | 2025-11-27 | Exposure of credentials in unintended requests in Devolutions Server.This issue affects Server: through 2025.2.20, through 2025.3.8. |
CVE-2025-66040 | Low | 3.6 | 2025-11-27 | Spotipy is a Python library for the Spotify Web API. Prior to version 2.25.2, there is a cross-site scripting (XSS) vulnerability in the OAuth callback server… |
CVE-2025-13611 | Low | 2.0 | 2025-11-26 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.2 before 18.5.5 and 18.6 before 18.6.3 that could have allowed an authenticated u… |
CVE-2025-65681 | Low | 3.3 | 2025-11-26 | An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information… |
CVE-2025-20373 | Low | 2.7 | 2025-11-26 | In Splunk Add-on for Palo Alto Networks versions below 2.0.2, the add-on exposes client secrets in plain text in the _internal index during the addition of new… |
CVE-2025-55174 | Low | 3.2 | 2025-11-26 | In KDE Skanpage before 25.08.0, an attempt at file overwrite can result in the contents of the new file at the beginning followed by the partial contents of th… |
CVE-2025-65942 | Low | 2.7 | 2025-11-25 | VictoriaMetrics is a scalable solution for monitoring and managing time series data. In versions from 1.0.0 to before 1.110.23, from 1.111.0 to before 1.122.8… |
CVE-2025-65961 | Low | 3.3 | 2025-11-25 | Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, it is possible to inject code into the template output tha… |
CVE-2025-33200 | Low | 2.3 | 2025-11-25 | NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a resource to be reused. A successful exploit of this vulnerabi… |
CVE-2025-33199 | Low | 3.2 | 2025-11-25 | NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause incorrect control flow behavior. A successful exploit of this v… |
CVE-2025-33198 | Low | 3.3 | 2025-11-25 | NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a resource to be reused. A successful exploit of this vulnerabi… |
CVE-2025-36134 | Low | 3.7 | 2025-11-25 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.5 and 6.2.1.1 could disclose sensitive information… |
CVE-2025-59485 | Low | 3.3 | 2025-11-25 | Incorrect default permissions issue exists in Security Point (Windows) of MaLion prior to Ver.5.3.4. If this vulnerability is exploited, an arbitrary file coul… |
CVE-2025-13643 | Low | 3.1 | 2025-11-25 | A user with access to the cluster with a limited set of privilege actions may be able to terminate queries that are being executed by other users. This may cau… |
CVE-2025-13584 | Low | 3.5 | 2025-11-24 | A security vulnerability has been detected in Eigenfocus up to 1.4.0. This vulnerability affects unknown code of the component Description Handler. The manipul… |
CVE-2025-13577 | Low | 3.5 | 2025-11-24 | A flaw has been found in PHPGurukul Hostel Management System 2.1. The impacted element is an unknown function of the file /register-complaint.php. Executing a… |
CVE-2025-13566 | Low | 3.3 | 2025-11-23 | A security vulnerability has been detected in jarun nnn up to 5.1. The impacted element is the function show_content_in_floating_window/run_cmd_as_plugin of th… |
CVE-2025-11934 | Low | 2.7 | 2025-11-21 | Improper input validation in the TLS 1.3 CertificateVerify signature algorithm negotiation in wolfSSL 5.8.2 and earlier on multiple platforms allows for downgr… |
CVE-2025-31216 | Low | 2.4 | 2025-11-21 | The issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7. An attacker with physical access to a device may… |
CVE-2025-66062 | Low | 3.4 | 2025-11-21 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Frank Goossens WP YouTube Lyte wp-youtube-lyte allows Phishing.This issue affects WP YouTu… |
CVE-2025-64299 | Low | 2.7 | 2025-11-21 | LogStare Collector improperly handles the password hash data. An administrative user may obtain the other users' password hashes. |
CVE-2025-13484 | Low | 2.4 | 2025-11-20 | A vulnerability was identified in Campcodes Complete Online Beauty Parlor Management System 1.0. This vulnerability affects unknown code of the file /admin/cus… |
CVE-2025-52666 | Low | 2.7 | 2025-11-20 | Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administrator user to disable th… |
CVE-2025-35029 | Low | 3.5 | 2025-11-20 | Medical Informatics Engineering Enterprise Health has a stored cross site scripting vulnerability that allows an authenticated attacker to add arbitrary conten… |
CVE-2025-64524 | Low | 3.3 | 2025-11-20 | cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In version… |
CVE-2025-13469 | Low | 2.4 | 2025-11-20 | A security vulnerability has been detected in Public Knowledge Project omp and ojs 3.3.0/3.4.0/3.5.0. Impacted is an unknown function of the file plugins/payme… |
CVE-2025-13450 | Low | 3.5 | 2025-11-20 | A vulnerability was determined in SourceCodester Online Shop Project 1.0. Impacted is an unknown function of the file /shop/register.php. This manipulation of… |
CVE-2025-13415 | Low | 3.5 | 2025-11-19 | A vulnerability was identified in icret EasyImages up to 2.8.6. This affects an unknown part of the file /app/upload.php of the component SVG Image Handler. Th… |
CVE-2025-13412 | Low | 2.4 | 2025-11-19 | A vulnerability was determined in Campcodes Retro Basketball Shoes Online Store 1.0. Affected by this issue is some unknown functionality of the file /admin/ad… |
CVE-2025-64757 | Low | 3.5 | 2025-11-19 | Astro is a web framework. Prior to version 5.14.3, a vulnerability has been identified in the Astro framework's development server that allows arbitrary local… |
CVE-2025-13397 | Low | 3.3 | 2025-11-19 | A security vulnerability has been detected in mrubyc up to 3.4. This impacts the function mrbc_raw_realloc of the file src/alloc.c. Such manipulation of the ar… |
CVE-2025-65014 | Low | 3.7 | 2025-11-18 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a weak password policy vulnerability was identified in… |
CVE-2025-52639 | Low | 3.5 | 2025-11-18 | HCL Connections is vulnerable to a sensitive information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitle… |
CVE-2025-54821 | Low | 1.9 | 2025-11-18 | An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.11, FortiOS 7.2 all v… |
CVE-2025-13083 | Low | 3.7 | 2025-11-18 | Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-12761 | Low | 3.5 | 2025-11-18 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Simple multi step form allows Cross-Site Scripting… |
CVE-2025-55074 | Low | 3.0 | 2025-11-18 | Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to enforce access permissions on the Agents plugin which allows other users to determine when us… |
CVE-2025-13349 | Low | 3.5 | 2025-11-18 | A vulnerability has been found in SourceCodester Student Grades Management System 1.0. This issue affects some unknown processing of the file /grades.php of th… |
CVE-2025-13343 | Low | 3.5 | 2025-11-18 | A security flaw has been discovered in SourceCodester Interview Management System 1.0. Affected is an unknown function of the file /editQuestion.php. The manip… |
CVE-2025-64734 | Low | 2.4 | 2025-11-18 | Missing Release of Resource after Effective Lifetime (CWE-772) in the T21 Reader allows an attacker with physical access to the Reader to perform a denial-of-s… |
CVE-2025-12792 | Low | 3.2 | 2025-11-18 | The Mac App Store distribution of the Canva for Mac desktop app before 1.117.1 was built without Hardened Runtime. A local threat actor with unprivileged acces… |
CVE-2025-63292 | Low | 3.5 | 2025-11-17 | Freebox v5 HD (firmware = 1.7.20), Freebox v5 Crystal (firmware = 1.7.20), Freebox v6 Révolution r1–r3 (firmware = 4.7.x), Freebox Mini 4K (firmware = 4.7.x)… |
CVE-2025-65083 | Low | 3.2 | 2025-11-17 | GoSign Desktop through 2.4.1 disables TLS certificate validation when configured to use a proxy server. This can be problematic if the GoSign Desktop user sele… |
CVE-2025-13245 | Low | 3.5 | 2025-11-16 | A vulnerability was identified in code-projects Student Information System 2.0. The impacted element is an unknown function of the file /editprofile.php. Such… |