Low-severity CVEs (page 22)
Page 22 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-5622 | Low | 3.7 | 2026-04-06 | A vulnerability was determined in hcengineering Huly Platform 0.7.382. Affected by this issue is some unknown functionality of the file foundations/core/packag… |
CVE-2026-35679 | Low | 3.5 | 2026-04-05 | Zcash zcashd before 6.12.0 allows invalid transactions to be accepted under certain conditions, which potentially could have resulted in the draining of user f… |
CVE-2026-5568 | Low | 3.5 | 2026-04-05 | A vulnerability has been found in Akaunting up to 3.1.21. This issue affects some unknown processing of the component Invoice/Billing. The manipulation of the… |
CVE-2026-34768 | Low | 3.9 | 2026-04-04 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-be… |
CVE-2026-34766 | Low | 3.3 | 2026-04-04 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-be… |
CVE-2026-3184 | Low | 3.7 | 2026-04-03 | A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote… |
CVE-2026-5471 | Low | 3.3 | 2026-04-03 | A vulnerability was detected in Investory Toy Planet Trouble App up to 1.5.5 on Android. Impacted is an unknown function of the file assets/google-services-des… |
CVE-2026-5468 | Low | 3.5 | 2026-04-03 | A security flaw has been discovered in Casdoor 2.356.0. This affects the function dangerouslySetInnerHTML. Performing a manipulation of the argument formCss/fo… |
CVE-2026-5462 | Low | 3.3 | 2026-04-03 | A vulnerability was identified in Wahoo Fitness SYSTM App up to 7.2.1 on Android. Impacted is an unknown function of the file com/WahooFitness/SYSTM/BuildConfi… |
CVE-2026-5458 | Low | 3.3 | 2026-04-03 | A weakness has been identified in Noelse Individuals & Pro App up to 2.1.7 on Android. This impacts an unknown function of the file com/reactnative/antelop/Bui… |
CVE-2026-5457 | Low | 3.3 | 2026-04-03 | A security flaw has been discovered in PropertyGuru AgentNet Singapore App up to 23.7.10 on Android. This affects an unknown function of the file com/allproper… |
CVE-2026-5456 | Low | 3.3 | 2026-04-03 | A vulnerability was identified in Align Technology My Invisalign App 3.12.4 on Android. The impacted element is an unknown function of the file com/aligntech/m… |
CVE-2026-5455 | Low | 3.3 | 2026-04-03 | A vulnerability was determined in Dialogue App up to 4.3.2 on Android. The affected element is an unknown function of the file file res/raw/config.json of the… |
CVE-2026-5454 | Low | 3.3 | 2026-04-03 | A vulnerability was found in GRID Organiser App up to 1.0.5 on Android. Impacted is an unknown function of the file file res/raw/app.json of the component co.g… |
CVE-2026-5453 | Low | 3.3 | 2026-04-03 | A vulnerability has been found in Rico só vantagem pra investir App up to 4.58.32.12421 on Android. This issue affects some unknown processing of the file br/c… |
CVE-2026-35538 | Low | 3.1 | 2026-04-03 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass du… |
CVE-2026-5452 | Low | 3.3 | 2026-04-03 | A flaw has been found in UCC CampusConnect App up to 14.3.5 on Android. This vulnerability affects unknown code of the file campusconnect/BuildConfig.java of t… |
CVE-2026-35537 | Low | 3.7 | 2026-04-03 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file… |
CVE-2026-5420 | Low | 2.5 | 2026-04-02 | A security flaw has been discovered in Shinrays Games Goods Triple App up to 1.200. The affected element is an unknown function of the file jRwTX.java of the c… |
CVE-2026-34762 | Low | 2.7 | 2026-04-02 | Ella Core is a 5G core designed for private networks. Prior to version 1.8.0, the PUT /api/v1/subscriber/{imsi} API accepts an IMSI identifier from both the UR… |
CVE-2025-43236 | Low | 3.3 | 2026-04-02 | A type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An at… |
CVE-2026-5413 | Low | 3.7 | 2026-04-02 | A vulnerability was identified in Newgen OmniDocs up to 12.0.00. Affected by this vulnerability is an unknown functionality of the file /omnidocs/GetWebApiConf… |
CVE-2026-5370 | Low | 3.5 | 2026-04-02 | A vulnerability was identified in krayin laravel-crm up to 2.2. Impacted is the function composeMail of the file packages/Webkul/Admin/tests/e2e-pw/tests/mail/… |
CVE-2026-5360 | Low | 3.7 | 2026-04-02 | A vulnerability has been found in Free5GC 4.2.0. The affected element is an unknown function of the component aper. Such manipulation leads to type confusion… |
CVE-2026-35388 | Low | 2.5 | 2026-04-02 | OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions. |
CVE-2026-35387 | Low | 3.1 | 2026-04-02 | OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterp… |
CVE-2026-35386 | Low | 3.6 | 2026-04-02 | In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username o… |
CVE-2026-26961 | Low | 3.7 | 2026-04-02 | Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser extracts the boundary parameter from multipar… |
CVE-2026-5332 | Low | 3.5 | 2026-04-02 | A vulnerability was identified in Xiaopi Panel 1.0.0. This vulnerability affects unknown code of the file /demo.php of the component WAF Firewall. The manipula… |
CVE-2026-5325 | Low | 3.5 | 2026-04-02 | A vulnerability was determined in SourceCodester Simple Customer Relationship Management System 1.0. This issue affects some unknown processing of the file /cr… |
CVE-2025-66487 | Low | 2.7 | 2026-04-01 | IBM Aspera Shares 1.9.9 through 1.11.0 does not properly rate limit the frequency that an authenticated user can send emails, which could result in email flood… |
CVE-2026-2475 | Low | 3.1 | 2026-04-01 | IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 thr… |
CVE-2026-5310 | Low | 2.5 | 2026-04-01 | A vulnerability was identified in Enter Software Iperius Backup up to 8.7.2. This impacts an unknown function of the file IperiusAccounts.ini. Such manipulatio… |
CVE-2025-67806 | Low | 3.7 | 2026-04-01 | The login mechanism of Sage DPW 2021_06_004 displays distinct responses for valid and invalid usernames, allowing enumeration of existing accounts in versions… |
CVE-2026-35094 | Low | 3.3 | 2026-04-01 | A flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directories can exploit a dangling pointer vulnerability. T… |
CVE-2026-5254 | Low | 3.5 | 2026-04-01 | A security vulnerability has been detected in welovemedia FFmate up to 2.0.15. Affected by this issue is some unknown functionality of the file /ui/app/compone… |
CVE-2026-5253 | Low | 3.5 | 2026-04-01 | A weakness has been identified in bufanyun HotGo 1.0/2.0. Affected by this vulnerability is an unknown functionality of the file /web/src/layout/components/Hea… |
CVE-2026-5252 | Low | 3.5 | 2026-04-01 | A security flaw has been discovered in z-9527 admin 1.0/2.0. Affected is an unknown function of the file /server/routes/message.js of the component Message Cre… |
CVE-2026-5249 | Low | 3.5 | 2026-04-01 | A vulnerability was found in gougucms 4.08.18. This impacts an unknown function of the file \gougucms-master\app\admin\view\user\record.html of the component R… |
CVE-2026-3470 | Low | 3.8 | 2026-03-31 | A vulnerability exists in the SonicWall Email Security appliance due to improper input sanitization that may lead to data corruption, allowing a remote authent… |
CVE-2026-3469 | Low | 2.7 | 2026-03-31 | A denial-of-service (DoS) vulnerability exists due to improper input validation in the SonicWall Email Security appliance, allowing a remote authenticated atta… |
CVE-2026-34372 | Low | 2.7 | 2026-03-31 | Sulu is an open-source PHP content management system based on the Symfony framework. From versions 1.0.0 to before 2.6.22, and 3.0.0 to before 3.0.5, a user wh… |
CVE-2026-34203 | Low | 2.7 | 2026-03-31 | Nautobot is a Network Source of Truth and Network Automation Platform. Prior to versions 2.4.30 and 3.0.10, user creation and editing via the REST API fails to… |
CVE-2026-5209 | Low | 2.4 | 2026-03-31 | A security vulnerability has been detected in SourceCodester Leave Application System 1.0. Affected by this issue is some unknown functionality of the componen… |
CVE-2026-33415 | Low | 2.7 | 2026-03-31 | Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to b… |
CVE-2025-62184 | Low | 3.4 | 2026-03-31 | Pega Platform versions 8.1.0 through 25.1.0 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. Requires an administrat… |
CVE-2026-33762 | Low | 2.8 | 2026-03-31 | go-git is an extensible git implementation library written in pure Go. Prior to version 5.17.1, go-git’s index decoder for format version 4 fails to validate t… |
CVE-2026-32970 | Low | 2.5 | 2026-03-31 | OpenClaw before 2026.3.11 contains a credential fallback vulnerability where unavailable local gateway.auth.token and gateway.auth.password SecretRefs are trea… |
CVE-2026-0397 | Low | 3.1 | 2026-03-31 | When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malic… |
CVE-2026-0396 | Low | 3.1 | 2026-03-31 | An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynami… |
CVE-2026-32696 | Low | 3.1 | 2026-03-30 | NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In NanoMQ version 0.24.6, after enabling auth.http_auth (HTTP authentication), when a cli… |
CVE-2026-21716 | Low | 3.3 | 2026-03-30 | An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while the… |
CVE-2026-21715 | Low | 3.3 | 2026-03-30 | A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable f… |
CVE-2025-66215 | Low | 3.8 | 2026-03-30 | OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, an attacker with physical access to the computer at the time user or adminis… |
CVE-2025-66038 | Low | 3.9 | 2026-03-30 | OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, sc_compacttlv_find_tag searches a compact-TLV buffer for a given tag. In com… |
CVE-2025-66037 | Low | 3.9 | 2026-03-30 | OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, feeding a crafted input to the fuzz_pkcs15_reader harness causes OpenSC to p… |
CVE-2025-49010 | Low | 3.8 | 2026-03-30 | OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, an attacker with physical access to the computer at the time user or adminis… |
CVE-2026-5124 | Low | 3.7 | 2026-03-30 | A security vulnerability has been detected in osrg GoBGP up to 4.3.0. Affected is the function BGPHeader.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of t… |
CVE-2026-5123 | Low | 3.7 | 2026-03-30 | A weakness has been identified in osrg GoBGP up to 4.3.0. This impacts the function DecodeFromBytes of the file pkg/packet/bgp/bgp.go. Executing a manipulation… |
CVE-2026-5122 | Low | 3.7 | 2026-03-30 | A security flaw has been discovered in osrg GoBGP up to 4.3.0. This affects the function DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component BGP… |
CVE-2026-28527 | Low | 3.5 | 2026-03-30 | BlueKitchen BTstack versions prior to 1.8.1 contain an out-of-bounds read vulnerability in the AVRCP Controller GET_PLAYER_APPLICATION_SETTING_ATTRIBUTE_TEXT a… |
CVE-2026-28526 | Low | 3.5 | 2026-03-30 | BlueKitchen BTstack versions prior to 1.8.1 contain an out-of-bounds read vulnerability in the AVRCP Controller LIST_PLAYER_APPLICATION_SETTING_ATTRIBUTES and… |
CVE-2026-5106 | Low | 2.4 | 2026-03-30 | A flaw has been found in code-projects Exam Form Submission 1.0. The impacted element is an unknown function of the file /admin/update_fst.php. Executing a man… |
CVE-2026-5037 | Low | 3.3 | 2026-03-29 | A vulnerability was determined in mxml up to 4.0.4. This issue affects the function index_sort of the file mxml-index.c of the component mxmlIndexNew. Executin… |
CVE-2026-4995 | Low | 3.5 | 2026-03-28 | A vulnerability was determined in wandb OpenUI up to 1.0. Affected by this vulnerability is an unknown functionality of the file frontend/public/annotator/inde… |
CVE-2026-4994 | Low | 3.5 | 2026-03-28 | A vulnerability was found in wandb OpenUI up to 1.0/3.5-turb. Affected is the function generic_exception_handler of the file backend/openui/server.py of the co… |
CVE-2026-4993 | Low | 3.3 | 2026-03-28 | A vulnerability has been found in wandb OpenUI up to 0.0.0.0/1.0. This impacts an unknown function of the file backend/openui/config.py. The manipulation of th… |
CVE-2026-4991 | Low | 3.5 | 2026-03-27 | A vulnerability was detected in QDOCS Smart School Management System up to 7.2. The impacted element is an unknown function of the file /admin/enquiry of the c… |
CVE-2026-4988 | Low | 3.7 | 2026-03-27 | A security flaw has been discovered in Open5GS 2.7.6. This issue affects the function smf_gx_cca_cb/smf_gy_cca_cb/smf_s6b of the component CCA Message Handler… |
CVE-2026-4973 | Low | 3.5 | 2026-03-27 | A vulnerability was detected in SourceCodester Online Quiz System up to 1.0. Affected by this vulnerability is an unknown functionality of the file endpoint/ad… |
CVE-2026-4972 | Low | 2.4 | 2026-03-27 | A security vulnerability has been detected in code-projects Online Reviewer System up to 1.0. Affected is an unknown function of the file /system/system/studen… |
CVE-2026-4969 | Low | 3.5 | 2026-03-27 | A vulnerability was identified in code-projects Social Networking Site 1.0. The impacted element is an unknown function of the file /home.php of the component… |
CVE-2026-4958 | Low | 3.1 | 2026-03-27 | A vulnerability has been found in OpenBMB XAgent 1.0.0. This affects the function ReplayServer.on_connect/ReplayServer.send_data of the file XAgentServer/appli… |
CVE-2026-32984 | Low | 3.5 | 2026-03-27 | Wazuh authd contains a heap-buffer overflow vulnerability that allows attackers to cause memory corruption and malformed heap data by sending specially crafted… |
CVE-2023-7340 | Low | 3.5 | 2026-03-27 | Wazuh authd contains a heap-buffer overflow vulnerability that allows attackers to cause memory corruption and malformed heap data by sending specially crafted… |
CVE-2026-4957 | Low | 2.7 | 2026-03-27 | A flaw has been found in OpenBMB XAgent 1.0.0. The impacted element is the function FunctionHandler.handle_tool_call of the file XAgent/function_handler.py of… |
CVE-2026-27860 | Low | 3.7 | 2026-03-27 | If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restricti… |
CVE-2026-4909 | Low | 2.4 | 2026-03-27 | A weakness has been identified in code-projects Exam Form Submission 1.0. This impacts an unknown function of the file /admin/update_s7.php. This manipulation… |
CVE-2026-29071 | Low | 3.1 | 2026-03-27 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.6, any authenticated user can read othe… |
CVE-2026-4899 | Low | 2.4 | 2026-03-26 | A security flaw has been discovered in code-projects Online Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file /dbfood/… |
CVE-2026-33674 | Low | 2.0 | 2026-03-26 | PrestaShop is an open source e-commerce web application. Versions prior to 8.2.5 and 9.1.0 improperly use the validation framework. Versions 8.2.5 and 9.1.0 co… |
CVE-2026-2271 | Low | 3.3 | 2026-03-26 | A flaw was found in GIMP's PSP (Paint Shop Pro) file parser. A remote attacker could exploit an integer overflow vulnerability in the read_creator_block() func… |
CVE-2026-2239 | Low | 2.8 | 2026-03-26 | A flaw was found in GIMP. Heap-buffer-overflow vulnerability exists in the fread_pascal_string function when processing a specially crafted PSD (Photoshop Docu… |
CVE-2026-0968 | Low | 3.1 | 2026-03-26 | A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SS… |
CVE-2026-0965 | Low | 3.3 | 2026-03-26 | A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a maliciou… |
CVE-2026-33529 | Low | 3.3 | 2026-03-26 | Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. Prior to version 3.3.2, an authenticated path traversal vulnerability in the configuration… |
CVE-2026-33490 | Low | 3.7 | 2026-03-26 | H3 is a minimal H(TTP) framework. In versions 2.0.0-0 through 2.0.1-rc.16, the `mount()` method in h3 uses a simple `startsWith()` check to determine whether i… |
CVE-2026-3109 | Low | 2.2 | 2026-03-26 | Mattermost Plugins versions <=11.4 10.11.11.0 fail to validate webhook request timestamps which allows an attacker to corrupt Zoom meeting state in Mattermost… |
CVE-2025-55277 | Low | 2.6 | 2026-03-26 | HCL Aftermarket DPC is affected by Use of Vulnerable/Outdated Versions vulnerability using which an attacker may make use of the exploits available across the… |
CVE-2025-55276 | Low | 3.1 | 2026-03-26 | HCL Aftermarket DPC is affected by Internal IP Disclosure vulnerability will give attackers a clearer map of the organization’s network layout. |
CVE-2025-55275 | Low | 3.7 | 2026-03-26 | HCL Aftermarket DPC is affected by Admin Session Concurrency vulnerability using which an attacker can exploit concurrent sessions to hijack or impersonate an… |
CVE-2025-55274 | Low | 2.6 | 2026-03-26 | HCL Aftermarket DPC is affected by Cross-Origin Resource Sharing vulnerability. CORS misconfigurations includes the exposure of sensitive user information to a… |
CVE-2025-55272 | Low | 3.1 | 2026-03-26 | HCL Aftermarket DPC is affected by Banner Disclosure vulnerability where attackers gain insights into the system’s software and version details which would all… |
CVE-2025-55271 | Low | 3.1 | 2026-03-26 | HCL Aftermarket DPC is affected by HTTP Response Splitting vulnerability where in depending on how the web application handles the split response, an attacker… |
CVE-2025-55270 | Low | 3.5 | 2026-03-26 | HCL Aftermarket DPC is affected by Improper Input Validation which allows an attacker to inject executable code and can carry out attacks such as XSS, SQL Inje… |
CVE-2026-4874 | Low | 3.1 | 2026-03-26 | A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the `client_session_host` parameter duri… |
CVE-2026-4835 | Low | 3.5 | 2026-03-26 | A security vulnerability has been detected in code-projects Accounting System 1.0. Impacted is an unknown function of the file /my_account/add_costumer.php of… |
CVE-2026-4833 | Low | 3.3 | 2026-03-26 | A weakness has been identified in Orc discount up to 3.0.1.2. This issue affects the function compile of the file markdown.c of the component Markdown Handler… |
CVE-2026-4831 | Low | 3.7 | 2026-03-26 | A security flaw has been discovered in kalcaddle kodbox 1.64. Impacted is the function can of the file /workspace/source-code/app/controller/explorer/auth.clas… |
CVE-2026-4823 | Low | 2.5 | 2026-03-25 | A flaw has been found in Enter Software Iperius Backup up to 8.7.3. Affected by this vulnerability is an unknown functionality of the component NTLM2 Handler… |