Low-severity CVEs (page 23)
Page 23 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-62711 | Low | 3.1 | 2025-10-24 | Wasmtime is a runtime for WebAssembly. In versions from 38.0.0 to before 38.0.3, the implementation of component-model related host-to-wasm trampolines in Wasm… |
CVE-2025-10723 | Low | 2.7 | 2025-10-24 | The PixelYourSite WordPress plugin before 11.1.2 does not validate some URL parameters before using them to generate paths passed to function/s, allowing any… |
CVE-2025-41721 | Low | 2.7 | 2025-10-22 | A high privileged remote attacker can influence the parameters passed to the openssl command due to improper neutralization of special elements when adding a p… |
CVE-2025-62774 | Low | 3.1 | 2025-10-22 | On Mercku M6a devices through 2.1.0, the authentication system uses predictable session tokens based on timestamps. |
CVE-2025-62773 | Low | 2.4 | 2025-10-22 | Mercku M6a devices through 2.1.0 allow TELNET sessions via a router.telnet.enabled.update request by an administrator. |
CVE-2025-62772 | Low | 3.1 | 2025-10-22 | On Mercku M6a devices through 2.1.0, session tokens remain valid for at least months in some cases. |
CVE-2025-62480 | Low | 2.7 | 2025-10-21 | Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Naming Subsystem). The supported version that is affected is 8.8… |
CVE-2025-62479 | Low | 2.7 | 2025-10-21 | Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Block Storage). The supported version that is affected is 8.8. Ea… |
CVE-2025-61755 | Low | 3.7 | 2025-10-21 | Vulnerability in the Oracle GraalVM for JDK product of Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle GraalVM for JDK… |
CVE-2025-61749 | Low | 2.7 | 2025-10-21 | Vulnerability in the Unified Audit component of Oracle Database Server. Supported versions that are affected are 23.4-23.9. Easily exploitable vulnerability a… |
CVE-2025-61748 | Low | 3.7 | 2025-10-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported ver… |
CVE-2025-53051 | Low | 2.7 | 2025-10-21 | Vulnerability in the RDBMS Functional Index component of Oracle Database Server. Supported versions that are affected are 23.4-23.9. Easily exploitable vulner… |
CVE-2022-4981 | Low | 3.3 | 2025-10-21 | A vulnerability was detected in DCMTK up to 3.6.7. The impacted element is the function DcmQueryRetrieveConfig::readPeerList of the file /dcmqrcnf.cc of the co… |
CVE-2025-5496 | Low | 3.3 | 2025-10-21 | ZohoCorp ManageEngine Endpoint Central versions earlier than 11.4.2508.14, 11.4.2516.06, and 11.4.2518.01 are affected by an arbitrary file deletion vulnerabil… |
CVE-2025-57837 | Low | 2.9 | 2025-10-20 | Tileservice module is affected by information leak vulnerability, successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-11946 | Low | 3.5 | 2025-10-19 | A security flaw has been discovered in LogicalDOC Community Edition up to 9.2.1. This issue affects some unknown processing of the file /frontend.jsp of the co… |
CVE-2025-11945 | Low | 3.5 | 2025-10-19 | A vulnerability was identified in toeverything AFFiNE up to 0.24.1. This vulnerability affects unknown code of the component Avatar Upload Image Endpoint. Such… |
CVE-2025-62643 | Low | 3.4 | 2025-10-17 | The Restaurant Brands International (RBI) assistant platform through 2025-09-06 transmits passwords of user accounts in cleartext e-mail messages. |
CVE-2025-62505 | Low | 3.0 | 2025-10-17 | LobeChat is an open source chat application platform. The web-crawler package in LobeChat version 1.136.1 allows server-side request forgery (SSRF) in the tool… |
CVE-2025-60361 | Low | 3.3 | 2025-10-17 | radare2 v5.9.8 and before contains a memory leak in the function bochs_open. |
CVE-2025-62412 | Low | 3.8 | 2025-10-16 | LibreNMS is a community-based GPL-licensed network monitoring system. The alert rule name in the Alerts > Alert Rules page is not properly sanitized, and can… |
CVE-2025-61924 | Low | 3.8 | 2025-10-16 | PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. In versions prior to 4.4.1 and 5.0.5, the Target PayPal merchant acco… |
CVE-2025-11851 | Low | 3.5 | 2025-10-16 | A vulnerability has been found in Apeman ID71 EN75.8.53.20. The affected element is an unknown function of the file /set_alias.cgi. Such manipulation of the ar… |
CVE-2025-11840 | Low | 3.3 | 2025-10-16 | A weakness has been identified in GNU Binutils 2.45. The affected element is the function vfinfo of the file ldmisc.c. Executing a manipulation can lead to out… |
CVE-2025-11839 | Low | 3.3 | 2025-10-16 | A security flaw has been discovered in GNU Binutils 2.45. Impacted is the function tg_tag_type of the file prdbg.c. Performing a manipulation results in unchec… |
CVE-2025-54499 | Low | 3.1 | 2025-10-16 | Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to use constant-time comparison for sensitive string comparisons which allows attackers to explo… |
CVE-2025-10545 | Low | 3.1 | 2025-10-16 | Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when adding channel members which allows guest users… |
CVE-2025-62379 | Low | 3.1 | 2025-10-15 | Reflex is a library to build full-stack web apps in pure Python. In versions 0.5.4 through 0.8.14, the /auth-codespace endpoint automatically assigns the redir… |
CVE-2025-2529 | Low | 2.9 | 2025-10-15 | Applications using affected versions of Ehcache 3.x can experience degraded cache-write performance if the application using Ehcache utilizes keys sourced from… |
CVE-2025-6026 | Low | 3.1 | 2025-10-15 | An improper certificate validation vulnerability was reported in the Lenovo Universal Device Client (UDC) that could allow a user capable of intercepting netwo… |
CVE-2025-56746 | Low | 2.2 | 2025-10-15 | Creativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authentication, enabling session fixation attacks where attac… |
CVE-2025-59294 | Low | 2.1 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows Taskbar Live allows an unauthorized attacker to disclose information with a physical atta… |
CVE-2025-59284 | Low | 3.3 | 2025-10-14 | Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing locally. |
CVE-2025-59280 | Low | 3.1 | 2025-10-14 | Improper authentication in Windows SMB Client allows an unauthorized attacker to perform tampering over a network. |
CVE-2025-58903 | Low | 2.7 | 2025-10-14 | An Unchecked Return Value vulnerability [CWE-252] in Fortinet FortiOS version 7.6.0 through 7.6.3 and before 7.4.8 API allows an authenticated user to cause a… |
CVE-2025-47890 | Low | 2.6 | 2025-10-14 | An URL Redirection to Untrusted Site vulnerabilities [CWE-601] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2… |
CVE-2025-31514 | Low | 2.7 | 2025-10-14 | A insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS 7.2 all versions, F… |
CVE-2025-40773 | Low | 3.5 | 2025-10-14 | A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications contains a broken access control vulnerability. Th… |
CVE-2025-8594 | Low | 3.8 | 2025-10-14 | The Pz-LinkCard WordPress plugin before 2.5.7 does not validate a parameter before making a request to it, which could allow users with a role as low as Contri… |
CVE-2025-11731 | Low | 3.1 | 2025-10-14 | A flaw was found in the exsltFuncResultComp() function of libxslt, which handles EXSLT <func:result> elements during stylesheet parsing. Due to improper type h… |
CVE-2025-42909 | Low | 3.0 | 2025-10-14 | SAP Cloud Appliance Library Appliances allows an attacker with high privileges to leverage an insecure S/4HANA default profile setting in an existing SAP CAL a… |
CVE-2025-62178 | Low | 3.5 | 2025-10-13 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.1, a Reflected Cross-Site Scripting (XSS) vulnerab… |
CVE-2025-62174 | Low | 3.5 | 2025-10-13 | Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon before 4.4.6, 4.3.14, and 4.2.27, when an administrator resets a user… |
CVE-2025-58084 | Low | 3.5 | 2025-10-13 | Mattermost Desktop App versions <= 5.13.0 fail to validate URLs external to the configured Mattermost servers, allowing an attacker on a server the user has co… |
CVE-2025-31995 | Low | 3.5 | 2025-10-13 | HCL Unica MaxAI Workbench is vulnerable to improper input validation. This allows attackers to exploit vulnerabilities such as SQL Injection, XSS, or command… |
CVE-2025-11650 | Low | 1.8 | 2025-10-12 | A vulnerability was determined in Tomofun Furbo 360 and Furbo Mini. The impacted element is an unknown function of the file /etc/shadow of the component Passwo… |
CVE-2025-11647 | Low | 3.1 | 2025-10-12 | A flaw has been found in Tomofun Furbo 360 and Furbo Mini. This issue affects some unknown processing of the component GATT Service. This manipulation of the a… |
CVE-2025-11645 | Low | 2.4 | 2025-10-12 | A security vulnerability has been detected in Tomofun Furbo Mobile App up to 7.57.0a on Android. This affects an unknown part of the component Authentication T… |
CVE-2025-11644 | Low | 2.0 | 2025-10-12 | A weakness has been identified in Tomofun Furbo 360 and Furbo Mini. Affected by this issue is some unknown functionality of the component UART Interface. Execu… |
CVE-2025-11643 | Low | 3.7 | 2025-10-12 | A security flaw has been discovered in Tomofun Furbo 360 and Furbo Mini. Affected by this vulnerability is an unknown functionality of the file /squashfs-root/… |
CVE-2025-11641 | Low | 3.9 | 2025-10-12 | A vulnerability was determined in Tomofun Furbo 360 and Furbo Mini. This impacts an unknown function of the component Trial Restriction Handler. This manipulat… |
CVE-2025-11640 | Low | 3.1 | 2025-10-12 | A vulnerability was found in Tomofun Furbo 360 and Furbo Mini. This affects an unknown function of the component Bluetooth Low Energy. The manipulation results… |
CVE-2025-11639 | Low | 3.3 | 2025-10-12 | A vulnerability has been found in Tomofun Furbo 360 and Furbo Mini. The impacted element is an unknown function of the file collect_logs.sh of the component De… |
CVE-2025-2139 | Low | 3.5 | 2025-10-12 | IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete reviews from other users du… |
CVE-2025-2138 | Low | 3.5 | 2025-10-12 | IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete comments from other users… |
CVE-2025-11634 | Low | 2.4 | 2025-10-12 | A security flaw has been discovered in Tomofun Furbo 360 and Furbo Mini. This affects an unknown part of the component UART Interface. The manipulation results… |
CVE-2025-11633 | Low | 3.7 | 2025-10-12 | A vulnerability was identified in Tomofun Furbo 360 and Furbo Mini. Affected by this issue is the function upload_file_to_s3 of the file collect_logs.sh of the… |
CVE-2025-52615 | Low | 3.5 | 2025-10-12 | HCL Unica Platform is impacted by misconfigured security related HTTP headers. This can lead to less secure browser default treatment for the policies control… |
CVE-2025-52614 | Low | 3.5 | 2025-10-12 | HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability. A malicious agent may be able to induce this event by feeding a user suita… |
CVE-2025-31998 | Low | 3.5 | 2025-10-12 | HCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive information. An attacker can exploit use this inform… |
CVE-2025-31993 | Low | 3.5 | 2025-10-12 | HCL Unica Centralized Offer Management is vulnerable to a potential Server-Side Request Forgery (SSRF). An attacker can exploit improper input validation by su… |
CVE-2025-11609 | Low | 3.7 | 2025-10-11 | A flaw has been found in code-projects Hospital Management System 1.0. Affected is the function session of the component express-session. This manipulation of… |
CVE-2025-8606 | Low | 2.4 | 2025-10-11 | The GSheetConnector For Gravity Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions less than, or equal to, 1.3.23. This is due… |
CVE-2025-58292 | Low | 3.3 | 2025-10-11 | Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58291 | Low | 3.3 | 2025-10-11 | Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58290 | Low | 3.3 | 2025-10-11 | Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58286 | Low | 3.3 | 2025-10-11 | Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58282 | Low | 2.8 | 2025-10-11 | Permission control vulnerability in the camera module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-52635 | Low | 3.7 | 2025-10-10 | A rusted types in scripts not enforced in CSP vulnerability has been identified in HCL AION.This issue affects AION: 2.0. |
CVE-2025-52625 | Low | 3.7 | 2025-10-10 | A vulnerability Cacheable SSL Page Found vulnerability has been identified in HCL AION. Cached data may expose credentials, system identifiers, or intern… |
CVE-2025-52634 | Low | 3.7 | 2025-10-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION This issue affects HCL AION: 2.0. |
CVE-2025-52630 | Low | 3.7 | 2025-10-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION.This issue affects AION: 2.0. |
CVE-2025-52655 | Low | 3.1 | 2025-10-10 | Inclusion of Functionality from Untrusted Control Sphere vulnerability in HCL MyXalytics. v6.6 allows Loading third-party scripts without integrity checks or v… |
CVE-2025-21046 | Low | 2.4 | 2025-10-10 | Improper access control in WindowManager in Samsung DeX prior to SMR Oct-2025 Release 1 allows physical attackers to temporarily access to recent app list. |
CVE-2025-4614 | Low | 2.7 | 2025-10-09 | An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to view session tokens of users authentic… |
CVE-2025-11495 | Low | 3.3 | 2025-10-08 | A vulnerability was determined in GNU Binutils 2.45. The affected element is the function elf_x86_64_relocate_section of the file elf64-x86-64.c of the compone… |
CVE-2025-11494 | Low | 3.3 | 2025-10-08 | A vulnerability was found in GNU Binutils 2.45. Impacted is the function _bfd_x86_elf_late_size_sections of the file bfd/elfxx-x86.c of the component Linker. T… |
CVE-2025-11485 | Low | 2.4 | 2025-10-08 | A vulnerability was determined in SourceCodester Student Grades Management System 1.0. Affected is the function add_user of the file /admin.php of the componen… |
CVE-2025-11443 | Low | 3.7 | 2025-10-08 | A weakness has been identified in JhumanJ OpnForm up to 1.9.3. This affects an unknown function of the file /api/password/email of the component Forgotten Pass… |
CVE-2025-11441 | Low | 3.7 | 2025-10-08 | A vulnerability was identified in JhumanJ OpnForm up to 1.9.3. The affected element is an unknown function of the component HTTP Header Handler. The manipulati… |
CVE-2025-11437 | Low | 2.4 | 2025-10-08 | A flaw has been found in JhumanJ OpnForm up to 1.9.3. This affects an unknown part of the file /api/open/forms/ of the component Form Editor. This manipulation… |
CVE-2025-11433 | Low | 3.5 | 2025-10-08 | A security flaw has been discovered in itsourcecode Leave Management System 1.0. This impacts the function redirect of the file /module/employee/controller.php… |
CVE-2025-11425 | Low | 2.4 | 2025-10-08 | A vulnerability was identified in projectworlds Advanced Library Management System 1.0. Affected is an unknown function of the file /edit_admin.php. The manipu… |
CVE-2025-11421 | Low | 3.5 | 2025-10-08 | A flaw has been found in code-projects Voting System 1.0. The affected element is an unknown function of the file /admin/candidates_edit.php. This manipulation… |
CVE-2025-61786 | Low | 3.3 | 2025-10-08 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.stat` and `Deno.FsFile.prototype.statS… |
CVE-2025-61785 | Low | 3.3 | 2025-10-08 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.utime` and `Deno.FsFile.prototype.utim… |
CVE-2025-11414 | Low | 3.3 | 2025-10-07 | A vulnerability was determined in GNU Binutils 2.45. Affected by this vulnerability is the function get_link_hash_entry of the file bfd/elflink.c of the compon… |
CVE-2025-11413 | Low | 3.3 | 2025-10-07 | A vulnerability was found in GNU Binutils 2.45. Affected is the function elf_link_add_object_symbols of the file bfd/elflink.c of the component Linker. The man… |
CVE-2025-11412 | Low | 3.3 | 2025-10-07 | A vulnerability has been found in GNU Binutils 2.45. This impacts the function bfd_elf_gc_record_vtentry of the file bfd/elflink.c of the component Linker. The… |
CVE-2025-62187 | Low | 2.9 | 2025-10-07 | In Ankitects Anki before 25.02.6, crafted sound file references could cause files to be written to arbitrary locations on Windows and Linux (media file pathnam… |
CVE-2025-43910 | Low | 2.3 | 2025-10-07 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0… |
CVE-2025-61670 | Low | 3.3 | 2025-10-07 | Wasmtime is a runtime for WebAssembly. Wasmtime 37.0.0 and 37.0.1 have memory leaks in the C/C++ API when using bindings for the `anyref` or `externref` WebAss… |
CVE-2025-43909 | Low | 3.7 | 2025-10-07 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0… |
CVE-2022-50522 | Low | 3.3 | 2025-10-07 | In the Linux kernel, the following vulnerability has been resolved: mcb: mcb-parse: fix error handing in chameleon_parse_gdd() If mcb_device_register() retur… |
CVE-2025-59451 | Low | 3.5 | 2025-10-06 | The YoSmart YoLink application through 2025-10-02 has session tokens with unexpectedly long lifetimes. |
CVE-2025-59447 | Low | 2.2 | 2025-10-06 | The YoSmart YoLink Smart Hub device 0382 exposes a UART debug interface. An attacker with direct physical access can leverage this interface to read a boot log… |
CVE-2025-61985 | Low | 3.6 | 2025-10-06 | ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used. |
CVE-2025-61984 | Low | 3.6 | 2025-10-06 | ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution… |
CVE-2025-11333 | Low | 2.4 | 2025-10-06 | A vulnerability was identified in langleyfcu Online Banking System up to 57437e6400ce0ae240e692c24e6346b8d0c17d7a. This impacts an unknown function of the file… |
CVE-2025-11332 | Low | 3.5 | 2025-10-06 | A vulnerability was determined in CmsEasy up to 7.7.7. This affects an unknown function in the library lib/inc/view.php of the component URL Handler. Executing… |