Low-severity CVEs (page 23)
Page 23 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-20684 | Low | 3.3 | 2026-03-25 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.4. An app may bypass Gatekeeper checks. |
CVE-2026-33624 | Low | 2.7 | 2026-03-24 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.60 and 9.6.0-alpha.54, an attacke… |
CVE-2026-28753 | Low | 3.7 | 2026-03-24 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This… |
CVE-2026-4626 | Low | 3.5 | 2026-03-24 | A vulnerability has been found in projectworlds Lawyer Management System 1.0. This impacts an unknown function of the file /lawyer_booking.php. The manipulatio… |
CVE-2026-4616 | Low | 2.4 | 2026-03-24 | A security flaw has been discovered in bolo-blog up to 2.6.4. The affected element is an unknown function of the file /console/article/ of the component Articl… |
CVE-2026-4596 | Low | 3.5 | 2026-03-23 | A vulnerability was identified in projectworlds Lawyer Management System 1.0. This issue affects some unknown processing of the file /lawyers.php. The manipula… |
CVE-2026-4595 | Low | 2.4 | 2026-03-23 | A vulnerability was determined in code-projects Exam Form Submission 1.0. This vulnerability affects unknown code of the file /admin/update_s6.php. Executing a… |
CVE-2026-4590 | Low | 3.1 | 2026-03-23 | A security flaw has been discovered in kalcaddle kodbox 1.64. The impacted element is an unknown function of the file /workspace/source-code/plugins/oauth/cont… |
CVE-2026-4588 | Low | 3.7 | 2026-03-23 | A vulnerability was determined in kalcaddle kodbox 1.64. Impacted is the function shareSafeGroup of the file /workspace/source-code/app/controller/explorer/sha… |
CVE-2026-4587 | Low | 3.7 | 2026-03-23 | A vulnerability was found in HybridAuth up to 3.12.2. This issue affects some unknown processing of the file src/HttpClient/Curl.php of the component SSL Handl… |
CVE-2026-4584 | Low | 3.1 | 2026-03-23 | A flaw has been found in Shenzhen HCC Technology MPOS M6 PLUS 1V.31-N. This affects an unknown part of the component Cardholder Data Handler. Executing a manip… |
CVE-2026-4633 | Low | 3.7 | 2026-03-23 | A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizations are enabled. Th… |
CVE-2026-4578 | Low | 2.4 | 2026-03-23 | A vulnerability was determined in code-projects Exam Form Submission 1.0. The impacted element is an unknown function of the file /admin/update_s3.php. Executi… |
CVE-2026-4577 | Low | 2.4 | 2026-03-23 | A vulnerability was found in code-projects Exam Form Submission 1.0. The affected element is an unknown function of the file /admin/update_s4.php. Performing a… |
CVE-2026-4576 | Low | 2.4 | 2026-03-23 | A vulnerability has been found in code-projects Exam Form Submission 1.0. Impacted is an unknown function of the file /admin/update_s5.php. Such manipulation o… |
CVE-2026-4575 | Low | 2.4 | 2026-03-23 | A flaw has been found in code-projects Exam Form Submission 1.0. This issue affects some unknown processing of the file /admin/update_s2.php. This manipulation… |
CVE-2026-4549 | Low | 3.1 | 2026-03-22 | A flaw has been found in mickasmt next-saas-stripe-starter 1.0.0. Affected by this issue is the function openCustomerPortal of the file actions/open-customer-p… |
CVE-2026-4115 | Low | 3.7 | 2026-03-22 | A vulnerability was detected in PuTTY 0.83. Affected is the function eddsa_verify of the file crypto/ecc-ssh.c of the component Ed25519 Signature Handler. The… |
CVE-2026-4544 | Low | 2.4 | 2026-03-22 | A vulnerability was determined in Wavlink WL-WN578W2 221110. This affects an unknown function of the file /cgi-bin/login.cgi of the component POST Request Hand… |
CVE-2026-4541 | Low | 2.5 | 2026-03-22 | A flaw has been found in janmojzis tinyssh up to 20250501. Impacted is an unknown function of the file tinyssh/crypto_sign_ed25519_tinyssh.c of the component E… |
CVE-2026-4539 | Low | 3.3 | 2026-03-22 | A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manip… |
CVE-2026-33550 | Low | 2.0 | 2026-03-22 | SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended). |
CVE-2026-2290 | Low | 3.8 | 2026-03-21 | The Post Affiliate Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.28.0. This makes it possible f… |
CVE-2026-32897 | Low | 3.7 | 2026-03-21 | OpenClaw versions prior to 2026.2.22 reuse gateway.auth.token as a fallback hash secret for owner-ID prompt obfuscation when commands.ownerDisplay is set to ha… |
CVE-2026-32067 | Low | 3.7 | 2026-03-21 | OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability in the pairing-store access control for direct message pairing policy that a… |
CVE-2026-32058 | Low | 2.6 | 2026-03-21 | OpenClaw versions prior to 2026.2.26 contain an approval context-binding weakness in system.run execution flows with host=node that allows reuse of previously… |
CVE-2026-32050 | Low | 3.7 | 2026-03-21 | OpenClaw versions prior to 2026.2.25 contain an access control vulnerability in signal reaction notification handling that allows unauthorized senders to enque… |
CVE-2026-3339 | Low | 2.7 | 2026-03-21 | The Keep Backup Daily plugin for WordPress is vulnerable to Limited Path Traversal in all versions up to, and including, 2.1.1 via the `kbd_open_upload_dir` AJ… |
CVE-2026-33426 | Low | 3.5 | 2026-03-21 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, users with tag-editing permissions could edit and… |
CVE-2026-33422 | Low | 3.5 | 2026-03-20 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the `ip_address` of a flagged user is exposed to… |
CVE-2026-4495 | Low | 3.5 | 2026-03-20 | A security flaw has been discovered in atjiu pybbs 6.0.0. This impacts the function create of the file src/main/java/co/yiiu/pybbs/controller/api/CommentApiCon… |
CVE-2026-4494 | Low | 3.5 | 2026-03-20 | A vulnerability was identified in atjiu pybbs 6.0.0. This affects the function create of the file src/main/java/co/yiiu/pybbs/controller/api/TopicApiController… |
CVE-2026-4519 | Low | 3.3 | 2026-03-20 | The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior reject… |
CVE-2026-32595 | Low | 3.7 | 2026-03-20 | Traefik is an HTTP reverse proxy and load balancer. Versions 2.11.40 and below, 3.0.0-beta1 through 3.6.11, and 3.7.0-ea.1 comtain BasicAuth middleware that al… |
CVE-2026-33070 | Low | 3.7 | 2026-03-20 | FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.8.0, a missing-authentication vulnerability in the deleteShareLink endpoint… |
CVE-2026-4477 | Low | 3.1 | 2026-03-20 | A vulnerability was determined in Yi Technology YI Home Camera 2 2.1.1_20171024151200. This affects an unknown function of the component WPA/WPS. Executing a m… |
CVE-2026-4474 | Low | 2.4 | 2026-03-20 | A flaw has been found in itsourcecode University Management System 1.0. Impacted is an unknown function of the file /admin_single_student_update.php. This mani… |
CVE-2026-32946 | Low | 2.7 | 2026-03-20 | Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. In versions 2.15.1 and below, the Harden-Runner that allows bypass o… |
CVE-2026-30888 | Low | 2.2 | 2026-03-20 | Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 allow a moderator to edit site policy documents (T… |
CVE-2026-22735 | Low | 2.6 | 2026-03-20 | Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Foundation: from 7.0.0 t… |
CVE-2026-33408 | Low | 2.2 | 2026-03-19 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, moderators were able to see the first 40 characte… |
CVE-2026-29104 | Low | 2.7 | 2026-03-19 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, SuiteCRM contains… |
CVE-2026-4159 | Low | 3.3 | 2026-03-19 | 1-byte OOB heap read in wc_PKCS7_DecodeEnvelopedData via zero-length encrypted content. A vulnerability existed in wolfSSL 5.8.4 and earlier, where a 1-byte ou… |
CVE-2026-33394 | Low | 2.7 | 2026-03-19 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the Post Edits admin report (/admin/reports/post_… |
CVE-2026-32020 | Low | 3.3 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 contain a path traversal vulnerability in the static file handler that follows symbolic links, allowing out-of-root file r… |
CVE-2026-32018 | Low | 3.6 | 2026-03-19 | OpenClaw versions prior to 2026.2.19 contain a race condition vulnerability in concurrent updateRegistry and removeRegistryEntry operations for sandbox contain… |
CVE-2026-32006 | Low | 3.1 | 2026-03-19 | OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where DM pairing-store identities are incorrectly treated as group allowlist… |
CVE-2026-3230 | Low | 2.7 | 2026-03-19 | Missing required cryptographic step in the TLS 1.3 client HelloRetryRequest handshake logic in wolfSSL could lead to a compromise in the confidentiality of TLS… |
CVE-2026-31991 | Low | 3.7 | 2026-03-19 | OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where Signal group allowlist policy incorrectly accepts sender identities fr… |
CVE-2026-32943 | Low | 3.1 | 2026-03-18 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.28 and 8.6.48, the password reset… |
CVE-2026-32722 | Low | 3.6 | 2026-03-18 | Memray is a memory profiler for Python. Prior to Memray 1.19.2, Memray rendered the command line of the tracked process directly into generated HTML reports wi… |
CVE-2026-32638 | Low | 2.7 | 2026-03-18 | StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.4, the REST API `getUsers` endpoint in StudioCMS uses the a… |
CVE-2026-4356 | Low | 2.4 | 2026-03-18 | A flaw has been found in itsourcecode University Management System 1.0. Affected is an unknown function of the file /add_result.php. Executing a manipulation o… |
CVE-2026-4355 | Low | 3.5 | 2026-03-18 | A vulnerability was detected in Portabilis i-Educar 2.11. This impacts an unknown function of the file /intranet/educar_servidor_curso_lst.php of the component… |
CVE-2026-4354 | Low | 3.5 | 2026-03-18 | A vulnerability was identified in TRENDnet TEW-824DRU 1.010B01/1.04B01. The impacted element is the function sub_420A78 of the file apply_sec.cgi of the compon… |
CVE-2026-4359 | Low | 2.0 | 2026-03-17 | A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C… |
CVE-2026-32293 | Low | 3.7 | 2026-03-17 | The GL-iNet Comet (GL-RM1) KVM connects to a GL-iNet site during boot-up to provision client and CA certificates. The GL-RM1 does not verify certificates used… |
CVE-2025-31966 | Low | 2.7 | 2026-03-17 | HCL Sametime is vulnerable to broken server-side validation. While the application performs client-side input checks, these are not enforced by the web server… |
CVE-2026-3634 | Low | 3.9 | 2026-03-17 | A flaw was found in libsoup. An attacker controlling the value used to set the Content-Type header can inject a Carriage Return Line Feed (CRLF) sequence due t… |
CVE-2026-3633 | Low | 3.9 | 2026-03-17 | A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and ad… |
CVE-2026-3632 | Low | 3.9 | 2026-03-17 | A flaw was found in libsoup, a library used by applications to send network requests. This vulnerability occurs because libsoup does not properly validate host… |
CVE-2026-4285 | Low | 2.7 | 2026-03-17 | A vulnerability was identified in taoofagi easegen-admin up to 8f87936ac774065b92fb20aab55b274a6ea76433. Impacted is the function recognizeMarkdown of the file… |
CVE-2026-26230 | Low | 3.8 | 2026-03-16 | Mattermost versions 10.11.x <= 10.11.10 fail to properly validate permission requirements in the team member roles API endpoint which allows team administrator… |
CVE-2026-4251 | Low | 2.5 | 2026-03-16 | A vulnerability was determined in CityData CityChat up to 0.12.6 on Android. Affected by this vulnerability is an unknown functionality of the file resources/a… |
CVE-2026-4250 | Low | 2.5 | 2026-03-16 | A vulnerability was found in Albert Sağlık Hizmetleri ve Ticaret Albert Health up to 1.7.3 on Android. Affected is an unknown function of the file resources/as… |
CVE-2026-4243 | Low | 2.5 | 2026-03-16 | A weakness has been identified in La Nacion App 10.2.25 on Android. This impacts an unknown function of the file source/app/lanacion/clublanacion/BuildConfig.j… |
CVE-2026-4242 | Low | 2.5 | 2026-03-16 | A security flaw has been discovered in BabyChakra Pregnancy & Parenting App up to 5.4.3.0 on Android. This affects an unknown function of the file file app/bab… |
CVE-2026-22545 | Low | 3.1 | 2026-03-16 | Mattermost versions 10.11.x <= 10.11.10 fail to validate user's authentication method when processing account auth type switch which allows an authenticated at… |
CVE-2025-52649 | Low | 1.8 | 2026-03-16 | HCL AION is affected by a vulnerability where certain identifiers may be predictable in nature. Predictable identifiers may allow an attacker to infer or guess… |
CVE-2025-52646 | Low | 2.2 | 2026-03-16 | HCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries. Improper validation or r… |
CVE-2025-52645 | Low | 1.9 | 2026-03-16 | HCL AION is affected by a vulnerability where model packaging and distribution mechanisms may not include sufficient authenticity verification. This may allow… |
CVE-2025-52642 | Low | 3.3 | 2026-03-16 | HCL AION is affected by a vulnerability where internal filesystem paths may be exposed through application responses or system behaviour. Exposure of internal… |
CVE-2025-52636 | Low | 1.8 | 2026-03-16 | HCL AION is affected by a vulnerability related to the handling of upload size limits. Improper control or validation of upload sizes may allow excessive resou… |
CVE-2026-4239 | Low | 3.5 | 2026-03-16 | A vulnerability was found in Lagom WHMCS Template up to 2.3.7. Impacted is an unknown function of the component Datatables. The manipulation results in imprope… |
CVE-2026-4225 | Low | 2.4 | 2026-03-16 | A security flaw has been discovered in CMS Made Simple up to 2.2.21. Impacted is an unknown function of the file admin/listusers.php of the component User Mana… |
CVE-2026-4222 | Low | 3.8 | 2026-03-16 | A vulnerability was determined in SSCMS up to 7.4.0. This vulnerability affects the function PathUtils.RemoveParentPath of the file /api/admin/plugins/install/… |
CVE-2026-4219 | Low | 3.3 | 2026-03-16 | A flaw has been found in INDEX Conferences & Exhibitions Organization YWF BPOF APGCS App up to 1.0.2 on Android. Affected by this vulnerability is an unknown f… |
CVE-2026-4218 | Low | 2.5 | 2026-03-16 | A vulnerability was detected in myAEDES App up to 1.18.4 on Android. Affected is an unknown function of the file aedes/me/beta/utils/EngageBayUtils.java of the… |
CVE-2026-4217 | Low | 2.5 | 2026-03-16 | A security vulnerability has been detected in XREAL Nebula App up to 3.2.1 on Android. This impacts an unknown function of the file in ai/nreal/nebula/flutterP… |
CVE-2026-4186 | Low | 3.5 | 2026-03-16 | A vulnerability was determined in UEditor up to 1.4.3.2. This issue affects some unknown processing of the file php/controller.php?action=uploadimage of the co… |
CVE-2026-4175 | Low | 3.5 | 2026-03-16 | A vulnerability was determined in Aureus ERP up to 1.3.0-BETA2. The affected element is an unknown function of the file plugins/webkul/chatter/resources/views/… |
CVE-2026-4174 | Low | 3.3 | 2026-03-16 | A vulnerability has been found in Radare2 5.9.9. This issue affects the function walk_exports_trie of the file libr/bin/format/mach0/mach0.c of the component M… |
CVE-2026-4169 | Low | 2.4 | 2026-03-16 | A security flaw has been discovered in Tecnick TCExam up to 16.6.0. Affected is the function F_xml_export_users of the file admin/code/tce_xml_users.php of the… |
CVE-2026-4168 | Low | 2.4 | 2026-03-16 | A vulnerability was identified in Tecnick TCExam 16.5.0. This impacts an unknown function of the file /admin/code/tce_edit_group.php of the component Group Han… |
CVE-2026-4166 | Low | 3.5 | 2026-03-16 | A vulnerability was found in Wavlink WL-NU516U1 240425. The impacted element is the function sub_404F68 of the file /cgi-bin/login.cgi. The manipulation of the… |
CVE-2026-4165 | Low | 2.4 | 2026-03-16 | A vulnerability has been found in Worksuite HR, CRM and Project Management up to 5.5.25. The affected element is an unknown function of the file /account/order… |
CVE-2026-32778 | Low | 2.9 | 2026-03-16 | libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition. |
CVE-2026-32772 | Low | 3.4 | 2026-03-16 | telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON SEND USERVAR. |
CVE-2026-32717 | Low | 2.7 | 2026-03-16 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, in multi-use… |
CVE-2026-32715 | Low | 3.8 | 2026-03-16 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, The two gene… |
CVE-2026-20992 | Low | 3.3 | 2026-03-16 | Improper authorization in Settings prior to SMR Mar-2026 Release 1 allows local attacker to disable configuring the background data usage of application. |
CVE-2026-20989 | Low | 2.4 | 2026-03-16 | Improper verification of cryptographic signature in Font Settings prior to SMR Mar-2026 Release 1 allows physical attackers to use custom font. |
CVE-2026-0849 | Low | 3.8 | 2026-03-16 | Malformed ATAES132A responses with an oversized length field overflow a 52-byte stack buffer in the Zephyr crypto driver, allowing a compromised device or bus… |
CVE-2026-0639 | Low | 3.3 | 2026-03-16 | in OpenHarmony v6.0 and prior versions allow a local attacker case DOS through missing release of memory. |
CVE-2025-71264 | Low | 3.7 | 2026-03-16 | Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service (client crash). |
CVE-2025-69239 | Low | 2.7 | 2026-03-16 | Raytha CMS is vulnerable to Server-Side Request Forgery in the “Themes - Import from URL” feature. It allows an attacker with high privileges to provide the UR… |
CVE-2025-26474 | Low | 3.3 | 2026-03-16 | in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information improper input. This vulnerability can be exploited only in restricted scenar… |
CVE-2025-13459 | Low | 2.7 | 2026-03-16 | IBM Aspera Console 3.3.0 through 3.4.8 could allow a privileged user to cause a denial of service due to improper enforcement of behavioral workflow. |
CVE-2026-32445 | Low | 2.7 | 2026-03-13 | Missing Authorization vulnerability in Elementor Elementor Website Builder elementor allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2026-29776 | Low | 3.1 | 2026-03-13 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Cor… |