Low-severity CVEs (page 25)
Page 25 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-28422 | Low | 2.2 | 2026-02-27 | Vim is an open source, command line text editor. Prior to version 9.2.0078, a stack-buffer-overflow occurs in `build_stl_str_hl()` when rendering a statusline… |
CVE-2026-22717 | Low | 2.7 | 2026-02-27 | Out-of-bound read vulnerability in VMware Workstation 25H1 and below on any platform allows an actor with non-administrative privileges on a guest VM to obtain… |
CVE-2025-12150 | Low | 3.1 | 2026-02-27 | A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register… |
CVE-2025-15567 | Low | 3.3 | 2026-02-27 | Insufficient protection mechanisms in the Health Module may lead to partial information disclosure. |
CVE-2026-3293 | Low | 3.3 | 2026-02-27 | A weakness has been identified in snowflakedb snowflake-jdbc up to 4.0.1. Impacted is the function SdkProxyRoutePlanner of the file src/main/java/net/snowflake… |
CVE-2026-3285 | Low | 3.3 | 2026-02-27 | A vulnerability was determined in berry-lang berry up to 1.1.0. The affected element is the function scan_string of the file src/be_lexer.c. This manipulation… |
CVE-2026-3284 | Low | 3.3 | 2026-02-27 | A vulnerability was found in libvips 8.19.0. Impacted is the function vips_extract_area_build of the file libvips/conversion/extract.c. The manipulation of the… |
CVE-2026-3283 | Low | 3.3 | 2026-02-27 | A vulnerability has been found in libvips 8.19.0. This issue affects the function vips_extract_band_build of the file libvips/conversion/extract.c. The manipul… |
CVE-2026-3282 | Low | 3.3 | 2026-02-27 | A flaw has been found in libvips 8.19.0. This vulnerability affects the function vips_unpremultiply_build of the file libvips/conversion/unpremultiply.c. Execu… |
CVE-2026-22877 | Low | 3.7 | 2026-02-27 | An arbitrary file-read vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling unauthenticated attackers to read arbitrary files on the system, a… |
CVE-2026-27838 | Low | 3.1 | 2026-02-26 | wger is a free, open-source workout and fitness manager. Five routine detail action endpoints check a cache before calling `self.get_object()`. In versions up… |
CVE-2026-28227 | Low | 2.7 | 2026-02-26 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, TL4 users can publish topics into staff-only categories v… |
CVE-2026-27153 | Low | 2.7 | 2026-02-26 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, moderators could export user Chat DMs via the CSV export… |
CVE-2026-27152 | Low | 3.8 | 2026-02-26 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, DM communication-preference bypass when adding members vi… |
CVE-2026-27151 | Low | 2.7 | 2026-02-26 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, the `move_posts` action only checked `can_move_posts?` on… |
CVE-2026-27150 | Low | 3.8 | 2026-02-26 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, missing `validate_before_create` authorization in Data Ex… |
CVE-2026-26979 | Low | 2.7 | 2026-02-26 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, TL4 users are able to close, archive and pin topics in pr… |
CVE-2026-26227 | Low | 3.7 | 2026-02-26 | VideoLAN VLC for Android prior to version 3.7.0 contains an authentication bypass in the Remote Access Server feature due to missing or insufficient rate limit… |
CVE-2026-23749 | Low | 2.9 | 2026-02-26 | Golioth Firmware SDK version 0.19.1 prior to 0.22.0, fixed in commit 0e788217, contain an out-of-bounds read due to improper null termination of a blockwise tr… |
CVE-2026-23748 | Low | 3.7 | 2026-02-26 | Golioth Firmware SDK version 0.10.0 prior to 0.22.0, fixed in commit d7f55b38, contain an out-of-bounds read in LightDB State string parsing. When processing a… |
CVE-2026-23747 | Low | 3.7 | 2026-02-26 | Golioth Firmware SDK version 0.10.0 prior to 0.22.0, fixed in commit 48f521b, contain a stack-based buffer overflow in Payload Utils. The golioth_payload_as_in… |
CVE-2026-3193 | Low | 3.1 | 2026-02-25 | A vulnerability was detected in Chia Blockchain 2.1.0. Impacted is an unknown function of the file /send_transaction. The manipulation results in cross-site re… |
CVE-2026-3189 | Low | 3.1 | 2026-02-25 | A weakness has been identified in feiyuchuixue sz-boot-parent up to 1.3.2-beta. This vulnerability affects unknown code of the file /api/admin/common/files/dow… |
CVE-2026-28196 | Low | 2.3 | 2026-02-25 | In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk |
CVE-2026-21725 | Low | 2.6 | 2026-02-25 | A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so. This requi… |
CVE-2025-67860 | Low | 3.8 | 2026-02-25 | A vulnerability has been identified in the NeuVector scanner where the scanner process accepts registry and controller credentials as command-line arguments, p… |
CVE-2026-3171 | Low | 3.5 | 2026-02-25 | A flaw has been found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected by this vulnerability is an unknown functiona… |
CVE-2026-3170 | Low | 2.4 | 2026-02-25 | A vulnerability was detected in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected is an unknown function of the file /pa… |
CVE-2026-3146 | Low | 3.3 | 2026-02-25 | A vulnerability has been found in libvips up to 8.18.0. The impacted element is the function vips_foreign_load_matrix_header of the file libvips/foreign/matrix… |
CVE-2026-27632 | Low | 2.6 | 2026-02-25 | Talishar is a fan-made Flesh and Blood project. Prior to commit 6be3871a14c192d1fb8146cdbc76f29f27c1cf48, the Talishar application lacks Cross-Site Request For… |
CVE-2026-23859 | Low | 2.7 | 2026-02-24 | Dell Wyse Management Suite, versions prior to WMS 5.5, contain a Client-Side Enforcement of Server-Side Security vulnerability. A high privileged attacker with… |
CVE-2025-15589 | Low | 3.8 | 2026-02-24 | A vulnerability was determined in MuYuCMS 2.7. Affected is the function delete_dir_file of the file application/admin/controller/Template.php of the component… |
CVE-2026-3050 | Low | 3.5 | 2026-02-24 | A flaw has been found in horilla-opensource horilla up to 1.0.2. Impacted is an unknown function of the file static/assets/js/global.js of the component Leads… |
CVE-2026-3041 | Low | 2.4 | 2026-02-23 | A security vulnerability has been detected in xingfuggz BaykeShop up to 1.3.20. Impacted is an unknown function of the file src/baykeshop/contrib/article/templ… |
CVE-2026-2974 | Low | 2.5 | 2026-02-23 | A vulnerability was identified in AliasVault App up to 0.25.3 on Android/iOS. This vulnerability affects unknown code of the file shared_prefs/aliasvault.xml o… |
CVE-2026-2972 | Low | 2.4 | 2026-02-23 | A vulnerability was determined in a466350665 Smart-SSO up to 2.1.1. This affects the function Save of the file smart-sso-server/src/main/java/openjoe/smart/sso… |
CVE-2026-2968 | Low | 3.7 | 2026-02-23 | A vulnerability was detected in Cesanta Mongoose up to 7.20. This impacts the function mg_chacha20_poly1305_decrypt of the file /src/tls_chacha20.c of the comp… |
CVE-2026-2967 | Low | 3.7 | 2026-02-23 | A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This affects the function getpeer of the file /src/net_builtin.c of the component TC… |
CVE-2026-2966 | Low | 3.7 | 2026-02-23 | A weakness has been identified in Cesanta Mongoose up to 7.20. The impacted element is the function mg_sendnsreq of the file /src/dns.c of the component DNS Tr… |
CVE-2026-2965 | Low | 2.4 | 2026-02-23 | A security flaw has been discovered in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.2.9. The affected element is an unknown function of the file /admin/SysModule/e… |
CVE-2026-2947 | Low | 3.5 | 2026-02-22 | A vulnerability was detected in rymcu forest up to 0.0.5. This affects the function updateUserInfo of the file - src/main/java/com/rymcu/forest/web/api/user/Us… |
CVE-2026-2946 | Low | 3.5 | 2026-02-22 | A security vulnerability has been detected in rymcu forest up to 0.0.5. Affected by this issue is the function XssUtils.replaceHtmlCode of the file src/main/ja… |
CVE-2026-2939 | Low | 2.4 | 2026-02-22 | A vulnerability was found in itsourcecode Student Management System 1.0. The impacted element is an unknown function of the file /add_student/ of the component… |
CVE-2026-2934 | Low | 2.4 | 2026-02-22 | A security vulnerability has been detected in YiFang CMS up to 2.0.5. This impacts the function update of the file app/db/admin/D_friendLinkGroup.php of the co… |
CVE-2026-2933 | Low | 2.4 | 2026-02-22 | A weakness has been identified in YiFang CMS up to 2.0.5. This affects the function update of the file app/db/admin/D_adManage.php of the component Extended Ma… |
CVE-2026-2932 | Low | 2.4 | 2026-02-22 | A security flaw has been discovered in YiFang CMS up to 2.0.5. The impacted element is the function update of the file app/db/admin/D_adPosition.php of the com… |
CVE-2026-2913 | Low | 2.5 | 2026-02-22 | A vulnerability was determined in libvips up to 8.19.0. The affected element is the function vips_source_read_to_memory of the file libvips/iofuncs/source.c. T… |
CVE-2026-2903 | Low | 3.3 | 2026-02-22 | A flaw has been found in skvadrik re2c up to 4.4. Impacted is the function check_and_merge_special_rules of the file src/parse/ast.cc. This manipulation causes… |
CVE-2026-2897 | Low | 2.4 | 2026-02-22 | A security vulnerability has been detected in funadmin up to 7.1.0-rc4. This vulnerability affects unknown code of the file app/backend/view/index/index.html o… |
CVE-2026-2895 | Low | 3.7 | 2026-02-21 | A security flaw has been discovered in funadmin up to 7.1.0-rc4. Affected by this issue is the function repass of the file app/frontend/controller/Member.php… |
CVE-2026-2889 | Low | 3.3 | 2026-02-21 | A vulnerability was detected in CCExtractor up to 0.96.5. Affected is the function processmp4 in the library src/lib_ccx/mp4.c. Performing a manipulation resul… |
CVE-2026-2887 | Low | 3.3 | 2026-02-21 | A security vulnerability has been detected in aardappel lobster up to 2025.4. This impacts the function lobster::TypeName in the library dev/src/lobster/idents… |
CVE-2026-2869 | Low | 3.3 | 2026-02-21 | A vulnerability was identified in janet-lang janet up to 1.40.1. Affected by this vulnerability is the function janetc_varset of the file src/core/specials.c o… |
CVE-2026-27467 | Low | 2.0 | 2026-02-21 | BigBlueButton is an open-source virtual classroom. In versions 3.0.19 and below, when first joining a session with the microphone muted, the client sends audio… |
CVE-2026-2858 | Low | 3.3 | 2026-02-20 | A vulnerability was identified in wren-lang wren up to 0.4.0. This affects the function peekChar of the file src/vm/wren_compiler.c of the component Source Fil… |
CVE-2025-15583 | Low | 3.5 | 2026-02-20 | A weakness has been identified in detronetdip E-commerce 1.0.0. This affects the function get_safe_value of the file utility/function.php. Executing a manipula… |
CVE-2026-22885 | Low | 3.7 | 2026-02-20 | A vulnerability exists in EnOcean SmartServer IoT version 4.60.009 and prior, which would allow remote attackers, in the LON IP-852 management messages, to s… |
CVE-2025-52603 | Low | 3.5 | 2026-02-20 | HCL Connections is vulnerable to information disclosure. In a very specific user navigation scenario, this could allow a user to obtain limited information wh… |
CVE-2026-2825 | Low | 3.5 | 2026-02-20 | A vulnerability has been found in rachelos WeRSS we-mp-rss up to 1.4.8. This impacts the function fix_html of the file tools/fix.py of the component Article Mo… |
CVE-2026-27007 | Low | 3.3 | 2026-02-20 | OpenClaw is a personal AI assistant. Prior to version 2026.2.15, `normalizeForHash` in `src/agents/sandbox/config-hash.ts` recursively sorted arrays that conta… |
CVE-2026-26964 | Low | 2.7 | 2026-02-20 | Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Versions 1.634.6 and below allow non-admin users to… |
CVE-2026-24122 | Low | 3.7 | 2026-02-19 | Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires bef… |
CVE-2026-25423 | Low | 3.8 | 2026-02-19 | Missing Authorization vulnerability in creativeinteractivemedia Real 3D FlipBook real3d-flipbook-lite allows Exploiting Incorrectly Configured Access Control S… |
CVE-2026-2733 | Low | 3.8 | 2026-02-19 | A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens continue to be issued even after a Docker registry client has been adm… |
CVE-2026-2709 | Low | 3.5 | 2026-02-19 | A flaw has been found in busy up to 2.5.5. The affected element is an unknown function of the file source-code/busy-master/src/server/app.js of the component C… |
CVE-2026-2703 | Low | 3.3 | 2026-02-19 | A weakness has been identified in xlnt-community xlnt up to 1.6.1. Impacted is the function xlnt::detail::decode_base64 of the file source/detail/cryptography/… |
CVE-2026-2702 | Low | 3.1 | 2026-02-19 | A security flaw has been discovered in Beetel 777VR1 up to 01.00.09. This issue affects some unknown processing of the component WPA2 PSK. Performing a manipul… |
CVE-2026-25120 | Low | 2.7 | 2026-02-19 | Gogs is an open source self-hosted Git service. In versions 0.13.4 and below, the DeleteComment API does not verify that the comment belongs to the repository… |
CVE-2026-24764 | Low | 3.7 | 2026-02-19 | OpenClaw (formerly Clawdbot) is a personal AI assistant users run on their own devices. In versions 2026.2.2 and below, when the Slack integration is enabled… |
CVE-2025-14270 | Low | 2.7 | 2026-02-19 | The OneClick Chat to Order plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.0.9. This is due to the plugin not pr… |
CVE-2025-8860 | Low | 3.3 | 2026-02-18 | A flaw was found in QEMU in the uefi-vars virtual device. When the guest writes to register UEFI_VARS_REG_BUFFER_SIZE, the .write callback `uefi_vars_write` is… |
CVE-2025-12343 | Low | 3.3 | 2026-02-18 | A flaw was found in FFmpeg’s TensorFlow backend within the libavfilter/dnn_backend_tf.c source file. The issue occurs in the dnn_execute_model_tf() function, w… |
CVE-2026-2662 | Low | 3.3 | 2026-02-18 | A weakness has been identified in FascinatedBox lily up to 2.3. This vulnerability affects the function count_transforms of the file src/lily_emitter.c. This m… |
CVE-2026-2661 | Low | 3.3 | 2026-02-18 | A security flaw has been discovered in Squirrel up to 3.2. This affects the function SQObjectPtr::operator in the library squirrel/sqobject.h. The manipulation… |
CVE-2026-2660 | Low | 3.3 | 2026-02-18 | A vulnerability was identified in FascinatedBox lily up to 2.3. Affected by this issue is the function shorthash_for_name of the file src/lily_symtab.c. The ma… |
CVE-2026-2659 | Low | 3.3 | 2026-02-18 | A vulnerability was determined in Squirrel up to 3.2. Affected by this vulnerability is the function SQFuncState::PopTarget of the file src/squirrel/squirrel/s… |
CVE-2026-20137 | Low | 3.5 | 2026-02-18 | In Splunk Enterprise versions below 10.2.0, 10.0.3, 9.4.5, 9.3.7, and 9.2.9, and Splunk Cloud Platform versions below 10.1.2507.0, 10.0.2503.9, 9.3.2411.112, a… |
CVE-2026-2657 | Low | 3.3 | 2026-02-18 | A vulnerability has been found in wren-lang wren up to 0.4.0. This impacts the function printError of the file src/vm/wren_compiler.c of the component Error Me… |
CVE-2026-2656 | Low | 2.5 | 2026-02-18 | A flaw has been found in ChaiScript up to 6.1.0. This affects the function chaiscript::Type_Info::bare_equal of the file include/chaiscript/dispatchkit/type_in… |
CVE-2026-2655 | Low | 2.5 | 2026-02-18 | A vulnerability was detected in ChaiScript up to 6.1.0. The impacted element is the function chaiscript::str_less::operator of the file include/chaiscript/chai… |
CVE-2026-1582 | Low | 3.7 | 2026-02-18 | The WP All Export plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.14 via the export download end… |
CVE-2026-2419 | Low | 2.7 | 2026-02-18 | The WP-DownloadManager plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.69 via the 'download_path' configuration pa… |
CVE-2026-1831 | Low | 2.7 | 2026-02-18 | The YayMail - WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized plugin installation and activation due to missing capability chec… |
CVE-2026-2644 | Low | 3.3 | 2026-02-18 | A weakness has been identified in niklasso minisat up to 2.2.0. This issue affects the function Solver::value in the library core/SolverTypes.h of the componen… |
CVE-2026-2642 | Low | 3.3 | 2026-02-18 | A security vulnerability has been detected in ggreer the_silver_searcher up to 2.2.0. The impacted element is the function search_stream of the file src/search… |
CVE-2026-2641 | Low | 3.3 | 2026-02-18 | A weakness has been identified in universal-ctags ctags up to 6.2.1. The affected element is the function parseExpression/parseExprList of the file parsers/v.c… |
CVE-2026-27171 | Low | 2.9 | 2026-02-18 | zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination… |
CVE-2025-36183 | Low | 3.8 | 2026-02-17 | IBM watsonx.data 2.2 through 2.2.1 IBM Lakehouse could allow a privileged user to upload malicious files that could be executed server to modify limited files… |
CVE-2026-2622 | Low | 3.5 | 2026-02-17 | A vulnerability was detected in Blossom up to 1.17.1. This vulnerability affects the function content of the file blossom-backend/backend/src/main/java/com/blo… |
CVE-2026-0102 | Low | 3.1 | 2026-02-17 | Under specific conditions, a malicious webpage may trigger autofill population after two consecutive taps, potentially without clear or intentional user consen… |
CVE-2026-24733 | Low | 3.7 | 2026-02-17 | Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured… |
CVE-2026-2618 | Low | 3.7 | 2026-02-17 | A vulnerability was determined in Beetel 777VR1 up to 01.00.09. This impacts an unknown function of the component SSH Service. This manipulation causes risky c… |
CVE-2024-55271 | Low | 3.5 | 2026-02-17 | A Cross-Site Request Forgery (CSRF) vulnerability has been identified in phpgurukul Gym Management System 1.0. This issue is present in the profile update func… |
CVE-2026-2557 | Low | 3.5 | 2026-02-16 | A vulnerability was detected in cskefu up to 8.0.1. Impacted is the function Upload of the file com/cskefu/cc/controller/resource/MediaController.java of the c… |
CVE-2025-14573 | Low | 3.8 | 2026-02-16 | Mattermost versions 10.11.x <= 10.11.9 fail to enforce invite permissions when updating team settings, which allows team administrators without proper permissi… |
CVE-2026-2547 | Low | 3.5 | 2026-02-16 | A vulnerability was detected in LigeroSmart up to 6.1.26. The impacted element is the function AgentDashboard of the file /otrs/index.pl. Performing a manipula… |
CVE-2026-2546 | Low | 3.5 | 2026-02-16 | A security vulnerability has been detected in LigeroSmart up to 6.1.26. The affected element is an unknown function of the file /otrs/index.pl. Such manipulati… |
CVE-2026-2545 | Low | 3.5 | 2026-02-16 | A weakness has been identified in LigeroSmart up to 6.1.26. Impacted is an unknown function of the file /otrs/index.pl?Action=AgentTicketSearch. This manipulat… |
CVE-2026-2543 | Low | 2.7 | 2026-02-16 | A vulnerability was identified in vichan-devel vichan up to 5.1.5. This vulnerability affects unknown code of the file inc/mod/pages.php of the component Passw… |
CVE-2026-20796 | Low | 3.1 | 2026-02-13 | Mattermost versions 10.11.x <= 10.11.9 fail to properly validate channel membership at the time of data retrieval which allows a deactivated user to learn team… |