Low-severity CVEs (page 26)
Page 26 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-2391 | Low | 3.7 | 2026-02-12 | ### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-… |
CVE-2026-20681 | Low | 3.3 | 2026-02-11 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Tahoe 26.3. An app may be able to access infor… |
CVE-2026-20671 | Low | 3.1 | 2026-02-11 | A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS So… |
CVE-2026-20663 | Low | 3.3 | 2026-02-11 | The issue was resolved by sanitizing logging. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3. An app may be able to enumerate a… |
CVE-2026-20656 | Low | 3.3 | 2026-02-11 | A logic issue was addressed with improved validation. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, macOS Tahoe 26.3. An app may be able to… |
CVE-2026-20646 | Low | 3.3 | 2026-02-11 | A logging issue was addressed with improved data redaction. This issue is fixed in macOS Tahoe 26.3. A malicious app may be able to read sensitive location inf… |
CVE-2026-20642 | Low | 2.4 | 2026-02-11 | An input validation issue was addressed. This issue is fixed in iOS 26.3 and iPadOS 26.3. A person with physical access to an iOS device may be able to access… |
CVE-2026-20601 | Low | 3.3 | 2026-02-11 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.3. An app may be able to monitor keystrokes without user… |
CVE-2025-69873 | Low | 2.9 | 2026-02-11 | ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern k… |
CVE-2026-2345 | Low | 3.6 | 2026-02-11 | Proctorio Chrome Extension is a browser extension used for online proctoring. The extension contains multiple window.addEventListener('message', ...) handlers… |
CVE-2026-1282 | Low | 3.5 | 2026-02-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allow… |
CVE-2025-14594 | Low | 3.5 | 2026-02-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain… |
CVE-2025-14592 | Low | 3.7 | 2026-02-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain c… |
CVE-2026-26013 | Low | 3.7 | 2026-02-10 | LangChain is a framework for building agents and LLM-powered applications. Prior to 1.2.11, the ChatOpenAI.get_num_tokens_from_messages() method fetches arbitr… |
CVE-2026-1762 | Low | 2.9 | 2026-02-10 | A vulnerability in GE Vernova Enervista UR Setup on Windows allows File Manipulation.This issue affects Enervista: 8.6 and prior versions. |
CVE-2026-21249 | Low | 3.3 | 2026-02-10 | External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing locally. |
CVE-2025-33030 | Low | 3.3 | 2026-02-10 | Improper conditions check in some firmware for some Intel(R) NPU Drivers within Ring 3: User Applications may allow an escalation of privilege. Unprivileged so… |
CVE-2025-32739 | Low | 2.8 | 2026-02-10 | Improper conditions check in some firmware for some Intel(R) Graphics Drivers and Intel LTS kernels within Ring 1: Device Drivers may allow a denial of service… |
CVE-2025-31648 | Low | 3.9 | 2026-02-10 | Improper handling of values in the microcode flow for some Intel(R) Processor Family may allow an escalation of privilege. Startup code and smm adversary with… |
CVE-2025-25058 | Low | 3.3 | 2026-02-10 | Improper initialization for some ESXi kernel mode driver for the Intel(R) Ethernet 800-Series before version 2.2.2.0 (esxi 8.0) & 2.2.3.0 (esxi 9.0) within… |
CVE-2025-15572 | Low | 3.3 | 2026-02-10 | A vulnerability has been found in wasm3 up to 0.5.0. The affected element is the function NewCodePage. The manipulation leads to memory leak. The attack must b… |
CVE-2025-15571 | Low | 3.3 | 2026-02-10 | A security vulnerability has been detected in ckolivas lrzip up to 0.651. This vulnerability affects the function ucompthread of the file stream.c. Such manipu… |
CVE-2026-23901 | Low | 2.5 | 2026-02-10 | Observable Timing Discrepancy vulnerability in Apache Shiro. This issue affects Apache Shiro: from 1.*, 2.* before 2.0.7. Users are recommended to upgrade to… |
CVE-2026-2259 | Low | 3.3 | 2026-02-10 | A vulnerability has been found in aardappel lobster up to 2025.4. Affected by this issue is the function lobster::Parser::ParseStatements in the library dev/sr… |
CVE-2026-24320 | Low | 3.1 | 2026-02-10 | Due to improper memory management in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker could exploit logical errors in memor… |
CVE-2026-23686 | Low | 3.4 | 2026-02-10 | Due to a CRLF Injection vulnerability in SAP NetWeaver Application Server Java, an authenticated attacker with administrative access could submit specially cra… |
CVE-2026-2258 | Low | 3.3 | 2026-02-10 | A flaw has been found in aardappel lobster up to 2025.4. Affected by this vulnerability is the function WaveFunctionCollapse in the library dev/src/lobster/wfc… |
CVE-2026-2246 | Low | 3.3 | 2026-02-09 | A security vulnerability has been detected in AprilRobotics apriltag up to 3.4.5. Affected by this vulnerability is the function apriltag_detector_detect of th… |
CVE-2026-2245 | Low | 3.3 | 2026-02-09 | A vulnerability was identified in CCExtractor up to 183. This affects the function parse_PAT/parse_PMT in the library src/lib_ccx/ts_tables.c of the component… |
CVE-2026-2242 | Low | 3.3 | 2026-02-09 | A vulnerability was determined in janet-lang janet up to 1.40.1. This impacts the function janetc_if of the file src/core/specials.c. Executing a manipulation… |
CVE-2026-2241 | Low | 3.3 | 2026-02-09 | A vulnerability was found in janet-lang janet up to 1.40.1. This affects the function os_strftime of the file src/core/os.c. Performing a manipulation results… |
CVE-2026-2240 | Low | 3.3 | 2026-02-09 | A vulnerability has been found in janet-lang janet up to 1.40.1. The impacted element is the function janetc_pop_funcdef of the file src/core/compile.c. Such m… |
CVE-2026-2224 | Low | 3.5 | 2026-02-09 | A vulnerability was detected in code-projects Online Reviewer System 1.0. This affects an unknown part of the file /system/system/admins/manage/users/btn_funct… |
CVE-2026-2222 | Low | 2.4 | 2026-02-09 | A weakness has been identified in code-projects Online Reviewer System 1.0. Affected by this vulnerability is an unknown functionality of the file /system/syst… |
CVE-2026-2215 | Low | 3.7 | 2026-02-09 | A vulnerability was detected in rachelos WeRSS we-mp-rss up to 1.4.8. This issue affects some unknown processing of the file core/auth.py of the component JWT… |
CVE-2026-2214 | Low | 2.4 | 2026-02-09 | A weakness has been identified in code-projects for Plugin 1.0. This affects an unknown part of the file /Administrator/PHP/AdminAddAlbum.php. This manipulatio… |
CVE-2026-2201 | Low | 2.4 | 2026-02-09 | A security vulnerability has been detected in ZeroWdd studentmanager up to 2151560fc0a50ec00426785ec1e01a3763b380d9. This impacts the function addLeave of the… |
CVE-2026-2200 | Low | 2.4 | 2026-02-09 | A weakness has been identified in heyewei JFinalCMS 5.0.0. This affects an unknown function of the file /admin/admin/save of the component API Endpoint. Execut… |
CVE-2026-2156 | Low | 2.4 | 2026-02-08 | A weakness has been identified in code-projects Online Student Management System 1.0. The impacted element is an unknown function of the file /admin/announceme… |
CVE-2026-2145 | Low | 3.5 | 2026-02-08 | A vulnerability was identified in cym1102 nginxWebUI up to 4.3.7. The impacted element is an unknown function of the file /adminPage/conf/check of the componen… |
CVE-2025-15564 | Low | 3.3 | 2026-02-07 | A vulnerability has been found in Mapnik up to 4.2.0. This vulnerability affects the function mapnik::detail::mod<...>::operator of the file src/value.cpp. The… |
CVE-2026-2110 | Low | 3.7 | 2026-02-07 | A security flaw has been discovered in Tasin1025 SwiftBuy up to 0f5011372e8d1d7edfd642d57d721c9fadc54ec7. Affected by this vulnerability is an unknown function… |
CVE-2026-2069 | Low | 3.3 | 2026-02-06 | A flaw has been found in ggml-org llama.cpp up to 55abc39. Impacted is the function llama_grammar_advance_stack of the file llama.cpp/src/llama-grammar.cpp of… |
CVE-2026-25764 | Low | 3.5 | 2026-02-06 | OpenProject is an open-source, web-based project management software. Prior to versions 16.6.7 and 17.0.3, an HTML injection vulnerability occurs in the time t… |
CVE-2026-2064 | Low | 3.5 | 2026-02-06 | A vulnerability was identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/meusdadod.ph… |
CVE-2025-15320 | Low | 3.3 | 2026-02-06 | Tanium addressed a denial of service vulnerability in Tanium Client. |
CVE-2026-23739 | Low | 2.0 | 2026-02-06 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, the ast_xml_open(… |
CVE-2026-23738 | Low | 3.5 | 2026-02-06 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, user supplied/con… |
CVE-2026-1998 | Low | 3.3 | 2026-02-06 | A flaw has been found in micropython up to 1.27.0. This vulnerability affects the function mp_import_all of the file py/runtime.c. This manipulation causes mem… |
CVE-2026-1991 | Low | 3.3 | 2026-02-06 | A vulnerability was detected in libuvc up to 0.0.7. Affected is the function uvc_scan_streaming of the file src/device.c of the component UVC Descriptor Handle… |
CVE-2026-1990 | Low | 3.3 | 2026-02-06 | A security vulnerability has been detected in oatpp up to 1.3.1. This impacts the function oatpp::data::type::ObjectWrapper::ObjectWrapper of the file src/oatp… |
CVE-2026-1971 | Low | 2.4 | 2026-02-06 | A vulnerability has been found in Edimax BR-6288ACL up to 1.12. Impacted is the function wiz_WISP24gmanual of the file wiz_WISP24gmanual.asp. Such manipulation… |
CVE-2025-68458 | Low | 3.7 | 2026-02-05 | Webpack is a module bundler. From version 5.49.0 to before 5.104.1, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) can be by… |
CVE-2025-68157 | Low | 3.7 | 2026-02-05 | Webpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces… |
CVE-2026-25815 | Low | 3.2 | 2026-02-05 | Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials stored in device configuration files, as exploited in the wild from 2025-12-16 thro… |
CVE-2026-1970 | Low | 3.5 | 2026-02-05 | A flaw has been found in Edimax BR-6258n up to 1.18. This issue affects the function formStaDrvSetup of the file /goform/formStaDrvSetup. This manipulation of… |
CVE-2025-15323 | Low | 3.7 | 2026-02-05 | Tanium addressed an improper certificate validation vulnerability in Tanium Appliance. |
CVE-2025-15321 | Low | 2.7 | 2026-02-05 | Tanium addressed an improper input validation vulnerability in Tanium Appliance. |
CVE-2025-15289 | Low | 3.1 | 2026-02-05 | Tanium addressed an improper access controls vulnerability in Interact. |
CVE-2020-37148 | Low | 3.5 | 2026-02-05 | P5 FNIP-8x16A/FNIP-4xSH versions 1.0.20 and 1.0.11 suffer from a stored cross-site scripting vulnerability. Input passed to several GET/POST parameters is not… |
CVE-2020-37118 | Low | 3.5 | 2026-02-05 | P5 FNIP-8x16A FNIP-4xSH 1.0.20 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user interac… |
CVE-2025-22873 | Low | 3.8 | 2026-02-04 | It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the par… |
CVE-2026-25517 | Low | 2.7 | 2026-02-04 | Wagtail is an open source content management system built on Django. Prior to versions 6.3.6, 7.0.4, 7.1.3, 7.2.2, and 7.3, due to a missing permission check o… |
CVE-2025-2134 | Low | 3.5 | 2026-02-04 | IBM Jazz Reporting Service could allow an authenticated user on the network to affect the system's performance using complicated queries due to insufficient re… |
CVE-2025-27550 | Low | 3.5 | 2026-02-04 | IBM Jazz Reporting Service could allow an authenticated user on the host network to obtain sensitive information about other projects that reside on the server. |
CVE-2025-1823 | Low | 3.5 | 2026-02-04 | IBM Jazz Reporting Service could allow an authenticated user on the host network to cause a denial of service using specially crafted SQL query that consumes e… |
CVE-2026-20732 | Low | 3.1 | 2026-02-04 | A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages. Note: Software versions which h… |
CVE-2026-20730 | Low | 3.3 | 2026-02-04 | A vulnerability exists in BIG-IP Edge Client and browser VPN clients on Windows that may allow attackers to gain access to sensitive information. Note: Softwa… |
CVE-2026-1791 | Low | 2.7 | 2026-02-04 | Unrestricted Upload of File with Dangerous Type vulnerability in Hillstone Networks Operation and Maintenance Security Gateway on Linux allows Upload a Web She… |
CVE-2026-24513 | Low | 3.1 | 2026-02-03 | A security issue was discovered in ingress-nginx where the protection afforded by the `auth-url` Ingress annotation may not be effective in the presence of a s… |
CVE-2025-33081 | Low | 3.3 | 2026-02-03 | IBM Concert 1.0.0 through 2.1.0 stores potentially sensitive information in log files that could be read by a local user. |
CVE-2026-25224 | Low | 3.7 | 2026-02-03 | Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.3, a denial-of-service vulnerability in Fastify’s Web Streams response hand… |
CVE-2025-52633 | Low | 3.1 | 2026-02-03 | HCL AION is affected by a Permanent Cookie Containing Sensitive Session Information vulnerability. It is storing sensitive session data in persistent cookies m… |
CVE-2025-52631 | Low | 3.7 | 2026-02-03 | HCL AION is affected by a Missing or Insecure HTTP Strict-Transport-Security (HSTS) Header vulnerability. This can allow insecure connections, potentially expo… |
CVE-2025-52623 | Low | 3.7 | 2026-02-03 | HCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerability. This can allow autocomplete on password fields may lead… |
CVE-2025-52629 | Low | 3.7 | 2026-02-03 | HCL AION is susceptible to Missing Content-Security-Policy. An The absence of a CSP header may increase the risk of cross-site scripting and other content in… |
CVE-2025-67852 | Low | 3.5 | 2026-02-03 | A flaw was found in Moodle. An open redirect vulnerability in the OAuth login flow allows a remote attacker to redirect users to attacker-controlled pages afte… |
CVE-2025-58381 | Low | 2.3 | 2026-02-03 | A vulnerability in Brocade Fabric OS before 9.2.1c2 could allow an authenticated attacker with admin privileges using the shell commands “source, ping6, sle… |
CVE-2025-58380 | Low | 2.3 | 2026-02-03 | A vulnerability in Brocade Fabric OS before 9.2.1 could allow an authenticated attacker with admin privileges using the shell command “grep” to modify the path… |
CVE-2026-24934 | Low | 3.7 | 2026-02-03 | The DDNS function uses an insecure HTTP connection or fails to validate the SSL/TLS certificate when querying an external server for the device's WAN IP addres… |
CVE-2025-61634 | Low | 3.1 | 2026-02-03 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Rest/Handler/PageHTMLHandler.Php. This issue aff… |
CVE-2025-36194 | Low | 2.8 | 2026-02-02 | IBM PowerVM Hypervisor FW1110.00 through FW1110.03, FW1060.00 through FW1060.51, and FW950.00 through FW950.F0 may expose a limited amount of data to a peer pa… |
CVE-2026-1751 | Low | 3.1 | 2026-02-02 | A vulnerability has been discovered in GitLab CE/EE affecting all versions starting with 16.8 before 18.5.0 that could have allowed unauthorized edits to merge… |
CVE-2025-13881 | Low | 2.7 | 2026-02-02 | A flaw was found in Keycloak Admin API. This vulnerability allows an administrator with limited privileges to retrieve sensitive custom attributes via the /unm… |
CVE-2026-1744 | Low | 2.4 | 2026-02-02 | A vulnerability was found in D-Link DSL-6641K N8.TR069.20131126. Affected by this issue is the function doSubmitPPP of the file sp_pppoe_user.js. The manipulat… |
CVE-2026-1743 | Low | 3.1 | 2026-02-02 | A vulnerability has been found in DJI Mavic Mini, Air, Spark and Mini SE up to 01.00.0500. Affected by this vulnerability is an unknown functionality of the co… |
CVE-2026-1705 | Low | 2.4 | 2026-01-30 | A vulnerability was detected in D-Link DSL-6641K N8.TR069.20131126. Affected by this issue is the function ad_virtual_server_vdsl of the component Web Interfac… |
CVE-2026-1700 | Low | 3.5 | 2026-01-30 | A weakness has been identified in projectworlds House Rental and Property Listing 1.0. This vulnerability affects unknown code of the file /app/sms.php. This m… |
CVE-2026-1685 | Low | 3.7 | 2026-01-30 | A vulnerability was identified in D-Link DIR-823X 250416. This vulnerability affects the function sub_40AC74 of the component Login. Such manipulation leads to… |
CVE-2026-25211 | Low | 3.2 | 2026-01-30 | Llama Stack (aka llama-stack) before 0.4.0rc3 does not censor the pgvector password in the initialization log. |
CVE-2026-25046 | Low | 2.9 | 2026-01-29 | Kimi Agent SDK is a set of libraries that expose the Kimi Code (Kimi CLI) agent runtime in applications. The vsix-publish.js and ovsx-publish.js scripts pass f… |
CVE-2025-15288 | Low | 3.1 | 2026-01-29 | Tanium addressed an improper access controls vulnerability in Interact. |
CVE-2026-1598 | Low | 3.5 | 2026-01-29 | A vulnerability was found in Bdtask Bhojon All-In-One Restaurant Management System up to 20260116. Impacted is an unknown function of the file /dashboard/home/… |
CVE-2026-1588 | Low | 2.7 | 2026-01-29 | A vulnerability was found in jishenghua jshERP up to 3.6. The impacted element is the function install of the file /jshERP-boot/plugin/installByPath of the com… |
CVE-2025-53869 | Low | 3.7 | 2026-01-29 | Multiple MFPs provided by Brother Industries, Ltd. does not properly validate server certificates, which may allow a man-in-the-middle attacker to replace the… |
CVE-2026-1532 | Low | 2.4 | 2026-01-28 | A vulnerability was identified in D-Link DCS-700L 1.03.09. The affected element is the function uploadmusic of the file /setUploadMusic of the component Music… |
CVE-2026-23553 | Low | 2.9 | 2026-01-28 | In the context switch logic Xen attempts to skip an IBPB in the case of a vCPU returning to a CPU on which it was the previous vCPU to run. While safe for Xen'… |
CVE-2026-1520 | Low | 2.4 | 2026-01-28 | A vulnerability was identified in rethinkdb up to 2.4.3. Affected by this issue is some unknown functionality of the component Secondary Index Handler. Such ma… |
CVE-2026-24883 | Low | 3.7 | 2026-01-27 | In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set to a NULL value, leading to a denial of se… |
CVE-2026-22261 | Low | 3.7 | 2026-01-27 | Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, various inefficiencies in xff handling, especially for alerts not triggered… |