Low-severity CVEs (page 29)
Page 29 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-65185 | Low | 2.8 | 2025-12-17 | There is a username enumeration via local user login in Entrinsik Informer v5.10.1 which allows malicious users to enumerate users by entering an OTP code and… |
CVE-2025-62690 | Low | 3.1 | 2025-12-17 | Mattermost versions 10.11.x <= 10.11.4 fail to validate redirect URLs on the /error page, which allows an attacker to redirect a victim to a malicious site via… |
CVE-2025-13352 | Low | 3.0 | 2025-12-17 | Mattermost versions 10.11.x <= 10.11.6 and Mattermost GitHub plugin versions <=2.4.0 fail to validate plugin bot identity in reaction forwarding which allows a… |
CVE-2025-14801 | Low | 2.4 | 2025-12-17 | A security vulnerability has been detected in xiweicheng TMS up to 2.28.0. This affects the function createComment of the file /admin/blog/comment/create. Such… |
CVE-2025-68164 | Low | 2.7 | 2025-12-16 | In JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection test |
CVE-2025-68163 | Low | 3.5 | 2025-12-16 | In JetBrains TeamCity before 2025.11 stored XSS was possible on agentpushInstall page |
CVE-2025-68162 | Low | 2.7 | 2025-12-16 | In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configuration |
CVE-2025-54004 | Low | 2.7 | 2025-12-16 | Missing Authorization vulnerability in WC Lovers WCFM – Frontend Manager for WooCommerce wc-frontend-manager allows Exploiting Incorrectly Configured Access Co… |
CVE-2025-49300 | Low | 2.7 | 2025-12-16 | Insertion of Sensitive Information Into Sent Data vulnerability in shinetheme Traveler Option Tree custom-option-tree allows Retrieve Embedded Sensitive Data.T… |
CVE-2025-14722 | Low | 2.4 | 2025-12-15 | A vulnerability was determined in vion707 DMadmin up to 3403cafdb42537a648c30bf8cbc8148ec60437d1. This impacts the function Add of the file Admin/Controller/Ad… |
CVE-2025-55703 | Low | 2.5 | 2025-12-15 | An error-based SQL injection vulnerability exists in the Sunbird Power IQ 9.2.0 API. The vulnerability is due to an outdated API endpoint that applied arrays w… |
CVE-2025-14023 | Low | 3.1 | 2025-12-15 | LINE client for iOS prior to 15.19 allows UI spoofing due to inconsistencies between the navigation state and the in-app browser's user interface, which could… |
CVE-2025-14019 | Low | 3.4 | 2025-12-15 | LINE client for Android versions from 13.8 to 15.5 is vulnerable to UI spoofing in the in-app browser where a specific layout could obscure the full-screen war… |
CVE-2025-14697 | Low | 3.7 | 2025-12-15 | A security flaw has been discovered in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 4.10.24.3. Affected by this issue is some unknow… |
CVE-2025-67899 | Low | 2.9 | 2025-12-14 | uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by ParseMustBeSegmentNzNc with large input containing many commas. |
CVE-2025-14663 | Low | 2.4 | 2025-12-14 | A vulnerability was determined in code-projects Student File Management System 1.0. This vulnerability affects unknown code of the file /admin/update_student.p… |
CVE-2025-14662 | Low | 2.4 | 2025-12-14 | A vulnerability was found in code-projects Student File Management System 1.0. This affects an unknown part of the file /admin/update_user.php of the component… |
CVE-2025-14651 | Low | 3.7 | 2025-12-14 | A vulnerability has been found in MartialBE one-hub up to 0.14.27. This vulnerability affects unknown code of the file docker-compose.yml. The manipulation of… |
CVE-2025-14636 | Low | 3.7 | 2025-12-13 | A security flaw has been discovered in Tenda AX9 22.03.01.46. This affects the function image_check of the component httpd. The manipulation results in use of… |
CVE-2025-9218 | Low | 3.7 | 2025-12-13 | The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to to Information Disclosure due to missing authorization in the handle_re… |
CVE-2025-43532 | Low | 2.8 | 2025-12-12 | A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Seq… |
CVE-2025-43522 | Low | 3.3 | 2025-12-12 | A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.7.3, mac… |
CVE-2025-43518 | Low | 3.3 | 2025-12-12 | A logic issue was addressed with improved checks. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2… |
CVE-2025-43517 | Low | 3.3 | 2025-12-12 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tah… |
CVE-2025-43516 | Low | 3.3 | 2025-12-12 | A session management issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. A user with… |
CVE-2025-43437 | Low | 3.3 | 2025-12-12 | An information disclosure issue was addressed with improved privacy controls. This issue is fixed in iOS 26.1 and iPadOS 26.1. An app may be able to fingerprin… |
CVE-2025-43410 | Low | 2.4 | 2025-12-12 | The issue was addressed with improved handling of caches. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.2. An attacker with… |
CVE-2025-43404 | Low | 3.3 | 2025-12-12 | A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user da… |
CVE-2025-14580 | Low | 3.5 | 2025-12-12 | A security vulnerability has been detected in Qualitor up to 8.24.73. The impacted element is an unknown function of the file /Qualitor/html/bc/bcdocumento9/bi… |
CVE-2023-29144 | Low | 3.3 | 2025-12-12 | Malwarebytes 1.0.14 for Linux doesn't properly compute signatures in some scenarios. This allows a bypass of detection. |
CVE-2025-36744 | Low | 2.4 | 2025-12-12 | SolarEdge SE3680H has unauthenticated disclosure of sensitive information during the bootloader loop. While the device repeatedly initializes and waits for boo… |
CVE-2025-10583 | Low | 3.5 | 2025-12-12 | The WP Fastest Cache Premium plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.7.4 via the 'get_server_… |
CVE-2025-67737 | Low | 3.1 | 2025-12-12 | AzuraCast is a self-hosted, all-in-one web radio management suite. Versions 0.23.1 mistakenly include an API endpoint that is intended for internal use by the… |
CVE-2025-13053 | Low | 3.7 | 2025-12-12 | When a user configures the NAS to retrieve UPS status or control the UPS, a non-enforced TLS certificate verification can allow an attacker able to intercept n… |
CVE-2025-14538 | Low | 3.5 | 2025-12-11 | A security vulnerability has been detected in yangshare warehouseManager 仓库管理系统 1.1.0. This affects the function addCustomer of the file CustomerManageHandler… |
CVE-2025-67742 | Low | 3.8 | 2025-12-11 | In JetBrains TeamCity before 2025.11 path traversal was possible via file upload |
CVE-2025-67740 | Low | 2.7 | 2025-12-11 | In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata |
CVE-2025-67739 | Low | 3.1 | 2025-12-11 | In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure |
CVE-2025-55307 | Low | 3.3 | 2025-12-11 | An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. Opening a malicious PDF containing a crafted JavaScript call to… |
CVE-2025-14519 | Low | 3.5 | 2025-12-11 | A security flaw has been discovered in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c. This issue affects some unknown processing of the file /admi… |
CVE-2025-12734 | Low | 3.5 | 2025-12-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.6 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allow… |
CVE-2025-67646 | Low | 3.5 | 2025-12-11 | TableProgressTracking is a MediaWiki extension to track progress against specific criterion. Versions 1.2.0 and below do not enforce CSRF token validation in t… |
CVE-2025-5467 | Low | 3.3 | 2025-12-10 | It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibl… |
CVE-2025-67639 | Low | 3.5 | 2025-12-10 | A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the… |
CVE-2025-13127 | Low | 3.5 | 2025-12-10 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in TAC Information Services Internal and External Tra… |
CVE-2025-14082 | Low | 2.7 | 2025-12-10 | A flaw was found in Keycloak Admin REST (Representational State Transfer) API. This vulnerability allows information disclosure of sensitive role metadata via… |
CVE-2025-67500 | Low | 3.7 | 2025-12-10 | Mastodon is a free, open-source social network server based on ActivityPub. Versions 4.2.27 and prior, 4.3.0-beta.1 through 4.3.14, 4.4.0-beta.1 through 4.4.9… |
CVE-2025-64787 | Low | 3.3 | 2025-12-09 | Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an Improper Verification of Cryptograp… |
CVE-2025-64786 | Low | 3.3 | 2025-12-09 | Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an Improper Verification of Cryptograp… |
CVE-2025-59923 | Low | 2.7 | 2025-12-09 | An improper access control vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all ve… |
CVE-2025-57823 | Low | 2.7 | 2025-12-09 | A direct request ('forced browsing') vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator… |
CVE-2025-12945 | Low | 2.4 | 2025-12-09 | An improper input validation vulnerability in the NETGEAR Nighthawk R7000P (end of service) routers lets an authenticated administrator with local network acce… |
CVE-2025-64696 | Low | 3.3 | 2025-12-09 | Android App "Brother iPrint&Scan" versions 6.13.7 and earlier improperly uses an external cache directory. If exploited, application-specific files may be acce… |
CVE-2025-64255 | Low | 2.7 | 2025-12-09 | Missing Authorization vulnerability in Bowo Admin and Site Enhancements (ASE) admin-site-enhancements allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-64254 | Low | 2.7 | 2025-12-09 | Missing Authorization vulnerability in Ronald Huereca Photo Block photo-block allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2025-40818 | Low | 3.3 | 2025-12-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP4). Affected applications contain private SSL/TLS keys on the server… |
CVE-2024-56464 | Low | 2.7 | 2025-12-09 | IBM QRadar SIEM 7.5 - 7.5.0 UP14 IF01 is affected by an information disclosure vulnerability involving exposure of directory information. IBM has addressed thi… |
CVE-2025-36102 | Low | 2.7 | 2025-12-08 | IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow a privileged user to bypass validation, passing user input… |
CVE-2025-65228 | Low | 3.5 | 2025-12-08 | A stored cross-site scripting vulnerability exists in the web management interface of the R.V.R. Elettronica TLK302T telemetry controller (firmware 1.5.1799). |
CVE-2025-60912 | Low | 3.3 | 2025-12-08 | phpIPAM v1.7.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the database export functionality. The generate-mysql.php function, located in the… |
CVE-2025-14244 | Low | 2.4 | 2025-12-08 | A flaw has been found in GreenCMS 2.3.0603. Affected by this issue is some unknown functionality of the file /Admin/Controller/CustomController.class.php of th… |
CVE-2025-14228 | Low | 3.5 | 2025-12-08 | A weakness has been identified in Yealink SIP-T21P E2 52.84.0.15. Impacted is an unknown function of the component Local Directory Page. This manipulation caus… |
CVE-2025-66334 | Low | 3.3 | 2025-12-08 | Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-66333 | Low | 3.3 | 2025-12-08 | Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-66332 | Low | 3.3 | 2025-12-08 | Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-66331 | Low | 3.3 | 2025-12-08 | Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-14221 | Low | 3.5 | 2025-12-08 | A vulnerability was detected in SourceCodester Online Banking System 1.0. This impacts an unknown function of the file /?page=user. The manipulation of the arg… |
CVE-2025-14205 | Low | 2.4 | 2025-12-08 | A vulnerability was found in code-projects Chamber of Commerce Membership Management System 1.0. Impacted is an unknown function of the file /membership_profil… |
CVE-2025-14201 | Low | 2.4 | 2025-12-07 | A vulnerability was found in alokjaiswal Hotel-Management-services-using-MYSQL-and-php up to 5f8b60a7aa6c06a5632de569d4e3f6a8cd82f76f. Affected by this vulnera… |
CVE-2025-14200 | Low | 3.5 | 2025-12-07 | A vulnerability has been found in alokjaiswal Hotel-Management-services-using-MYSQL-and-php up to 5f8b60a7aa6c06a5632de569d4e3f6a8cd82f76f. Affected is an unkn… |
CVE-2025-14194 | Low | 3.5 | 2025-12-07 | A vulnerability was identified in code-projects Employee Profile Management System 1.0. This issue affects some unknown processing of the file /view_personnel… |
CVE-2025-14186 | Low | 3.5 | 2025-12-07 | A security flaw has been discovered in Grandstream GXP1625 1.0.7.4. The impacted element is an unknown function of the file /cgi-bin/api.values.post of the com… |
CVE-2025-66629 | Low | 3.7 | 2025-12-05 | HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.4, some of HedgeDoc's OAuth2 endpoints for social login provide… |
CVE-2025-66558 | Low | 3.1 | 2025-12-05 | Nextcloud Twofactor WebAuthn is the WebAuthn Two-Factor Provider for Nextcloud. Prior to 1.4.2 and 2.4.1, a missing ownership check allowed an attack to take-a… |
CVE-2025-66556 | Low | 3.5 | 2025-12-05 | Nextcloud talk is a video & audio conferencing app for Nextcloud. Prior to 20.1.8 and 21.1.2, a participant with chat permissions was able to delete poll draft… |
CVE-2025-66554 | Low | 3.5 | 2025-12-05 | Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. Prior to 5.5.4, 6.0.6, and 7.2.5, a malicious use… |
CVE-2025-66549 | Low | 2.4 | 2025-12-05 | Nextcloud Desktop is the desktop sync client for Nextcloud. Prior to 3.16.5, when trying to manually lock a file inside an end-to-end encrypted directory, the… |
CVE-2025-66548 | Low | 3.3 | 2025-12-05 | Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.12.7, 1… |
CVE-2025-66545 | Low | 3.5 | 2025-12-05 | Nextcloud Groupfolders provides admin-configured folders shared by everyone in a group or team. Prior to 14.0.11, 15.3.12, 16.0.15, 17.0.14, 18.1.8, 19.1.8, an… |
CVE-2025-66515 | Low | 2.7 | 2025-12-05 | The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a w… |
CVE-2025-66514 | Low | 3.5 | 2025-12-05 | Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Prior to 5.5.3, a stored HTML injection in the Mail app's message list allow… |
CVE-2025-66546 | Low | 3.3 | 2025-12-05 | Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential I… |
CVE-2025-12997 | Low | 2.2 | 2025-12-04 | Insecure Direct Object Reference vulnerability in Medtronic CareLink Network which allows an authenticated attacker with access to specific device and user inf… |
CVE-2025-14013 | Low | 2.4 | 2025-12-04 | A vulnerability was identified in JIZHICMS up to 2.5.5. The impacted element is an unknown function of the file /index.php/admins/Comment/addcomment.html of th… |
CVE-2025-14007 | Low | 2.0 | 2025-12-04 | A vulnerability was detected in dayrui XunRuiCMS up to 4.7.1. This affects an unknown part of the file /admin79f2ec220c7e.php?c=api&m=demo&name=mobile of the c… |
CVE-2025-14006 | Low | 3.5 | 2025-12-04 | A security vulnerability has been detected in dayrui XunRuiCMS up to 4.7.1. Affected by this issue is some unknown functionality of the file /admind45f74adbd95… |
CVE-2025-14005 | Low | 2.4 | 2025-12-04 | A weakness has been identified in dayrui XunRuiCMS up to 4.7.1. Affected by this vulnerability is an unknown functionality of the file /admind45f74adbd95.php?c… |
CVE-2025-64763 | Low | 3.7 | 2025-12-03 | Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, when Envoy is configured in TCP proxy mode to handle C… |
CVE-2025-20388 | Low | 2.7 | 2025-12-03 | In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.7, and 9.3.2411.116, a us… |
CVE-2025-20385 | Low | 2.4 | 2025-12-03 | In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.6, 10.0.2503.7, and 9.3.2411.117, a us… |
CVE-2025-20382 | Low | 3.5 | 2025-12-03 | In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.10, 10.0.2503.8, and 9.3.2411.120, a l… |
CVE-2025-12954 | Low | 2.7 | 2025-12-03 | The Timetable and Event Schedule by MotoPress WordPress plugin before 2.4.16 does not verify a user has access to a specific event when duplicating, leading to… |
CVE-2025-13640 | Low | 3.5 | 2025-12-02 | Inappropriate implementation in Passwords in Google Chrome prior to 143.0.7499.41 allowed a local attacker to bypass authentication via physical access to the… |
CVE-2025-59700 | Low | 3.9 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate att… |
CVE-2025-59696 | Low | 3.2 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate att… |
CVE-2025-65858 | Low | 3.5 | 2025-12-02 | A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user… |
CVE-2025-13879 | Low | 2.7 | 2025-12-02 | Directory traversal vulnerability in SOLIDserver IPAM v8.2.3. This vulnerability allows an authenticated user with administrator privileges to list directories… |
CVE-2025-13870 | Low | 3.1 | 2025-12-02 | Mattermost versions 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate the user permission when accessing the files and subscribing to the block in Boards… |
CVE-2025-13805 | Low | 3.7 | 2025-12-01 | A weakness has been identified in nutzam NutzBoot up to 2.6.0-SNAPSHOT. This affects the function getInputStream of the file nutzcloud/nutzcloud-literpc/src/ma… |
CVE-2025-13795 | Low | 2.4 | 2025-11-30 | A weakness has been identified in codingWithElias School Management System up to f1ac334bfd89ae9067cc14dea12ec6ff3f078c01. Affected is an unknown function of t… |