Low-severity CVEs (page 3)
Page 3 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-78426 | Low | 3.7 | 2026-09-17 | The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding a valid JWT that has not expired, but… |
CVE-2026-91017 | Low | 3.7 | 2026-09-17 | The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-def… |
CVE-2026-91008 | Low | 3.7 | 2026-09-17 | The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirma… |
CVE-2026-87836 | Low | 2.7 | 2026-09-17 | The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to con… |
CVE-2026-86446 | Low | 3.7 | 2026-09-17 | The LearnPress WordPress plugin before 4.4.7 does not restrict the correctness flags it returns when a quiz answer is checked, allowing unauthenticated attack… |
CVE-2026-20071 | Low | 3.8 | 2026-09-16 | A vulnerability in the SSID bring-your-own-device (BYOD) onboarding workflow of Cisco ISE could allow an unauthenticated, adjacent attacker to hijack the onboa… |
CVE-2026-92474 | Low | 3.3 | 2026-09-16 | A security flaw has been discovered in GPAC 26.08-DEV. This affects the function gf_inline_get_proto_lib of the file src/compositor/mpeg4_inline.c of the compo… |
CVE-2026-87026 | Low | 3.8 | 2026-09-16 | Tanium addressed an improper access controls vulnerability in Threat Response. |
CVE-2026-92473 | Low | 3.3 | 2026-09-16 | A vulnerability was identified in GPAC 26.08-DEV. The impacted element is the function gf_sg_command_del of the file src/scenegraph/commands.c of the component… |
CVE-2026-92472 | Low | 3.3 | 2026-09-16 | A vulnerability was determined in GPAC 26.08-DEV. The affected element is the function gf_node_deactivate_ex of the file src/scenegraph/base_scenegraph.c of th… |
CVE-2026-92418 | Low | 3.5 | 2026-09-16 | A vulnerability was determined in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This vulnerability affects unknown code of the file src/main/… |
CVE-2026-86071 | Low | 3.7 | 2026-09-16 | Junrar is an open source Java RAR archive library. Prior to version 7.6.1, LocalFolderExtractor in src/main/java/com/github/junrar/LocalFolderExtractor.java ca… |
CVE-2026-73442 | Low | 3.0 | 2026-09-16 | On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an… |
CVE-2026-87031 | Low | 2.7 | 2026-09-16 | n Concrete CMS 9.2.0 through 9.5.3, the REST API user creation endpoint (POST /ccm/api/1.0/users, the add() method of concrete/src/Api/Controller/Users.php) di… |
CVE-2026-71182 | Low | 3.0 | 2026-09-16 | Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A high pri… |
CVE-2026-71181 | Low | 3.0 | 2026-09-16 | Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A high pri… |
CVE-2026-69200 | Low | 3.7 | 2026-09-16 | node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-client 2.145.0, the internal fieldsToJson method in packages/node-opcua-… |
CVE-2026-92385 | Low | 2.4 | 2026-09-16 | A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/update_categor… |
CVE-2026-92381 | Low | 3.5 | 2026-09-16 | A weakness has been identified in PbootCMS up to 3.2.22. This affects the function decode_string of the file apps/admin/controller/content/ContentController.ph… |
CVE-2026-92130 | Low | 3.1 | 2026-09-16 | Jenkins Pipeline: Multibranch Plugin 841.vec5b_9e1806ec and earlier does not set the appropriate context for credentials lookup in the resolveScm Pipeline step… |
CVE-2026-92359 | Low | 3.1 | 2026-09-16 | A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. The affected element is the function create_strands_app of the file integrations/aws-strands… |
CVE-2026-77860 | Low | 3.7 | 2026-09-16 | In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' count… |
CVE-2026-3855 | Low | 3.1 | 2026-09-16 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain… |
CVE-2026-89328 | Low | 3.8 | 2026-09-16 | The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a user holds board-manager privileges before performing several board-management… |
CVE-2026-89327 | Low | 3.8 | 2026-09-16 | The FluentBoards WordPress plugin before 2.0.15 does not verify that a board member submitting a comment is the user the comment is attributed to, allowing an… |
CVE-2026-86448 | Low | 3.7 | 2026-09-16 | The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export… |
CVE-2026-84907 | Low | 3.7 | 2026-09-16 | The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline (local) payment method is enabled, relying on a non… |
CVE-2026-84905 | Low | 2.7 | 2026-09-16 | The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker, allowing users with contributor-level… |
CVE-2026-82126 | Low | 2.7 | 2026-09-16 | The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check that a user is allowed to edit the specific post they request schema gene… |
CVE-2026-92214 | Low | 3.5 | 2026-09-16 | A flaw has been found in a2ui-project a2ui up to 0.10.7. Affected is an unknown function of the file samples/community/client/angular/projects/a2a-chat-canvas/… |
CVE-2026-91747 | Low | 3.1 | 2026-09-15 | Use after free in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data v… |
CVE-2026-91730 | Low | 3.1 | 2026-09-15 | Incomplete cleanup in GetUserMedia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged soc… |
CVE-2026-91723 | Low | 3.1 | 2026-09-15 | Race condition in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium secu… |
CVE-2026-91708 | Low | 3.1 | 2026-09-15 | Race condition in Network in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin dat… |
CVE-2026-87284 | Low | 3.2 | 2026-09-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploi… |
CVE-2026-87281 | Low | 3.2 | 2026-09-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploi… |
CVE-2026-83414 | Low | 2.5 | 2026-09-15 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 15.1.1.0.0. Difficult… |
CVE-2026-83413 | Low | 1.9 | 2026-09-15 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0… |
CVE-2026-83369 | Low | 3.1 | 2026-09-15 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Access SDK). Supported versions that are affected are 12.2.1.4.0 an… |
CVE-2026-18425 | Low | 2.7 | 2026-09-15 | Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action (Concrete\Controller\Backend\Dashboard\SitemapUpdate) using only the global access_… |
CVE-2026-81923 | Low | 2.7 | 2026-09-15 | In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The saveRecord() action validated the… |
CVE-2026-81922 | Low | 2.7 | 2026-09-15 | Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, t… |
CVE-2026-91957 | Low | 3.1 | 2026-09-15 | FreeRDP before 3.31.0 contains a use-after-free vulnerability in the smartcard RDPDR device handler when worker thread creation fails after device registration… |
CVE-2026-88621 | Low | 2.7 | 2026-09-15 | OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload() method in class/Api.php. An authenticated administrator can… |
CVE-2026-91836 | Low | 2.8 | 2026-09-15 | A flaw has been found in OpenClaw ClawScan up to 0.1.6. This affects an unknown function of the file internal/runner/static_scanner.go of the component Static… |
CVE-2026-91835 | Low | 2.8 | 2026-09-15 | A vulnerability was detected in OpenClaw ClawScan up to 0.1.6. The impacted element is the function IsBinaryFile of the file internal/runner/static_scanner.go… |
CVE-2026-25827 | Low | 2.3 | 2026-09-15 | An issue was discovered in Keyfactor SignServer before 7.6.0. A number of properties were identified to not have any restrictions to what path they can be set… |
CVE-2026-25825 | Low | 2.7 | 2026-09-15 | An issue was discovered in Keyfactor SignServer before 7.6.0. The output file to which SignerStatusReportWorker logs the report can be set to any path, even on… |
CVE-2026-91926 | Low | 3.7 | 2026-09-15 | A flaw was found in gss-ntlmssp. A memory leak occurs in the NTLM target-info parser when a crafted NTLM CHALLENGE message contains duplicated string-valued AV… |
CVE-2025-13166 | Low | 3.7 | 2026-09-15 | The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses rece… |
CVE-2026-91782 | Low | 3.3 | 2026-09-15 | A vulnerability was detected in GNU Binutils 2.47. Affected by this vulnerability is the function elf_x86_allocate_dynrelocs of the file bfd/elfxx-x86.c of the… |
CVE-2026-91781 | Low | 3.3 | 2026-09-15 | A security vulnerability has been detected in GNU Binutils 2.47. Affected is the function elf_x86_64_common_section_index of the file bfd/elf64-x86-64.c of the… |
CVE-2026-91780 | Low | 3.3 | 2026-09-15 | A weakness has been identified in GNU Binutils 2.47. This impacts the function elf_link_add_object_symbols of the file bfd/elflink.c. Executing a manipulation… |
CVE-2026-91779 | Low | 3.3 | 2026-09-15 | A security flaw has been discovered in GNU Binutils 2.47. This affects the function _bfd_elf_eh_frame_section_offset of the file bfd/elf-eh-frame.c of the comp… |
CVE-2026-91090 | Low | 3.9 | 2026-09-15 | A vulnerability was determined in GPAC up to f1219cde. The affected element is the function gf_node_activate_ex of the file scenegraph/base_scenegraph.c. This… |
CVE-2026-86701 | Low | 2.5 | 2026-09-15 | Android application "ManabiPocket for Parents" contains an improper access control vulnerability in one of its components. A malicious application installed on… |
CVE-2026-16592 | Low | 2.7 | 2026-09-15 | The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its shortcodes, allowing users with a role as… |
CVE-2026-90850 | Low | 2.4 | 2026-09-15 | A vulnerability was detected in PHPGurukul Hostel Management System 3.0. Affected by this issue is some unknown functionality of the file /admin/manage-student… |
CVE-2026-90845 | Low | 3.5 | 2026-09-15 | A flaw has been found in PHPGurukul Daily Expense Tracker System 1.1. This issue affects some unknown processing of the file /dets/includes/sidebar.php. Execut… |
CVE-2026-90842 | Low | 3.7 | 2026-09-15 | A weakness has been identified in PHPGurukul Blood Donor Management System 1.0. Affected by this issue is some unknown functionality of the file application/mo… |
CVE-2026-90835 | Low | 3.5 | 2026-09-14 | A flaw has been found in michaelliao itranswarp up to 2.19. The impacted element is the function Markdown.toHtml of the file Markdown.java of the component Pag… |
CVE-2026-77191 | Low | 2.6 | 2026-09-14 | An authenticated supplicant on an adjacent network may bypass intended network authorization policy and send unrestricted traffic during a brief window (millis… |
CVE-2026-75945 | Low | 2.6 | 2026-09-14 | A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued. |
CVE-2026-75944 | Low | 2.6 | 2026-09-14 | A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale… |
CVE-2026-75943 | Low | 2.6 | 2026-09-14 | A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to… |
CVE-2026-90827 | Low | 3.3 | 2026-09-14 | A vulnerability was identified in GPAC 26.07.0. This affects the function gf_node_deactivate_ex of the file scenegraph/base_scenegraph.c of the component MP4Bo… |
CVE-2026-90826 | Low | 2.8 | 2026-09-14 | A vulnerability was determined in GPAC 26.07.0. Affected by this issue is the function gf_node_del of the file scenegraph/base_scenegraph.c of the component MP… |
CVE-2026-90825 | Low | 3.3 | 2026-09-14 | A vulnerability was found in GPAC 26.07.0. Affected by this vulnerability is the function gf_node_unregister of the file scenegraph/base_scenegraph.c of the co… |
CVE-2026-90824 | Low | 3.3 | 2026-09-14 | A vulnerability has been found in GPAC 26.07.0. Affected is the function gf_sg_dom_event_bubble of the file src/scenegraph/dom_events.c of the component MP4Box… |
CVE-2026-86893 | Low | 3.3 | 2026-09-14 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 27. An app may be ab… |
CVE-2026-86891 | Low | 3.5 | 2026-09-14 | An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, watchOS… |
CVE-2026-86888 | Low | 3.3 | 2026-09-14 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, tvOS 27, v… |
CVE-2026-86887 | Low | 3.3 | 2026-09-14 | A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, visionOS 27. An app may be abl… |
CVE-2026-84626 | Low | 3.3 | 2026-09-14 | An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Gold… |
CVE-2026-84530 | Low | 3.3 | 2026-09-14 | An information disclosure issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Gol… |
CVE-2026-65371 | Low | 3.3 | 2026-09-14 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.8, macOS Tahoe 26… |
CVE-2026-19086 | Low | 3.3 | 2026-09-14 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a denial of service as a result of a buffer overflow in a PASE process. An authenticated attacker could leverage this… |
CVE-2026-16190 | Low | 3.1 | 2026-09-14 | IBM WebSphere Application Server 9.0, and 8.5 is affected by an authorization bypass vulnerability. |
CVE-2026-90811 | Low | 3.3 | 2026-09-14 | A weakness has been identified in cosmicstack-labs mercury-agent up to 1.2.0. This affects the function PermissionManager.checkShellCommand of the file mercury… |
CVE-2026-57583 | Low | 3.3 | 2026-09-14 | OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wiza… |
CVE-2026-55866 | Low | 3.7 | 2026-09-14 | SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, SpiceDB can return PER… |
CVE-2026-49400 | Low | 3.3 | 2026-09-14 | October System provides the system module for October Content Management System. Prior to versions 3.7.17 and 4.2.21, the backend `SessionMaker` trait stored w… |
CVE-2026-46696 | Low | 3.3 | 2026-09-14 | October System provides the system module for October Content Management System. Versions prior to 3.7.17 and 4.2.21 have a vulnerability in the Twig sandbox s… |
CVE-2026-44162 | Low | 2.7 | 2026-09-14 | fluent-plugin-s3 is an Amazon S3 input and output plugin for Fluentd. From 0.7.0 to 1.8.4, the in_s3 input plugin reads the entire decompressed payload of gzip… |
CVE-2026-54542 | Low | 3.7 | 2026-09-14 | Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can… |
CVE-2026-54541 | Low | 3.7 | 2026-09-14 | Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can… |
CVE-2026-90713 | Low | 3.3 | 2026-09-14 | A security flaw has been discovered in vllm-project vLLM up to 0.29.0. The affected element is the function TiktokenTokenizer::new of the file rust/src/text/sr… |
CVE-2026-90696 | Low | 3.5 | 2026-09-14 | A vulnerability was determined in SourceCodester Inventory Management System 1.0. Affected by this issue is some unknown functionality of the file /api/product… |
CVE-2026-90695 | Low | 3.5 | 2026-09-14 | A vulnerability was found in SourceCodester Inventory Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /api/vendor… |
CVE-2026-90694 | Low | 3.5 | 2026-09-14 | A vulnerability has been found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file /api/customers_handler.php of the… |
CVE-2026-25832 | Low | 3.7 | 2026-09-14 | In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group. |
CVE-2025-26790 | Low | 3.7 | 2026-09-14 | Withsecure Atlant with Capricorn engine before 2025-01-20_02 allows a Remote Denial of Service via an out-of-bounds memory read during processing of a document… |
CVE-2026-90685 | Low | 2.8 | 2026-09-14 | A vulnerability has been found in GPAC up to f1219cde. Affected by this issue is the function lsr_exec_command_list of the file laser/lsr_dec.c of the componen… |
CVE-2023-37366 | Low | 2.8 | 2026-09-14 | An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor, and Modem Exynos 9810, Exynos 9610, Exynos 9820, Exynos 980, Exynos 850, Exyn… |
CVE-2023-37253 | Low | 3.1 | 2026-09-14 | An issue was discovered in the ProofreadPage extension for MediaWiki through 1.39.3. It leaks information about a suppressed user via the API and config variab… |
CVE-2026-90684 | Low | 2.8 | 2026-09-14 | A flaw has been found in GPAC up to f1219cde. Affected by this vulnerability is the function gf_node_get_field_count of the file scenegraph/base_scenegraph.c o… |
CVE-2026-90683 | Low | 3.3 | 2026-09-14 | A vulnerability was detected in GPAC up to f1219cde. Affected is the function gf_node_unregister of the file scenegraph/base_scenegraph.c of the component MP4B… |
CVE-2026-90681 | Low | 3.3 | 2026-09-14 | A weakness has been identified in Matthias-Wandel jhead up to 3.3. This affects the function Get16u of the file exif.c of the component EXIF Parsing. This mani… |
CVE-2023-37252 | Low | 3.1 | 2026-09-14 | An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. Special:CheckUserLog shows usernames that have been hidden. |
CVE-2023-32778 | Low | 3.3 | 2026-09-14 | An issue was discovered in ILIAS 6.23, 7 before 7.22, and 8.1. An attacker can execute arbitrary code via ZIP upload. |