Low-severity CVEs (page 30)
Page 30 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-13784 | Low | 2.4 | 2025-11-30 | A weakness has been identified in yungifez Skuul School Management System up to 2.6.5. This vulnerability affects unknown code of the file /dashboard/schools/1… |
CVE-2025-6666 | Low | 2.0 | 2025-11-29 | A vulnerability was determined in motogadget mo.lock Ignition Lock up to 20251125. Affected by this vulnerability is an unknown functionality of the component… |
CVE-2025-66382 | Low | 2.9 | 2025-11-28 | In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time. |
CVE-2025-66372 | Low | 2.8 | 2025-11-28 | Mustang before 2.16.3 allows exfiltrating files via XXE attacks. |
CVE-2025-13758 | Low | 3.5 | 2025-11-27 | Exposure of credentials in unintended requests in Devolutions Server.This issue affects Server: through 2025.2.20, through 2025.3.8. |
CVE-2025-66040 | Low | 3.6 | 2025-11-27 | Spotipy is a Python library for the Spotify Web API. Prior to version 2.25.2, there is a cross-site scripting (XSS) vulnerability in the OAuth callback server… |
CVE-2025-13611 | Low | 2.0 | 2025-11-26 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.2 before 18.5.5 and 18.6 before 18.6.3 that could have allowed an authenticated u… |
CVE-2025-65681 | Low | 3.3 | 2025-11-26 | An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information… |
CVE-2025-20373 | Low | 2.7 | 2025-11-26 | In Splunk Add-on for Palo Alto Networks versions below 2.0.2, the add-on exposes client secrets in plain text in the _internal index during the addition of new… |
CVE-2025-55174 | Low | 3.2 | 2025-11-26 | In KDE Skanpage before 25.08.0, an attempt at file overwrite can result in the contents of the new file at the beginning followed by the partial contents of th… |
CVE-2025-65942 | Low | 2.7 | 2025-11-25 | VictoriaMetrics is a scalable solution for monitoring and managing time series data. In versions from 1.0.0 to before 1.110.23, from 1.111.0 to before 1.122.8… |
CVE-2025-65961 | Low | 3.3 | 2025-11-25 | Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, it is possible to inject code into the template output tha… |
CVE-2025-33200 | Low | 2.3 | 2025-11-25 | NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a resource to be reused. A successful exploit of this vulnerabi… |
CVE-2025-33199 | Low | 3.2 | 2025-11-25 | NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause incorrect control flow behavior. A successful exploit of this v… |
CVE-2025-33198 | Low | 3.3 | 2025-11-25 | NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a resource to be reused. A successful exploit of this vulnerabi… |
CVE-2025-36134 | Low | 3.7 | 2025-11-25 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.5 and 6.2.1.1 could disclose sensitive information… |
CVE-2025-59485 | Low | 3.3 | 2025-11-25 | Incorrect default permissions issue exists in Security Point (Windows) of MaLion prior to Ver.5.3.4. If this vulnerability is exploited, an arbitrary file coul… |
CVE-2025-13643 | Low | 3.1 | 2025-11-25 | A user with access to the cluster with a limited set of privilege actions may be able to terminate queries that are being executed by other users. This may cau… |
CVE-2025-13584 | Low | 3.5 | 2025-11-24 | A security vulnerability has been detected in Eigenfocus up to 1.4.0. This vulnerability affects unknown code of the component Description Handler. The manipul… |
CVE-2025-13577 | Low | 3.5 | 2025-11-24 | A flaw has been found in PHPGurukul Hostel Management System 2.1. The impacted element is an unknown function of the file /register-complaint.php. Executing a… |
CVE-2025-13566 | Low | 3.3 | 2025-11-23 | A security vulnerability has been detected in jarun nnn up to 5.1. The impacted element is the function show_content_in_floating_window/run_cmd_as_plugin of th… |
CVE-2025-11934 | Low | 2.7 | 2025-11-21 | Improper input validation in the TLS 1.3 CertificateVerify signature algorithm negotiation in wolfSSL 5.8.2 and earlier on multiple platforms allows for downgr… |
CVE-2025-31216 | Low | 2.4 | 2025-11-21 | The issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7. An attacker with physical access to a device may… |
CVE-2025-66062 | Low | 3.4 | 2025-11-21 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Frank Goossens WP YouTube Lyte wp-youtube-lyte allows Phishing.This issue affects WP YouTu… |
CVE-2025-64299 | Low | 2.7 | 2025-11-21 | LogStare Collector improperly handles the password hash data. An administrative user may obtain the other users' password hashes. |
CVE-2025-13484 | Low | 2.4 | 2025-11-20 | A vulnerability was identified in Campcodes Complete Online Beauty Parlor Management System 1.0. This vulnerability affects unknown code of the file /admin/cus… |
CVE-2025-52666 | Low | 2.7 | 2025-11-20 | Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administrator user to disable th… |
CVE-2025-35029 | Low | 3.5 | 2025-11-20 | Medical Informatics Engineering Enterprise Health has a stored cross site scripting vulnerability that allows an authenticated attacker to add arbitrary conten… |
CVE-2025-64524 | Low | 3.3 | 2025-11-20 | cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In version… |
CVE-2025-13469 | Low | 2.4 | 2025-11-20 | A security vulnerability has been detected in Public Knowledge Project omp and ojs 3.3.0/3.4.0/3.5.0. Impacted is an unknown function of the file plugins/payme… |
CVE-2025-13450 | Low | 3.5 | 2025-11-20 | A vulnerability was determined in SourceCodester Online Shop Project 1.0. Impacted is an unknown function of the file /shop/register.php. This manipulation of… |
CVE-2025-13415 | Low | 3.5 | 2025-11-19 | A vulnerability was identified in icret EasyImages up to 2.8.6. This affects an unknown part of the file /app/upload.php of the component SVG Image Handler. Th… |
CVE-2025-13412 | Low | 2.4 | 2025-11-19 | A vulnerability was determined in Campcodes Retro Basketball Shoes Online Store 1.0. Affected by this issue is some unknown functionality of the file /admin/ad… |
CVE-2025-64757 | Low | 3.5 | 2025-11-19 | Astro is a web framework. Prior to version 5.14.3, a vulnerability has been identified in the Astro framework's development server that allows arbitrary local… |
CVE-2025-13397 | Low | 3.3 | 2025-11-19 | A security vulnerability has been detected in mrubyc up to 3.4. This impacts the function mrbc_raw_realloc of the file src/alloc.c. Such manipulation of the ar… |
CVE-2025-65014 | Low | 3.7 | 2025-11-18 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a weak password policy vulnerability was identified in… |
CVE-2025-52639 | Low | 3.5 | 2025-11-18 | HCL Connections is vulnerable to a sensitive information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitle… |
CVE-2025-54821 | Low | 1.9 | 2025-11-18 | An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.11, FortiOS 7.2 all v… |
CVE-2025-13083 | Low | 3.7 | 2025-11-18 | Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-12761 | Low | 3.5 | 2025-11-18 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Simple multi step form allows Cross-Site Scripting… |
CVE-2025-55074 | Low | 3.0 | 2025-11-18 | Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to enforce access permissions on the Agents plugin which allows other users to determine when us… |
CVE-2025-13349 | Low | 3.5 | 2025-11-18 | A vulnerability has been found in SourceCodester Student Grades Management System 1.0. This issue affects some unknown processing of the file /grades.php of th… |
CVE-2025-13343 | Low | 3.5 | 2025-11-18 | A security flaw has been discovered in SourceCodester Interview Management System 1.0. Affected is an unknown function of the file /editQuestion.php. The manip… |
CVE-2025-64734 | Low | 2.4 | 2025-11-18 | Missing Release of Resource after Effective Lifetime (CWE-772) in the T21 Reader allows an attacker with physical access to the Reader to perform a denial-of-s… |
CVE-2025-12792 | Low | 3.2 | 2025-11-18 | The Mac App Store distribution of the Canva for Mac desktop app before 1.117.1 was built without Hardened Runtime. A local threat actor with unprivileged acces… |
CVE-2025-63292 | Low | 3.5 | 2025-11-17 | Freebox v5 HD (firmware = 1.7.20), Freebox v5 Crystal (firmware = 1.7.20), Freebox v6 Révolution r1–r3 (firmware = 4.7.x), Freebox Mini 4K (firmware = 4.7.x)… |
CVE-2025-65083 | Low | 3.2 | 2025-11-17 | GoSign Desktop through 2.4.1 disables TLS certificate validation when configured to use a proxy server. This can be problematic if the GoSign Desktop user sele… |
CVE-2025-13245 | Low | 3.5 | 2025-11-16 | A vulnerability was identified in code-projects Student Information System 2.0. The impacted element is an unknown function of the file /editprofile.php. Such… |
CVE-2025-13232 | Low | 3.5 | 2025-11-16 | A flaw has been found in projectsend up to r1720. Impacted is an unknown function of the component File Editor/Custom Download Aliases. This manipulation cause… |
CVE-2025-13202 | Low | 3.5 | 2025-11-15 | A security flaw has been discovered in code-projects Simple Cafe Ordering System 1.0. This affects an unknown part of the file /add_to_cart. Performing manipul… |
CVE-2025-12983 | Low | 3.5 | 2025-11-15 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.9 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allow… |
CVE-2025-7736 | Low | 3.1 | 2025-11-15 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.9 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allow… |
CVE-2025-6945 | Low | 3.5 | 2025-11-15 | GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed… |
CVE-2025-11990 | Low | 3.1 | 2025-11-15 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated use… |
CVE-2025-13186 | Low | 2.4 | 2025-11-14 | A weakness has been identified in Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution up to 4.0. This impacts an unknown function of the file… |
CVE-2025-13182 | Low | 3.5 | 2025-11-14 | A vulnerability was identified in pojoin h3blog 1.0. The impacted element is an unknown function of the file /admin/cms/category/addtitle. The manipulation of… |
CVE-2025-13181 | Low | 3.5 | 2025-11-14 | A vulnerability was determined in pojoin h3blog 1.0. The affected element is an unknown function of the file /admin/cms/material/add. Executing a manipulation… |
CVE-2025-13180 | Low | 3.5 | 2025-11-14 | A vulnerability was found in Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System up to 20250320. Impacted is an unknown function of t… |
CVE-2025-13178 | Low | 3.5 | 2025-11-14 | A flaw has been found in Bdtask/CodeCanyon SalesERP up to 20250728. This vulnerability affects unknown code of the file /edit_profile of the component User Pro… |
CVE-2025-54560 | Low | 3.8 | 2025-11-14 | A Server-side Request Forgery vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows Probing of… |
CVE-2025-54559 | Low | 3.7 | 2025-11-14 | An issue was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows remote Path Traversal for loading arbitrary ex… |
CVE-2025-54342 | Low | 3.3 | 2025-11-14 | A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. There is Exposure of Sensitive Information because… |
CVE-2025-41436 | Low | 3.1 | 2025-11-14 | Mattermost versions <11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regular users to access archived channel co… |
CVE-2025-64745 | Low | 2.7 | 2025-11-13 | Astro is a web framework. Starting in version 5.2.0 and prior to version 5.15.6, a Reflected Cross-Site Scripting (XSS) vulnerability exists in Astro's develop… |
CVE-2025-64744 | Low | 3.5 | 2025-11-13 | OpenObserve is a cloud-native observability platform. In versions up to and including 0.16.1, when creating or renaming an organization with HTML in the name… |
CVE-2025-46370 | Low | 3.3 | 2025-11-13 | Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain a Process Control vulnerability. A low privileged attacker with local access cou… |
CVE-2025-11777 | Low | 3.1 | 2025-11-13 | Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API which allows user… |
CVE-2025-12817 | Low | 3.1 | 2025-11-13 | Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creati… |
CVE-2025-64711 | Low | 3.9 | 2025-11-13 | PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Starting in version 1.7.7 and prior to version 2.0.3, dragging a file whos… |
CVE-2025-64345 | Low | 1.8 | 2025-11-12 | Wasmtime is a runtime for WebAssembly. Prior to version 38.0.4, 37.0.3, 36.0.3, and 24.0.5, Wasmtime's Rust embedder API contains an unsound interaction where… |
CVE-2025-64170 | Low | 3.8 | 2025-11-12 | sudo-rs is a memory safe implementation of sudo and su written in Rust. Starting in version 0.2.7 and prior to version 0.2.10, if a user begins entering a pass… |
CVE-2025-63396 | Low | 3.3 | 2025-11-12 | An issue was discovered in PyTorch v2.5 and v2.7.1. Omission of profiler.stop() can cause torch.profiler.profile (PythonTracer) to crash or hang during finaliz… |
CVE-2025-13058 | Low | 3.5 | 2025-11-12 | A security flaw has been discovered in soerennb eXtplorer up to 2.1.15. The affected element is an unknown function of the component Filename Handler. The mani… |
CVE-2025-57812 | Low | 3.7 | 2025-11-12 | CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library f… |
CVE-2025-20379 | Low | 3.5 | 2025-11-12 | In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, and 9.2.9 and Splunk Cloud Platform versions below 9.3.2411.116, 9.3.2408.124, 10.0.2503.5 and 10.1.2… |
CVE-2025-20378 | Low | 3.1 | 2025-11-12 | In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, 9.2.9, and Splunk Cloud Platform versions below 10.0.2503.5, 9.3.2411.111, and 9.3.2408.121, an unaut… |
CVE-2025-32088 | Low | 3.3 | 2025-11-11 | Improper conditions check for some Intel(R) QAT Windows software before version 2.6.0. within Ring 3: User Applications may allow a denial of service. System s… |
CVE-2025-32037 | Low | 2.0 | 2025-11-11 | Improper access control for some Intel(R) PresentMon before version 2.3.1 within Ring 3: User Applications may allow a denial of service. Network adversary wit… |
CVE-2025-31948 | Low | 3.3 | 2025-11-11 | Improper input validation for some Intel(R) oneAPI Math Kernel Library before version 2025.2 within Ring 3: User Applications may allow a denial of service. Un… |
CVE-2025-30509 | Low | 3.8 | 2025-11-11 | Improper input validation for some Intel QuickAssist Technology software before version 2.6.0 within Ring 3: User Applications may allow an escalation of privi… |
CVE-2025-25216 | Low | 3.3 | 2025-11-11 | Improper input validation in some firmware for some Intel(R) Graphics Drivers and Intel LTS kernels within Ring 1: Device Drivers may allow a denial of service… |
CVE-2025-24862 | Low | 2.0 | 2025-11-11 | Unrestricted upload of file with dangerous type for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an… |
CVE-2025-24314 | Low | 2.2 | 2025-11-11 | Improper access control for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an information disclosure… |
CVE-2025-24307 | Low | 2.0 | 2025-11-11 | Improper privilege management for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escalation of pri… |
CVE-2025-20622 | Low | 3.8 | 2025-11-11 | Sensitive information uncleared in resource before release for reuse for some Intel(R) NPU Drivers for Windows before version 32.0.100.4023 within Ring 3: User… |
CVE-2025-64773 | Low | 2.7 | 2025-11-11 | In JetBrains YouTrack before 2025.3.104432 a race condition allowed bypass of helpdesk Agent limit |
CVE-2025-13015 | Low | 3.4 | 2025-11-11 | Spoofing issue in Firefox. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, and Firefox ESR 115.30. |
CVE-2025-8998 | Low | 3.1 | 2025-11-11 | It was possible to upload files with a specific name to a temporary directory, which may result in process crashes and impact usability. This flaw can only be… |
CVE-2025-42883 | Low | 2.7 | 2025-11-11 | Migration Workbench (DX Workbench) in SAP NetWeaver Application Server for ABAP fails to trigger a malware scan when an attacker with administrative privileges… |
CVE-2025-62780 | Low | 3.5 | 2025-11-10 | changedetection.io is a free open source web page change detection tool. A Stored Cross Site Scripting is present in changedetection.io Watch update API in ver… |
CVE-2025-64682 | Low | 2.7 | 2025-11-10 | In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limit |
CVE-2025-64681 | Low | 2.7 | 2025-11-10 | In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations |
CVE-2025-12923 | Low | 2.7 | 2025-11-10 | A vulnerability was determined in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function resourceDownload of the file /dev-api/common/downloa… |
CVE-2025-12920 | Low | 2.4 | 2025-11-09 | A flaw has been found in qianfox FoxCMS up to 1.2.16. Affected by this vulnerability is the function add/edit of the file app/admin/controller/Product.php. Thi… |
CVE-2025-12919 | Low | 3.7 | 2025-11-09 | A vulnerability was detected in EverShop up to 2.0.1. Affected is an unknown function of the file /src/modules/oms/graphql/types/Order/Order.resolvers.js of th… |
CVE-2025-12918 | Low | 3.1 | 2025-11-09 | A security flaw has been discovered in yungifez Skuul School Management System up to 2.6.5. The impacted element is an unknown function of the file /dashboard/… |
CVE-2025-12854 | Low | 3.7 | 2025-11-07 | A vulnerability was identified in newbee-mall-plus up to 2.4.1. This vulnerability affects the function executeSeckill of the file /seckillExecution/. The mani… |
CVE-2025-48985 | Low | 3.7 | 2025-11-07 | A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitel… |
CVE-2025-11219 | Low | 3.1 | 2025-11-06 | Use after free in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML pa… |
CVE-2025-64326 | Low | 2.6 | 2025-11-06 | Weblate is a web based localization tool. In versions 5.14 and below, Weblate leaks the IP address of the project member inviting the user to the project in t… |