Low-severity CVEs (page 33)
Page 33 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-60019 | Low | 3.7 | 2025-09-25 | glib-networking's OpenSSL backend fails to properly check the return value of memory allocation routines. An out of memory condition could potentially result i… |
CVE-2025-36857 | Low | 3.3 | 2025-09-25 | Rapid7 Appspider Pro versions below 7.5.021, suffer from a broken access control vulnerability in the application's configuration file loading mechanism, where… |
CVE-2025-10949 | Low | 2.4 | 2025-09-25 | A vulnerability was found in Changsha Developer Technology iView Editor up to 1.1.1. This impacts an unknown function of the component Markdown Handler. The ma… |
CVE-2025-5494 | Low | 3.9 | 2025-09-25 | ZohoCorp ManageEngine Endpoint Central was impacted by an improper privilege management issue in the agent setup. This issue affects Endpoint Central: through… |
CVE-2025-59422 | Low | 3.1 | 2025-09-25 | Dify is an open-source LLM app development platform. In version 1.8.1, a broken access control vulnerability on the /console/api/apps/<APP_ID>chat-messages?con… |
CVE-2025-10946 | Low | 3.5 | 2025-09-25 | A vulnerability was detected in nuz007 smsboom up to 01b2f35bbbc23f3e0f60f38ca0e3d1b286f8d674. The affected element is an unknown function of the file dy.php… |
CVE-2025-10945 | Low | 3.5 | 2025-09-25 | A security vulnerability has been detected in nuz007 smsboom up to 01b2f35bbbc23f3e0f60f38ca0e3d1b286f8d674. Impacted is an unknown function of the file d.php… |
CVE-2025-10944 | Low | 3.5 | 2025-09-25 | A weakness has been identified in yi-ge get-header-ip up to 589b23d0eb0043c310a6a13ce4bbe2505d0d0b15. This issue affects the function ip of the file ip.php. Th… |
CVE-2025-10943 | Low | 3.5 | 2025-09-25 | A security flaw has been discovered in MikeCen WeChat-Face-Recognition up to 6e3f72bf8547d80b59e330f1137e4aa505f492c1. This vulnerability affects the function… |
CVE-2025-10940 | Low | 2.4 | 2025-09-25 | A vulnerability was found in Total.js CMS 1.0.0. Affected by this vulnerability is the function layouts_save of the file /admin/ of the component Layout Page… |
CVE-2025-10909 | Low | 2.4 | 2025-09-24 | A security flaw has been discovered in Mangati NovoSGA up to 2.2.9. The impacted element is an unknown function of the file /admin of the component SVG File Ha… |
CVE-2025-23346 | Low | 3.3 | 2025-09-24 | NVIDIA CUDA Toolkit contains a vulnerability in cuobjdump, where an unprivileged user can cause a NULL pointer dereference. A successful exploit of this vulne… |
CVE-2025-23340 | Low | 3.3 | 2025-09-24 | NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the nvdisasm binary where a user may cause an out-of-bounds read by passing a malformed ELF f… |
CVE-2025-23339 | Low | 3.3 | 2025-09-24 | NVIDIA CUDA Toolkit for all platforms contains a vulnerability in cuobjdump where an attacker may cause a stack-based buffer overflow by getting the user to ru… |
CVE-2025-23338 | Low | 3.3 | 2025-09-24 | NVIDIA CUDA Toolkit for all platforms contains a vulnerability in nvdisasm where a user may cause an out-of-bounds write by running nvdisasm on a malicious ELF… |
CVE-2025-23308 | Low | 3.3 | 2025-09-24 | NVIDIA CUDA Toolkit for all platforms contains a vulnerability in nvdisasm where an attacker may cause a heap-based buffer overflow by getting the user to run… |
CVE-2025-23273 | Low | 2.5 | 2025-09-24 | NVIDIA CUDA Toolkit for all platforms contains a vulnerability in nvJPEG where a local authenticated user may cause a divide by zero error by submitting a spec… |
CVE-2025-23271 | Low | 3.3 | 2025-09-24 | NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the nvdisasm binary where a user may cause an out-of-bounds read by passing a malformed ELF f… |
CVE-2025-23255 | Low | 3.3 | 2025-09-24 | NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the cuobjdump binary where a user may cause an out-of-bounds read by passing a malformed ELF… |
CVE-2025-23248 | Low | 3.3 | 2025-09-24 | NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the nvdisasm binary where a user may cause an out-of-bounds read by passing a malformed ELF f… |
CVE-2025-59546 | Low | 2.4 | 2025-09-23 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, administrators and conte… |
CVE-2025-0672 | Low | 3.3 | 2025-09-23 | An authentication bypass vulnerability exists in multiple WSO2 products when FIDO authentication is enabled. When a user account is deleted, the system does no… |
CVE-2017-20200 | Low | 3.7 | 2025-09-23 | A vulnerability has been found in Coinomi up to 1.7.6. This issue affects some unknown processing. Such manipulation leads to cleartext transmission of sensiti… |
CVE-2025-8282 | Low | 3.5 | 2025-09-23 | The SureForms WordPress plugin before 1.9.1 does not sanitise and escape some parameters when outputing them in the page, which could allow admin and above us… |
CVE-2025-10837 | Low | 3.5 | 2025-09-23 | A security vulnerability has been detected in code-projects Simple Food Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-10823 | Low | 3.3 | 2025-09-23 | A vulnerability was found in axboe fio up to 3.41. This affects the function str_buffer_pattern_cb of the file options.c. Performing manipulation results in nu… |
CVE-2025-58012 | Low | 3.8 | 2025-09-22 | Authorization Bypass Through User-Controlled Key vulnerability in Alex Content Mask content-mask allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2025-58009 | Low | 3.8 | 2025-09-22 | Missing Authorization vulnerability in codepeople CP Multi View Event Calendar cp-multi-view-calendar allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-10778 | Low | 3.1 | 2025-09-22 | A vulnerability has been found in Smartstore up to 6.2.0. The affected element is an unknown function of the file /checkout/confirm/ of the component Gift Vouc… |
CVE-2025-10776 | Low | 3.7 | 2025-09-22 | A vulnerability was detected in LionCoders SalePro POS up to 5.5.0. This issue affects some unknown processing of the component Login. Performing manipulation… |
CVE-2025-10761 | Low | 3.7 | 2025-09-21 | A vulnerability has been found in Harness 3.3.0. Affected is an unknown function of the file /api/v1/login of the component Login Endpoint. The manipulation le… |
CVE-2025-10758 | Low | 2.4 | 2025-09-21 | A security vulnerability has been detected in htmly up to 3.1.0. The impacted element is an unknown function of the file /htmly/admin/field/post of the compone… |
CVE-2025-9081 | Low | 3.1 | 2025-09-19 | Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate access controls which allows any authenticated user to download sensitive fil… |
CVE-2025-59692 | Low | 3.7 | 2025-09-18 | PureVPN client applications on Linux through September 2025 mishandle firewalling. They flush the system's existing iptables rules and apply default ACCEPT pol… |
CVE-2025-59691 | Low | 3.7 | 2025-09-18 | PureVPN client applications on Linux through September 2025 allow IPv6 traffic to leak outside the VPN tunnel upon network events such as Wi-Fi reconnect or sy… |
CVE-2025-10671 | Low | 3.7 | 2025-09-18 | A vulnerability has been found in youth-is-as-pale-as-poetry e-learning 1.0. Impacted is the function encryptSecret of the file e-learning-master\exam-api\src\… |
CVE-2025-4444 | Low | 3.7 | 2025-09-18 | A security flaw has been discovered in Tor up to 0.4.7.16/0.4.8.17. Impacted is an unknown function of the component Onion Service Descriptor Handler. Performi… |
CVE-2025-30187 | Low | 3.7 | 2025-09-18 | In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to cause a d… |
CVE-2025-10642 | Low | 3.5 | 2025-09-18 | A vulnerability has been found in wangchenyi1996 chat_forum up to 80bdb92f5b460d36cab36e530a2c618acef5afd2. This impacts an unknown function of the file /q.php… |
CVE-2025-10632 | Low | 3.5 | 2025-09-18 | A security flaw has been discovered in itsourcecode Online Petshop Management System 1.0. The affected element is an unknown function of the file availablefram… |
CVE-2025-10631 | Low | 3.5 | 2025-09-18 | A vulnerability was identified in itsourcecode Online Petshop Management System 1.0. Impacted is an unknown function of the file addcnp.php of the component Av… |
CVE-2025-59410 | Low | 3.7 | 2025-09-17 | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the code in the scheduler for downloading a tiny file is… |
CVE-2025-59349 | Low | 3.3 | 2025-09-17 | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, DragonFly2 uses the os.MkdirAll function to create certa… |
CVE-2025-59414 | Low | 3.1 | 2025-09-17 | Nuxt is an open-source web development framework for Vue.js. Prior to 3.19.0 and 4.1.0, A client-side path traversal vulnerability in Nuxt's Island payload rev… |
CVE-2025-10591 | Low | 3.5 | 2025-09-17 | A weakness has been identified in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/educar_funcao_cad.php of the component… |
CVE-2025-10584 | Low | 3.5 | 2025-09-17 | A vulnerability was identified in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /intranet/educar_calendario_anotacao_cad.php. Suc… |
CVE-2025-30075 | Low | 2.2 | 2025-09-16 | In Alludo MindManager before 25.0.208 on Windows, attackers could potentially execute code as other local users on the same machine if they could write DLL fil… |
CVE-2025-59270 | Low | 3.1 | 2025-09-16 | psPAS PowerShell module does not explicitly enforce TLS 1.2 within the 'Get-PASSAMLResponse' function during the SAML authentication process. An unauthenticate… |
CVE-2025-26710 | Low | 3.5 | 2025-09-16 | There is an an information disclosure vulnerability in ZTE T5400. Due to improper configuration of the access control mechanism, attackers can obtain informati… |
CVE-2025-59453 | Low | 3.2 | 2025-09-16 | Click Studios Passwordstate before 9.9 Build 9972 has a potential authentication bypass for Passwordstate emergency access. By using a crafted URL while on the… |
CVE-2025-59437 | Low | 3.2 | 2025-09-16 | The ip (aka node-ip) package through 2.0.1 (in NPM) might allow SSRF because the IP address value 0 is improperly categorized as globally routable via isPublic… |
CVE-2025-59436 | Low | 3.2 | 2025-09-16 | The ip (aka node-ip) package through 2.0.1 (in NPM) might allow SSRF because the IP address value 017700000001 is improperly categorized as globally routable v… |
CVE-2025-43357 | Low | 3.3 | 2025-09-15 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Sequoia… |
CVE-2025-43349 | Low | 2.8 | 2025-09-15 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Sequoia… |
CVE-2025-43344 | Low | 3.3 | 2025-09-15 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, w… |
CVE-2025-43328 | Low | 3.3 | 2025-09-15 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to access sensitive user data. |
CVE-2025-43301 | Low | 3.3 | 2025-09-15 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 2… |
CVE-2025-43294 | Low | 3.3 | 2025-09-15 | An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 26.1 and iPadOS 26.1… |
CVE-2025-43283 | Low | 3.3 | 2025-09-15 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Tahoe 26. An app may be able to cause unexpected system termina… |
CVE-2025-59399 | Low | 3.1 | 2025-09-15 | libocpp before 0.28.0 allows a denial of service (EVerest crash) because a secondary exception is thrown during error message generation. |
CVE-2025-59398 | Low | 3.1 | 2025-09-15 | The OCPP implementation in libocpp before 0.26.2 allows a denial of service (EVerest crash) via JSON input larger than 255 characters, because a CiString<255>… |
CVE-2025-59377 | Low | 3.7 | 2025-09-15 | feiskyer mcp-kubernetes-server through 0.1.11 allows OS command injection, even in read-only mode, via /mcp/kubectl because shell=True is used. NOTE: this is u… |
CVE-2025-59376 | Low | 3.7 | 2025-09-15 | feiskyer mcp-kubernetes-server through 0.1.11 does not consider chained commands in the implementation of --disable-write and --disable-delete, e.g., it allows… |
CVE-2025-9084 | Low | 3.1 | 2025-09-15 | Mattermost versions 10.5.x <= 10.5.9 fail to properly validate redirect URLs which allows attackers to redirect users to malicious sites via crafted OAuth logi… |
CVE-2025-10434 | Low | 2.4 | 2025-09-15 | A vulnerability was identified in IbuyuCMS up to 2.6.3. Impacted is an unknown function of the file /admin/article.php?a=mod of the component Add Article Page… |
CVE-2025-10423 | Low | 3.7 | 2025-09-15 | A vulnerability was found in newbee-mall 1.0. Impacted is the function mallKaptcha of the file /common/mall/kaptcha. The manipulation results in guessable capt… |
CVE-2025-0164 | Low | 2.3 | 2025-09-14 | IBM QRadar SIEM 7.5 through 7.5 Update Pack 13 Independent Fix 01 could allow a local privileged user to perform unauthorized actions on configuration files du… |
CVE-2025-10388 | Low | 3.5 | 2025-09-14 | A vulnerability was identified in Selleo Mentingo 2025.08.27. This issue affects some unknown processing of the file /api/course/enroll-course of the component… |
CVE-2025-10373 | Low | 3.5 | 2025-09-13 | A security vulnerability has been detected in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /intranet/educar_turma_ti… |
CVE-2025-10372 | Low | 3.5 | 2025-09-13 | A weakness has been identified in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /intranet/educar_modulo_cad.php. This manipulatio… |
CVE-2025-10370 | Low | 3.5 | 2025-09-13 | A vulnerability was identified in MiczFlor RPi-Jukebox-RFID up to 2.8.0. This vulnerability affects unknown code of the file /htdocs/userScripts.php. The manip… |
CVE-2025-10369 | Low | 3.5 | 2025-09-13 | A vulnerability was determined in MiczFlor RPi-Jukebox-RFID up to 2.8.0. This affects an unknown part of the file /htdocs/cardRegisterNew.php. Executing manipu… |
CVE-2025-10368 | Low | 3.5 | 2025-09-13 | A vulnerability was found in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected by this issue is some unknown functionality of the file /htdocs/manageFilesFolders… |
CVE-2025-10367 | Low | 3.5 | 2025-09-13 | A vulnerability has been found in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected by this vulnerability is an unknown functionality of the file /htdocs/cardEdi… |
CVE-2025-10366 | Low | 3.5 | 2025-09-13 | A flaw has been found in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected is an unknown function of the file /htdocs/inc.setWlanIpMail.php. This manipulation of… |
CVE-2025-10340 | Low | 3.5 | 2025-09-13 | A vulnerability was determined in WhatCD Gazelle up to 63b337026d49b5cf63ce4be20fdabdc880112fa3. The affected element is an unknown function of the file /secti… |
CVE-2025-10332 | Low | 3.5 | 2025-09-13 | A vulnerability was found in cdevroe unmark up to 1.9.3. Impacted is an unknown function of the file application/views/marks/info.php. Performing manipulation… |
CVE-2025-10331 | Low | 3.5 | 2025-09-13 | A vulnerability has been found in cdevroe unmark up to 1.9.3. This issue affects some unknown processing of the file /application/controllers/Marks.php. Such m… |
CVE-2025-10320 | Low | 3.1 | 2025-09-12 | A vulnerability was detected in iteachyou Dreamer CMS up to 4.1.3.2. This issue affects some unknown processing of the file /admin/user/updatePwd. Performing m… |
CVE-2025-27238 | Low | 3.5 | 2025-09-12 | Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them. |
CVE-2025-3650 | Low | 3.5 | 2025-09-12 | The jQuery Colorbox WordPress plugin through 4.6.3 uses the colorbox library, which does not sanitize title attributes on links before using them, allowing use… |
CVE-2025-10287 | Low | 3.1 | 2025-09-12 | A vulnerability has been found in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40. The affected element is an unknown function of the file /au… |
CVE-2025-10273 | Low | 3.5 | 2025-09-12 | A vulnerability was identified in erjinzhi 10OA 1.0. Affected by this vulnerability is an unknown functionality of the file /view/file.aspx. Such manipulation… |
CVE-2025-56556 | Low | 3.8 | 2025-09-11 | An issue was discovered in Subrion CMS 4.2.1, allowing authenticated adminitrators or moderators with access to the built-in Run SQL Query feature under the SQ… |
CVE-2025-10255 | Low | 3.5 | 2025-09-11 | A vulnerability was determined in Ascensio System SIA OnlyOffice up to 12.7.0. Impacted is an unknown function of the file /Products/Projects/Messages.aspx of… |
CVE-2025-10254 | Low | 3.5 | 2025-09-11 | A vulnerability was found in Ascensio System SIA OnlyOffice up to 12.7.0. This issue affects some unknown processing of the file /Products/Projects/Messages.as… |
CVE-2025-10253 | Low | 3.5 | 2025-09-11 | A vulnerability has been found in openDCIM 23.04. This vulnerability affects unknown code of the file /scripts/uploadifive.php of the component SVG File Handle… |
CVE-2025-10252 | Low | 3.1 | 2025-09-11 | A flaw has been found in SEAT Queue Ticket Kiosk up to 20250827. This affects an unknown part of the component Java RMI Registry Handler. This manipulation cau… |
CVE-2025-10246 | Low | 3.5 | 2025-09-11 | A weakness has been identified in lokibhardwaj PHP-Code-For-Unlimited-File-Upload up to 124fe96324915490c81eaf7db3234b0b4e4bab3c. This affects an unknown part… |
CVE-2025-6088 | Low | 3.1 | 2025-09-11 | In version 0.7.8 of danny-avila/librechat, improper authorization controls in the conversation sharing feature allow unauthorized access to other users' conver… |
CVE-2025-10235 | Low | 2.4 | 2025-09-11 | A flaw has been found in Scada-LTS up to 2.7.8.1. This issue affects some unknown processing of the file /reports.shtm of the component Reports Module. This ma… |
CVE-2025-10234 | Low | 2.4 | 2025-09-11 | A vulnerability was detected in Scada-LTS up to 2.7.8.1. This vulnerability affects unknown code of the file /data_point_edit.shtm of the component Data Point… |
CVE-2025-10216 | Low | 2.6 | 2025-09-10 | A vulnerability was detected in GrandNode up to 2.3.0. The impacted element is an unknown function of the file /checkout/ConfirmOrder/ of the component Voucher… |
CVE-2025-10222 | Low | 3.3 | 2025-09-10 | Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) in the diagnostic dump component in AxxonSoft Axxon One VMS (C-Werk) 2.0.0 through 2.0.1 o… |
CVE-2025-8277 | Low | 3.1 | 2025-09-09 | A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory du… |
CVE-2025-59014 | Low | 2.7 | 2025-09-09 | An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users t… |
CVE-2025-40803 | Low | 3.1 | 2025-09-09 | A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions). The affected device exposes certain non-critical information from the… |
CVE-2025-40802 | Low | 3.1 | 2025-09-09 | A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions). The affected device may be susceptible to resource exhaustion when su… |
CVE-2025-9111 | Low | 3.5 | 2025-09-09 | The AI ChatBot for WordPress WordPress plugin before 7.1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as a… |
CVE-2025-8889 | Low | 3.8 | 2025-09-09 | The Compress & Upload WordPress plugin before 1.0.5 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary… |