Low-severity CVEs (page 34)
Page 34 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-4011 | Low | 3.5 | 2025-04-28 | A vulnerability has been found in Redmine 6.0.0/6.0.1/6.0.2/6.0.3 and classified as problematic. This vulnerability affects unknown code of the component Custo… |
CVE-2025-32471 | Low | 3.7 | 2025-04-28 | The device’s passwords have not been adequately salted, making them vulnerable to password extraction attacks. |
CVE-2025-0627 | Low | 3.5 | 2025-04-28 | The WordPress Tag, Category, and Taxonomy Manager WordPress plugin before 3.30.0 does not sanitise and escape some of its Widgets settings, which could allow… |
CVE-2024-9771 | Low | 3.5 | 2025-04-28 | The WP-Recall WordPress plugin before 16.26.12 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2025-4001 | Low | 3.3 | 2025-04-28 | A vulnerability has been found in scipopt scip up to 9.2.1 and classified as problematic. Affected by this vulnerability is the function main of the file examp… |
CVE-2025-4000 | Low | 3.5 | 2025-04-28 | A vulnerability, which was classified as problematic, was found in Seeyon Zhiyuan OA Web Application System 8.1 SP2. Affected is an unknown function of the fil… |
CVE-2025-3999 | Low | 3.5 | 2025-04-28 | A vulnerability, which was classified as problematic, has been found in Seeyon Zhiyuan OA Web Application System 8.1 SP2. This issue affects some unknown proce… |
CVE-2025-3996 | Low | 2.4 | 2025-04-28 | A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525. It has been rated as problematic. Affected by this issue is some unknown functionality of the fil… |
CVE-2025-3995 | Low | 2.4 | 2025-04-28 | A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525. It has been declared as problematic. Affected by this vulnerability is an unknown functionality o… |
CVE-2025-3994 | Low | 2.4 | 2025-04-28 | A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525. It has been classified as problematic. Affected is an unknown function of the file /home.htm of t… |
CVE-2025-3985 | Low | 2.7 | 2025-04-27 | A vulnerability was found in Apereo CAS 5.2.6. It has been classified as problematic. This affects the function ResponseEntity of the file cas-5.2.6\webapp-mgm… |
CVE-2025-3970 | Low | 3.5 | 2025-04-27 | A vulnerability classified as problematic has been found in baseweb JSite up to 1.0. Affected is an unknown function of the file /sys/office/save. The manipula… |
CVE-2025-3965 | Low | 3.5 | 2025-04-27 | A vulnerability has been found in itwanger paicoding 1.0.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2024-52887 | Low | 3.5 | 2025-04-27 | Authenticated end-user may set a specially crafted SNX bookmark that can make their browser run a script while accessing their own bookmark list. |
CVE-2025-3962 | Low | 3.5 | 2025-04-27 | A vulnerability classified as problematic was found in withstars Books-Management-System 1.0. This vulnerability affects unknown code of the file /api/comment/… |
CVE-2025-3961 | Low | 3.5 | 2025-04-27 | A vulnerability classified as problematic has been found in withstars Books-Management-System 1.0. This affects an unknown part of the file /admin/article/add/… |
CVE-2025-3958 | Low | 3.5 | 2025-04-27 | A vulnerability was found in withstars Books-Management-System 1.0. It has been classified as problematic. Affected is an unknown function of the file /book_ed… |
CVE-2025-46675 | Low | 3.5 | 2025-04-27 | In NASA CryptoLib before 1.3.2, the key state is not checked before use, potentially leading to spacecraft hijacking. |
CVE-2025-46674 | Low | 3.5 | 2025-04-27 | NASA CryptoLib before 1.3.2 uses Extended Procedures that are a Work in Progress (not intended for use during flight), potentially leading to a keystream oracl… |
CVE-2025-46672 | Low | 3.5 | 2025-04-27 | NASA CryptoLib before 1.3.2 does not check the OTAR crypto function returned status, potentially leading to spacecraft hijacking. |
CVE-2025-46656 | Low | 2.9 | 2025-04-26 | python-markdownify (aka markdownify) before 0.14.1 allows large headline prefixes such as <h9999999> in addition to <h1> through <h6>. This causes memory consu… |
CVE-2025-3954 | Low | 3.7 | 2025-04-26 | A vulnerability, which was classified as problematic, has been found in ChurchCRM 5.16.0. Affected by this issue is some unknown functionality of the component… |
CVE-2025-46653 | Low | 3.1 | 2025-04-26 | Formidable (aka node-formidable) 2.1.0 through 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, he… |
CVE-2025-2850 | Low | 3.5 | 2025-04-26 | A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT180… |
CVE-2025-46618 | Low | 3.5 | 2025-04-25 | In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tab |
CVE-2025-3637 | Low | 3.1 | 2025-04-25 | A security vulnerability was found in Moodle where confidential information that prevents cross-site request forgery (CSRF) attacks was shared publicly through… |
CVE-2025-3635 | Low | 3.5 | 2025-04-25 | A security vulnerability was discovered in Moodle that allows anyone to duplicate existing tours without needing to log in due to a lack of protection against… |
CVE-2024-57375 | Low | 2.4 | 2025-04-25 | Andamiro Pump It Up 20th Anniversary (aka Double X or XX/2019) 1.00.0-2.08.3 allows a physically proximate attacker to cause a denial of service (application c… |
CVE-2025-46546 | Low | 3.5 | 2025-04-25 | In Sherpa Orchestrator 141851, multiple time-based blind SQL injections can be performed by an authenticated user. This affects api/gui/asset/list, /api/gui/fi… |
CVE-2024-30127 | Low | 3.2 | 2025-04-24 | Missing "no cache" headers in HCL Leap permits sensitive data to be cached. |
CVE-2023-37516 | Low | 3.2 | 2025-04-24 | Missing "no cache" headers in HCL Leap permits user directory information to be cached. |
CVE-2024-30114 | Low | 3.7 | 2025-04-24 | Insufficient sanitization in HCL Leap allows client-side script injection in the authoring environment. |
CVE-2025-41423 | Low | 3.1 | 2025-04-24 | Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate permissions for the API endpoint /plugins/playbooks/api/v0/… |
CVE-2025-25046 | Low | 3.7 | 2025-04-23 | IBM InfoSphere Information Server 11.7 DataStage Flow Designer transmits sensitive information via URL or query parameters that could be exposed to an unauth… |
CVE-2024-58251 | Low | 2.5 | 2025-04-23 | In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a d… |
CVE-2025-46394 | Low | 3.2 | 2025-04-23 | In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences. |
CVE-2025-46393 | Low | 2.9 | 2025-04-23 | In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary orde… |
CVE-2025-43965 | Low | 2.9 | 2025-04-23 | In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used. |
CVE-2025-23253 | Low | 2.5 | 2025-04-22 | NVIDIA NvContainer service for Windows contains a vulnerability in its usage of OpenSSL, where an attacker could exploit a hard-coded constant issue by copying… |
CVE-2025-3850 | Low | 3.7 | 2025-04-22 | A vulnerability, which was classified as problematic, has been found in YXJ2018 SpringBoot-Vue-OnlineExam 1.0. This issue affects some unknown processing of th… |
CVE-2025-2987 | Low | 3.8 | 2025-04-22 | IBM Maximo Asset Management 7.6.1.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests… |
CVE-2025-3841 | Low | 3.3 | 2025-04-21 | A vulnerability, which was classified as problematic, was found in wix-incubator jam up to e87a6fd85cf8fb5ff37b62b2d68f917219d07ae9. This affects an unknown pa… |
CVE-2025-43916 | Low | 3.4 | 2025-04-21 | Sonos api.sonos.com through 2025-04-21, when the /login/v3/oauth endpoint is used, accepts a redirect_uri containing userinfo in the authority component, which… |
CVE-2025-32408 | Low | 2.5 | 2025-04-21 | In Soffid Console 3.6.31 before 3.6.32, authorization to use the pam service is mishandled. |
CVE-2025-25228 | Low | 3.8 | 2025-04-21 | A SQL injection in VirtueMart component 1.0.0 - 4.4.7 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the produc… |
CVE-2025-43967 | Low | 2.9 | 2025-04-21 | libheif before 1.19.6 has a NULL pointer dereference in ImageItem_Grid::get_decoder in image-items/grid.cc because a grid image can reference a nonexistent ima… |
CVE-2025-43966 | Low | 2.9 | 2025-04-21 | libheif before 1.19.6 has a NULL pointer dereference in ImageItem_iden in image-items/iden.cc. |
CVE-2025-43964 | Low | 2.9 | 2025-04-21 | In LibRaw before 0.21.4, tag 0x412 processing in phase_one_correct in decoders/load_mfbacks.cpp does not enforce minimum w0 and w1 values. |
CVE-2025-43963 | Low | 2.9 | 2025-04-21 | In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in 0… |
CVE-2025-43962 | Low | 2.9 | 2025-04-21 | In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp has out-of-bounds reads for tag 0x412 processing, related to large w0 or w1 values or t… |
CVE-2025-43961 | Low | 2.9 | 2025-04-21 | In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser. |
CVE-2025-43955 | Low | 2.2 | 2025-04-20 | TwsCachedXPathAPI in Convertigo through 8.3.4 does not restrict the use of commons-jxpath APIs. |
CVE-2025-3826 | Low | 2.4 | 2025-04-20 | A vulnerability, which was classified as problematic, was found in SourceCodester Web-based Pharmacy Product Management System 1.0. This affects an unknown par… |
CVE-2025-3825 | Low | 2.4 | 2025-04-20 | A vulnerability, which was classified as problematic, has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. Affected by this issue… |
CVE-2025-3824 | Low | 2.4 | 2025-04-20 | A vulnerability classified as problematic was found in SourceCodester Web-based Pharmacy Product Management System 1.0. Affected by this vulnerability is an un… |
CVE-2025-3823 | Low | 2.4 | 2025-04-20 | A vulnerability classified as problematic has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. Affected is an unknown function of… |
CVE-2025-3822 | Low | 2.4 | 2025-04-20 | A vulnerability was found in SourceCodester Web-based Pharmacy Product Management System 1.0. It has been rated as problematic. This issue affects some unknown… |
CVE-2025-3821 | Low | 2.4 | 2025-04-20 | A vulnerability was found in SourceCodester Web-based Pharmacy Product Management System 1.0. It has been declared as problematic. This vulnerability affects u… |
CVE-2023-30421 | Low | 2.9 | 2025-04-19 | mystrtod in mjson 1.2.7 requires more than a billion iterations during processing of certain digit strings such as 8891110122900e913013935755114. |
CVE-2023-26819 | Low | 2.9 | 2025-04-19 | cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b": [ null,999999999999999999999999999999999999999999999991234567… |
CVE-2022-47112 | Low | 2.5 | 2025-04-19 | 7-Zip 22.01 does not report an error for certain invalid xz files, involving stream flags and reserved bits. Some later versions are unaffected. |
CVE-2022-47111 | Low | 2.5 | 2025-04-19 | 7-Zip 22.01 does not report an error for certain invalid xz files, involving block flags and reserved bits. Some later versions are unaffected. |
CVE-2025-3806 | Low | 2.4 | 2025-04-19 | A vulnerability, which was classified as problematic, has been found in dazhouda lecms up to 3.0.3. Affected by this issue is some unknown functionality of the… |
CVE-2025-3801 | Low | 2.4 | 2025-04-19 | A vulnerability was found in songquanpeng one-api up to 0.6.10. It has been classified as problematic. This affects an unknown part of the component System Set… |
CVE-2025-3795 | Low | 2.4 | 2025-04-18 | A vulnerability was found in DaiCuo 1.3.13. It has been rated as problematic. Affected by this issue is some unknown functionality of the component SEO Optimiz… |
CVE-2025-25985 | Low | 2.6 | 2025-04-18 | An issue in Macro-video Technologies Co.,Ltd V380E6_C1 IP camera (Hw_HsAKPIQp_WF_XHR) 1020302 allows a physically proximate attacker to execute arbitrary code… |
CVE-2025-25983 | Low | 3.4 | 2025-04-18 | An issue in Macro-video Technologies Co.,Ltd V380 Pro android application 2.1.44 and V380 Pro android application 2.1.64 allows an attacker to obtain sensitive… |
CVE-2025-3789 | Low | 3.5 | 2025-04-18 | A vulnerability was found in baseweb JSite 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /a/sys/area/… |
CVE-2025-3788 | Low | 3.5 | 2025-04-18 | A vulnerability was found in baseweb JSite 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /a/… |
CVE-2025-3787 | Low | 2.7 | 2025-04-18 | A vulnerability was found in PbootCMS 3.2.5. It has been classified as problematic. Affected is an unknown function of the component Image Handler. The manipul… |
CVE-2024-42178 | Low | 2.5 | 2025-04-17 | HCL MyXalytics is affected by a failure to restrict URL access vulnerability. Unauthenticated users might gain unauthorized access to potentially confidential… |
CVE-2024-42177 | Low | 2.6 | 2025-04-17 | HCL MyXalytics is affected by SSL∕TLS Protocol affected with BREACH & LUCKY13 vulnerabilities. Attackers can exploit the weakness in the ciphers to intercept a… |
CVE-2025-26269 | Low | 3.3 | 2025-04-17 | DragonflyDB Dragonfly through 1.28.2 (fixed in 1.29.0) allows authenticated users to cause a denial of service (daemon crash) via a Lua library command that re… |
CVE-2025-26268 | Low | 3.3 | 2025-04-17 | DragonflyDB Dragonfly before 1.27.0 allows authenticated users to cause a denial of service (daemon crash) via a crafted Redis command. The validity of the sca… |
CVE-2021-47671 | Low | 3.3 | 2025-04-17 | In the Linux kernel, the following vulnerability has been resolved: can: etas_es58x: es58x_rx_err_msg(): fix memory leak in error path In es58x_rx_err_msg()… |
CVE-2025-32415 | Low | 2.9 | 2025-04-17 | In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XM… |
CVE-2025-26478 | Low | 3.1 | 2025-04-17 | Dell ECS version 3.8.1.4 and prior contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could pot… |
CVE-2025-29931 | Low | 3.7 | 2025-04-17 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected product does not properly validate a length field in a… |
CVE-2025-1525 | Low | 3.5 | 2025-04-17 | The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2025-1524 | Low | 3.5 | 2025-04-17 | The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2025-1523 | Low | 3.5 | 2025-04-17 | The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2024-11924 | Low | 3.5 | 2025-04-17 | The Icegram Express formerly known as Email Subscribers WordPress plugin before 5.7.52 does not sanitise and escape some of its settings, which could allow hi… |
CVE-2025-43708 | Low | 3.3 | 2025-04-17 | VisiCut 2.1 allows stack consumption via an XML document with nested set elements, as demonstrated by a java.util.HashMap StackOverflowError when reference='… |
CVE-2025-32789 | Low | 3.1 | 2025-04-16 | EspoCRM is an Open Source Customer Relationship Management software. Prior to version 9.0.7, users can be sorted by their password hash. This flaw allows an at… |
CVE-2025-32787 | Low | 3.1 | 2025-04-16 | SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. Versions 5.02.5184 to 5.02.5187 are vulnerable to NULL dereference in `DeleteIPv6De… |
CVE-2025-3730 | Low | 3.3 | 2025-04-16 | A vulnerability, which was classified as problematic, was found in PyTorch 2.6.0. Affected is the function torch.nn.functional.ctc_loss of the file aten/src/AT… |
CVE-2024-58249 | Low | 3.7 | 2025-04-16 | In wxWidgets before 3.2.7, a crash can be triggered in wxWidgets apps when connections are refused in wxWebRequestCURL. |
CVE-2025-3692 | Low | 2.4 | 2025-04-16 | A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown function… |
CVE-2024-58248 | Low | 3.5 | 2025-04-16 | nopCommerce through 4.90.1 does not offer locking for order placement. Thus there is a race condition with duplicate redeeming of gift cards. |
CVE-2025-3691 | Low | 2.7 | 2025-04-16 | A vulnerability was found in mirweiye Seven Bears Library CMS 2023. It has been classified as problematic. Affected is an unknown function of the component Add… |
CVE-2025-3688 | Low | 2.4 | 2025-04-16 | A vulnerability, which was classified as problematic, was found in mirweiye Seven Bears Library CMS 2023. This affects an unknown part of the component Backgro… |
CVE-2025-31363 | Low | 3.0 | 2025-04-16 | Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.9 fail to restrict domains the LLM can request to contact upstream which allows an authe… |
CVE-2025-27538 | Low | 2.2 | 2025-04-16 | Mattermost versions 10.5.x <= 10.5.1, 9.11.x <= 9.11.9 fail to enforce MFA checks in PUT /api/v4/users/user-id/mfa when the requesting user differs from the ta… |
CVE-2025-24839 | Low | 3.1 | 2025-04-16 | Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to prevent Wrangler posts from triggering AI responses. This vulnerability allows… |
CVE-2025-32435 | Low | 2.6 | 2025-04-15 | Hydra is a Continuous Integration service for Nix based projects. Evaluation of untrusted non-flake nix code could potentially access secrets that are accessib… |
CVE-2025-32021 | Low | 2.2 | 2025-04-15 | Weblate is a web based localization tool. Prior to version 5.11, when creating a new component from an existing component that has a source code repository URL… |
CVE-2025-30731 | Low | 3.6 | 2025-04-15 | Vulnerability in the Oracle Applications Technology Stack product of Oracle E-Business Suite (component: Configuration). Supported versions that are affected… |
CVE-2025-30703 | Low | 2.7 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9… |
CVE-2025-30700 | Low | 3.5 | 2025-04-15 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). The supported version that is affected is 11. Eas… |
CVE-2025-30681 | Low | 2.7 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4… |