Low-severity CVEs (page 4)
Page 4 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-24288 | Low | 2.9 | 2026-09-14 | An issue in Portable Puzzle Collection before 20230116.5782e29 allows attackers to cause a Denial of Service (DoS) via creating an excessive amount of save sta… |
CVE-2023-24287 | Low | 2.9 | 2026-09-14 | Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the "M" command. |
CVE-2023-24286 | Low | 2.9 | 2026-09-14 | Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the game description parameter. |
CVE-2023-24285 | Low | 2.9 | 2026-09-14 | Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow which is triggered when an unusually long move is executed. |
CVE-2023-24284 | Low | 2.9 | 2026-09-14 | Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the is_markable() function. |
CVE-2026-90623 | Low | 3.7 | 2026-09-14 | A weakness has been identified in andreashappe cochise up to 0.4.1. Affected is the function asyncssh.connect of the file src/cochise/ssh_connection.py of the… |
CVE-2026-90622 | Low | 3.3 | 2026-09-14 | A security flaw has been discovered in GNU libredwg 0.13.4. This impacts the function DWG_TABLE of the file src/dwg.spec of the component Layer Encoding. Perfo… |
CVE-2023-24283 | Low | 2.9 | 2026-09-14 | Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow which allows attackers to cause a Denial of Service (DoS) via a… |
CVE-2023-24035 | Low | 3.5 | 2026-09-14 | An issue was discovered in Nagios XI before 5.9.3. The is_insecure_login_authenticated function uses a insecure timing comparison that leads to an attacker bei… |
CVE-2023-24034 | Low | 3.1 | 2026-09-14 | An issue was discovered in twilio_ajax_handler.php in Nagios XI before 5.9.3. An attacker can force a user to visit a malicious site by using a open redirect v… |
CVE-2023-22632 | Low | 2.7 | 2026-09-14 | PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the FTP Server Count Sensor. |
CVE-2023-22631 | Low | 2.7 | 2026-09-14 | PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the HTTP XML/REST Sensor. |
CVE-2026-38924 | Low | 2.9 | 2026-09-14 | In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier observed that 0.0.0.0 was a "potential secur… |
CVE-2026-33970 | Low | 3.5 | 2026-09-14 | An issue was discovered in NR RRC and L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400… |
CVE-2026-33968 | Low | 2.8 | 2026-09-14 | An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. In the camera driver, a Time-of-Check… |
CVE-2026-33967 | Low | 2.8 | 2026-09-14 | An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. In the camera driver, an out-of-bounds… |
CVE-2026-33966 | Low | 2.8 | 2026-09-14 | An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. An information Leak occurs in the came… |
CVE-2026-90613 | Low | 3.3 | 2026-09-14 | A security flaw has been discovered in GPAC up to f1219cde. Affected by this vulnerability is the function stbl_GetSampleInfos of the file isomedia/stbl_read.c… |
CVE-2026-90612 | Low | 3.3 | 2026-09-14 | A vulnerability was identified in GPAC up to f1219cde. Affected is the function gf_sm_dump_command_list of the file scene_manager/scene_dump.c of the component… |
CVE-2026-90611 | Low | 3.3 | 2026-09-14 | A vulnerability was determined in GPAC up to f1219cde. This impacts the function xmt_parse_element of the file scene_manager/loader_xmt.c of the component MP4B… |
CVE-2026-90610 | Low | 3.3 | 2026-09-14 | A vulnerability was found in GPAC up to f1219cde. This affects the function gf_svg_attributes_copy of the file scenegraph/svg_attributes.c of the component MP4… |
CVE-2026-33962 | Low | 2.8 | 2026-09-14 | An issue was discovered in Wi-Fi in Samsung Mobile Processor Exynos 850, 1280, 1330, 1380, 1480, 2400, W920, and W930. A malformed Netlink command can trigger… |
CVE-2026-33960 | Low | 2.8 | 2026-09-14 | An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 1580, 1680, W920, W930, and W1000. . A malformed ioctl comm… |
CVE-2026-33956 | Low | 2.8 | 2026-09-14 | An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, and 2500. Sending a malformed message to the test_msg sysfs… |
CVE-2026-23793 | Low | 3.5 | 2026-09-14 | An issue was discovered in Samsung Mobile Processor Exynos 1330, 1380, 1480, and 2400. An out-of-bounds memory access vulnerability in the camera GDC driver ma… |
CVE-2026-90609 | Low | 3.3 | 2026-09-14 | A vulnerability has been found in GPAC up to f1219cde. The impacted element is an unknown function of the file scenegraph/vrml_tools.c of the component MP4Box… |
CVE-2026-23786 | Low | 2.8 | 2026-09-14 | An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. A TOCTOU race condition in the Exyn… |
CVE-2025-64031 | Low | 2.5 | 2026-09-14 | libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archive_compressor_gzip_open in arc… |
CVE-2026-90604 | Low | 3.5 | 2026-09-14 | A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. This affects an unknown part of the component Anchor Tag Handler. Performing a manip… |
CVE-2026-90602 | Low | 3.5 | 2026-09-13 | A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this vulnerability is the function renderHistory of the file I… |
CVE-2026-52297 | Low | 2.9 | 2026-09-13 | FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in libavformat/mov.c. |
CVE-2026-52296 | Low | 2.9 | 2026-09-13 | FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c. |
CVE-2026-35867 | Low | 3.1 | 2026-09-13 | A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of the LB-LINK router AC1900_AZ2 V1.0.2 via shell m… |
CVE-2026-38332 | Low | 2.9 | 2026-09-13 | TinyEXIF before 1.1.0 has a heap-based buffer over-read in EntryParser::Fetch methods reachable via a crafted SubjectArea length. |
CVE-2025-70820 | Low | 3.5 | 2026-09-13 | Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder. |
CVE-2026-90576 | Low | 3.3 | 2026-09-13 | A security vulnerability has been detected in GPAC up to f1219cde. Affected is the function gf_node_list_add_child of the file scenegraph/base_scenegraph.c of… |
CVE-2025-64059 | Low | 1.8 | 2026-09-13 | Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admins are allowed to… |
CVE-2025-45480 | Low | 3.0 | 2026-09-13 | Floodlight 71fe8a7 allows disruption of host communication via link spoofing. A port is misclassified as a non-boundary. |
CVE-2026-90575 | Low | 3.7 | 2026-09-13 | A weakness has been identified in PHPGurukul Small CRM 4.0. This impacts the function unserialize of the file /crm/login.php of the component Login Success Han… |
CVE-2026-90573 | Low | 3.3 | 2026-09-13 | A vulnerability was identified in GPAC up to f1219cde. The impacted element is the function gf_sg_mfurl_del of the file scenegraph/vrml_tools.c of the componen… |
CVE-2026-90570 | Low | 2.4 | 2026-09-13 | A vulnerability has been found in linlinjava litemall 1.4.0/1.5.0/1.6.0/1.7.0/1.8.0. This issue affects the function AdminGoodsService.validate of the file lit… |
CVE-2026-90569 | Low | 2.4 | 2026-09-13 | A flaw has been found in linlinjava litemall 1.5.0/1.6.0/1.7.0/1.8.0. This vulnerability affects the function AdminTopicController.validate of the file litemal… |
CVE-2026-90568 | Low | 3.5 | 2026-09-13 | A vulnerability was detected in moxi624 Mogu Blog v2 up to 5.2. This affects the function BlogSortServiceImpl.addBlogSort of the file mogu_web/src/main/resourc… |
CVE-2026-90567 | Low | 3.5 | 2026-09-13 | A security vulnerability has been detected in quequnlong shiyi-blog up to 1.2.1. Affected by this issue is the function highlightKeyword of the file blog-web/s… |
CVE-2026-90564 | Low | 3.5 | 2026-09-13 | A vulnerability was identified in quequnlong shiyi-blog 1.0.0-1.2.1. This impacts the function SysChatMsgMapper.getChatMsgList of the file blog-web/src/views/c… |
CVE-2026-90563 | Low | 3.5 | 2026-09-13 | A vulnerability was determined in maliangnansheng bbs-springboot 3.0.0. This affects the function utils.toToc of the file ArticleController.java. This manipula… |
CVE-2026-90529 | Low | 3.5 | 2026-09-13 | A vulnerability has been found in DataEase up to 2.10.25/2.10.26. Affected by this issue is the function buildTooltip of the file core/core-frontend/src/views/… |
CVE-2026-90528 | Low | 3.5 | 2026-09-13 | A flaw has been found in TDuckApp tduck-platform up to 5.3. Affected by this vulnerability is an unknown functionality of the file tduck-front/src/views/form/w… |
CVE-2026-90773 | Low | 3.2 | 2026-09-13 | procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column. Local attackers can execute pro… |
CVE-2026-90771 | Low | 3.7 | 2026-09-13 | joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error cod… |
CVE-2026-90508 | Low | 3.4 | 2026-09-13 | A security flaw has been discovered in Chengdu Qilu Technology Ludashi 6.1026.4715.714. Affected by this vulnerability is the function MessageNotifyCallback in… |
CVE-2026-90503 | Low | 2.3 | 2026-09-13 | A flaw has been found in Chengdu Qilu Technology Ludashi 6.1026.4715.714. The affected element is the function sub_11008 in the library ComputerZ_x64.sys. Exec… |
CVE-2026-90502 | Low | 3.5 | 2026-09-13 | A vulnerability was detected in stilleshan ServerStatus 1.0/2.0. Impacted is an unknown function of the file server/src/main.cpp of the component Stats Generat… |
CVE-2026-90497 | Low | 3.5 | 2026-09-13 | A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11. Affected by this vulnerability is the function getTitle of the file application/view… |
CVE-2026-86407 | Low | 3.7 | 2026-09-13 | The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account… |
CVE-2026-90489 | Low | 3.5 | 2026-09-13 | A vulnerability was identified in Xuxueli xxl-job up to 3.5.0. This vulnerability affects unknown code of the file /jobinfo/insert. Such manipulation of the ar… |
CVE-2026-79300 | Low | 3.5 | 2026-09-12 | SEP sesam before 5.2.0.24 mishandles User Authorization with MFA. If AD authentication is configured and MFA is enforced, an attacker can create a second OTP a… |
CVE-2026-84025 | Low | 2.2 | 2026-09-12 | The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing… |
CVE-2026-82851 | Low | 2.7 | 2026-09-12 | The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing user… |
CVE-2026-11765 | Low | 3.3 | 2026-09-11 | Improper neutralization of argument delimiters in a command ('argument injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Par… |
CVE-2026-86779 | Low | 2.7 | 2026-09-11 | The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-obj… |
CVE-2025-15695 | Low | 3.5 | 2026-09-11 | The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the bundled front-end scripts build markup… |
CVE-2026-89162 | Low | 2.9 | 2026-09-11 | In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is… |
CVE-2026-89160 | Low | 3.7 | 2026-09-11 | PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject. |
CVE-2026-89156 | Low | 2.9 | 2026-09-11 | PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data. |
CVE-2026-89151 | Low | 3.5 | 2026-09-11 | Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature. |
CVE-2026-78131 | Low | 3.7 | 2026-09-11 | strongSwan 4.2.0 through 6.0.7 has a missing release of memory after its effective lifetime in the x509 plugin's attribute certificate parser. |
CVE-2026-78127 | Low | 3.7 | 2026-09-11 | libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser. |
CVE-2026-78124 | Low | 3.7 | 2026-09-11 | strongSwan 5.0.2 through 6.0.7 allows PKCS#7 certificate enumeration in the openssl plugin that leads to a lack of release of memory after its effective lifeti… |
CVE-2026-45761 | Low | 3.3 | 2026-09-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a cra… |
CVE-2026-88013 | Low | 3.7 | 2026-09-10 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attach… |
CVE-2026-61910 | Low | 3.5 | 2026-09-09 | An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetK… |
CVE-2026-61909 | Low | 3.5 | 2026-09-09 | An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to anot… |
CVE-2026-61908 | Low | 3.1 | 2026-09-09 | An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to d… |
CVE-2026-87876 | Low | 3.0 | 2026-09-09 | Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attri… |
CVE-2026-46460 | Low | 3.5 | 2026-09-09 | Dell PowerScale OneFS, versions 9.5.0.0 through 9.7.1.15, versions 9.8.0.0 through 9.13.1.0, and versions prior to 9.15.0.0, contain an Incorrect Authorization… |
CVE-2026-79944 | Low | 3.4 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Least Privilege Violation vulnerabili… |
CVE-2026-79942 | Low | 3.4 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Execution with Unnecessary Privilege… |
CVE-2026-79693 | Low | 3.4 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Least Privilege Violation vulnerabili… |
CVE-2026-79736 | Low | 3.7 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vuln… |
CVE-2026-79732 | Low | 3.7 | 2026-09-09 | Dell Secure Connect Gateway (SCG) 5.0 Appliance, versions prior to 5.36.00.xx, contains an Improper Certificate Validation vulnerability. An unauthenticated at… |
CVE-2026-79729 | Low | 3.7 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vuln… |
CVE-2026-79690 | Low | 3.7 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vuln… |
CVE-2026-86763 | Low | 3.5 | 2026-09-09 | Snipe-IT versions >= 7.0.12 and <= 8.6.3 contain an authorization bypass in the Livewire importer component (App\Livewire\Importer, mounted at the imports.inde… |
CVE-2026-86744 | Low | 2.2 | 2026-09-09 | Snipe-IT 8.6.3 and earlier (and develop pre-release commits prior to the fix) contain a race condition in the asset checkout paths. Api\AssetsController::check… |
CVE-2026-86740 | Low | 3.8 | 2026-09-09 | Snipe-IT before 8.7.0 fails to check the return value of Storage::delete() in UploadedFilesController::destroy() and Api\\UploadedFilesController::destroy(), a… |
CVE-2026-86739 | Low | 3.1 | 2026-09-09 | Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put() when writing the signature PNG and the generated acceptance PDF in Account\Acceptanc… |
CVE-2026-86203 | Low | 3.7 | 2026-09-09 | PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets from clients. Attackers can exploit a race condition… |
CVE-2026-80169 | Low | 3.3 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information i… |
CVE-2026-79966 | Low | 3.3 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information i… |
CVE-2026-80239 | Low | 2.4 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Exposure of Sensitive System Informa… |
CVE-2026-79727 | Low | 3.3 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Exposure of Sensitive System Informa… |
CVE-2026-86776 | Low | 3.3 | 2026-09-09 | KeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes before memory allocation in the ReadHeaderField function. Attackers can craft a m… |
CVE-2026-80175 | Low | 3.3 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information i… |
CVE-2026-13146 | Low | 3.7 | 2026-09-09 | The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowi… |
CVE-2026-13144 | Low | 3.7 | 2026-09-09 | The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its ban… |
CVE-2026-87657 | Low | 3.1 | 2026-09-09 | Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory inside the sandb… |
CVE-2026-87652 | Low | 3.1 | 2026-09-09 | Incorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web ori… |
CVE-2026-87647 | Low | 3.4 | 2026-09-09 | Uninitialized resource in GPU in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside… |
CVE-2026-87614 | Low | 3.1 | 2026-09-09 | Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass w… |