Low-severity CVEs (page 41)
Page 41 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-5153 | Low | 3.5 | 2025-05-25 | A vulnerability, which was classified as problematic, has been found in CMS Made Simple 2.2.21. This issue affects some unknown processing of the component Des… |
CVE-2025-5138 | Low | 3.5 | 2025-05-25 | A vulnerability was found in Bitwarden up to 2.25.1. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the com… |
CVE-2025-5136 | Low | 3.7 | 2025-05-25 | A vulnerability, which was classified as problematic, was found in Tmall Demo up to 20250505. This affects an unknown part of the file /tmall/order/pay/ of the… |
CVE-2025-5135 | Low | 2.4 | 2025-05-24 | A vulnerability, which was classified as problematic, has been found in Tmall Demo up to 20250505. Affected by this issue is some unknown functionality of the… |
CVE-2025-5134 | Low | 3.5 | 2025-05-24 | A vulnerability classified as problematic was found in Tmall Demo up to 20250505. Affected by this vulnerability is an unknown functionality of the component B… |
CVE-2025-5127 | Low | 3.5 | 2025-05-24 | A vulnerability was determined in Teledyne FLIR AX8 up to 1.46.16. This issue affects some unknown processing of the file /prod.php. Executing manipulation of… |
CVE-2025-48756 | Low | 2.9 | 2025-05-24 | In group_number in the scsir crate 0.2.0 for Rust, there can be an overflow because a hardware device may expect a small number of bits (e.g., 5 bits) for grou… |
CVE-2025-48755 | Low | 2.9 | 2025-05-24 | In the spiral-rs crate 0.2.0 for Rust, allocation can be attempted for a ZST (zero-sized type). |
CVE-2025-48754 | Low | 2.9 | 2025-05-24 | In the memory_pages crate 0.1.0 for Rust, division by zero can occur. |
CVE-2025-48753 | Low | 2.9 | 2025-05-24 | In the anode crate 0.1.0 for Rust, data races can occur in unlock in SpinLock. |
CVE-2025-48752 | Low | 2.9 | 2025-05-24 | In the process-sync crate 0.2.2 for Rust, the drop function lacks a check for whether the pthread_mutex is unlocked. |
CVE-2025-48751 | Low | 2.9 | 2025-05-24 | The process_lock crate 0.1.0 for Rust allows data races in unlock. |
CVE-2025-48376 | Low | 3.5 | 2025-05-23 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, a malicious SuperUser (H… |
CVE-2023-53154 | Low | 2.9 | 2025-05-23 | parse_string in cJSON before 1.7.18 has a heap-based buffer over-read via {"1":1, with no trailing newline if cJSON_ParseWithLength is called. |
CVE-2024-9163 | Low | 3.5 | 2025-05-23 | A business logic error in GitLab CE/EE affecting all versions starting from 12.1 prior to 17.10.7, 17.11 prior to 17.11.3 and 18.0 prior to 18.0.1 where an att… |
CVE-2025-1110 | Low | 2.7 | 2025-05-22 | An issue has been discovered in GitLab CE/EE affecting all versions from 18.0 before 18.0.1. In certain circumstances, a user with limited permissions could ac… |
CVE-2023-47466 | Low | 2.9 | 2025-05-22 | TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a crafted WAV file in which an id3 chunk is the only valid chunk. |
CVE-2025-48070 | Low | 3.5 | 2025-05-21 | Plane is open-source project management software. Versions prior to 0.23 have insecure permissions in UserSerializer that allows users to change fields that ar… |
CVE-2025-48064 | Low | 3.3 | 2025-05-21 | GitHub Desktop is an open-source, Electron-based GitHub app designed for git development. Prior to version 3.4.20-beta3, an attacker convincing a user to view… |
CVE-2025-5031 | Low | 3.1 | 2025-05-21 | A vulnerability was found in Ackites KillWxapkg up to 2.4.1. It has been rated as problematic. This issue affects some unknown processing of the component wxap… |
CVE-2025-48009 | Low | 3.1 | 2025-05-21 | Missing Authorization vulnerability in Drupal Single Content Sync allows Functionality Misuse.This issue affects Single Content Sync: from 0.0.0 before 1.4.12. |
CVE-2025-5011 | Low | 2.4 | 2025-05-21 | A vulnerability classified as problematic was found in moonlightL hexo-boot 4.3.0. This vulnerability affects unknown code of the file /admin/home/index.html o… |
CVE-2025-5010 | Low | 2.4 | 2025-05-21 | A vulnerability classified as problematic has been found in moonlightL hexo-boot 4.3.0. This affects an unknown part of the file /admin/home/index.html of the… |
CVE-2025-5007 | Low | 3.5 | 2025-05-20 | A vulnerability was found in Part-DB up to 1.17.0. It has been declared as problematic. Affected by this vulnerability is the function handleUpload of the file… |
CVE-2025-5001 | Low | 3.3 | 2025-05-20 | A vulnerability was found in GNU PSPP 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb. It has been declared as problematic. This vulnerability affects the function ca… |
CVE-2025-4996 | Low | 2.4 | 2025-05-20 | A vulnerability, which was classified as problematic, has been found in Intelbras RF 301K 1.1.5. This issue affects some unknown processing of the component Ad… |
CVE-2025-48015 | Low | 3.7 | 2025-05-20 | Failed login response could be different depending on whether the username was local or central. |
CVE-2025-47938 | Low | 3.8 | 2025-05-20 | TYPO3 is an open source, PHP based web content management system. Starting in version 9.0.0 and prior to versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4… |
CVE-2025-47937 | Low | 3.7 | 2025-05-20 | TYPO3 is an open source, PHP based web content management system. Starting in version 9.0.0 and prior to versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4… |
CVE-2025-47936 | Low | 3.3 | 2025-05-20 | TYPO3 is an open source, PHP based web content management system. In versions on the 12.x branch prior to 12.4.31 LTS and the 13.x branch prior to 13.4.2 LTS… |
CVE-2025-4945 | Low | 3.7 | 2025-05-19 | A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software. The vulnerability arises when processi… |
CVE-2025-31185 | Low | 3.3 | 2025-05-19 | A logic issue was addressed with improved checks. This issue is fixed in iOS 18.3 and iPadOS 18.3. Photos in the Hidden Photos Album may be viewed without auth… |
CVE-2025-27566 | Low | 3.8 | 2025-05-19 | Path traversal vulnerability exists in a-blog cms versions prior to Ver. 3.1.43 and versions prior to Ver. 3.0.47. This is an issue with insufficient path vali… |
CVE-2025-23165 | Low | 3.7 | 2025-05-19 | In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently o… |
CVE-2025-4894 | Low | 3.7 | 2025-05-18 | A vulnerability classified as problematic was found in calmkart Django-sso-server up to 057247929a94ffc358788a37ab99e391379a4d15. This vulnerability affects th… |
CVE-2025-48219 | Low | 3.5 | 2025-05-18 | O2 UK before 2025-05-19 allows subscribers to determine the Cell ID of other subscribers by initiating an IMS (IP Multimedia Subsystem) call and then reading t… |
CVE-2025-4860 | Low | 2.4 | 2025-05-18 | A vulnerability classified as problematic has been found in D-Link DAP-2695 120b36r137_ALL_en_20210528. Affected is an unknown function of the file /adv_dhcps… |
CVE-2025-4859 | Low | 2.4 | 2025-05-18 | A vulnerability was found in D-Link DAP-2695 120b36r137_ALL_en_20210528. It has been rated as problematic. This issue affects some unknown processing of the fi… |
CVE-2025-4858 | Low | 2.4 | 2025-05-18 | A vulnerability was found in D-Link DAP-2695 120b36r137_ALL_en_20210528. It has been declared as problematic. This vulnerability affects unknown code of the fi… |
CVE-2025-4852 | Low | 2.4 | 2025-05-18 | A vulnerability, which was classified as problematic, has been found in TOTOLINK A3002R 2.1.1-B20230720.1011. This issue affects some unknown processing of the… |
CVE-2025-4839 | Low | 3.1 | 2025-05-17 | A vulnerability has been found in itwanger paicoding 1.0.0/1.0.1/1.0.2/1.0.3 and classified as problematic. Affected by this vulnerability is an unknown functi… |
CVE-2025-4819 | Low | 3.1 | 2025-05-17 | A vulnerability classified as problematic has been found in y_project RuoYi 4.8.0. Affected is an unknown function of the file /monitor/online/batchForceLogout… |
CVE-2025-48188 | Low | 2.9 | 2025-05-16 | libpspp-core.a in GNU PSPP through 2.0.1 has an incorrect call from fill_buffer (in data/encrypted-file.c) to the Gnulib rijndaelDecrypt function, leading to a… |
CVE-2025-22233 | Low | 3.1 | 2025-05-16 | CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names. However, the… |
CVE-2025-47794 | Low | 2.6 | 2025-05-16 | Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0… |
CVE-2025-4745 | Low | 3.5 | 2025-05-16 | A vulnerability, which was classified as problematic, was found in code-projects Employee Record System 1.0. This affects an unknown part of the file current_e… |
CVE-2025-4744 | Low | 3.5 | 2025-05-16 | A vulnerability, which was classified as problematic, has been found in code-projects Employee Record System 1.0. Affected by this issue is some unknown functi… |
CVE-2025-4727 | Low | 3.7 | 2025-05-15 | A vulnerability was found in Meteor up to 3.2.1 and classified as problematic. This issue affects the function Object.assign of the file packages/ddp-server/li… |
CVE-2024-7762 | Low | 3.7 | 2025-05-15 | The Simple Job Board WordPress plugin before 2.12.6 does not prevent uploaded files from being listed, allowing unauthenticated users to access and download up… |
CVE-2024-6711 | Low | 3.5 | 2025-05-15 | The Event Tickets with Ticket Scanner WordPress plugin before 2.3.8 does not sanitise and escape some parameters, which could allow users with a role as low as… |
CVE-2024-4091 | Low | 3.5 | 2025-05-15 | The Responsive Gallery Grid WordPress plugin before 2.3.15 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2024-4004 | Low | 3.5 | 2025-05-15 | The Advanced Cron Manager WordPress plugin before 2.5.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-4002 | Low | 3.5 | 2025-05-15 | The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.6.9 does not sanitise and escape some of its settings, which could allow high privilege… |
CVE-2024-3996 | Low | 3.5 | 2025-05-15 | The Smart Post Show WordPress plugin before 2.4.28 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-12767 | Low | 3.5 | 2025-05-15 | The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private posts |
CVE-2024-11140 | Low | 3.5 | 2025-05-15 | The Real WP Shop Lite Ajax eCommerce Shopping Cart WordPress plugin through 2.0.8 does not sanitise and escape some of its settings, which could allow high pri… |
CVE-2024-10098 | Low | 2.7 | 2025-05-15 | The ApplyOnline WordPress plugin before 2.6.3 does not protect uploaded files during the application process, allowing unauthenticated users to access them an… |
CVE-2023-7297 | Low | 3.5 | 2025-05-15 | The TwitterPosts WordPress plugin through 1.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in a… |
CVE-2025-47279 | Low | 3.1 | 2025-05-15 | Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vuln… |
CVE-2025-2570 | Low | 2.7 | 2025-05-15 | Mattermost versions 10.5.x <= 10.5.3, 9.11.x <= 9.11.11 fail to check `RestrictSystemAdmin` setting if user doesn't have access to `ExperimentalSettings` which… |
CVE-2025-27525 | Low | 3.9 | 2025-05-15 | Information Exposure vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows.This issue affects JP1/IT Desktop Management 2 - Sm… |
CVE-2025-32421 | Low | 3.7 | 2025-05-14 | Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and 15.1.6 have a race-condition vulnerability. This issue onl… |
CVE-2025-0135 | Low | 3.3 | 2025-05-14 | An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on macOS devices enables a locally authenticated non administrativ… |
CVE-2025-23233 | Low | 3.5 | 2025-05-13 | Incorrect execution-assigned permissions for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated user to potentially e… |
CVE-2025-22848 | Low | 3.5 | 2025-05-13 | Improper conditions check for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated user to potentially enable denial of… |
CVE-2025-20084 | Low | 3.5 | 2025-05-13 | Uncontrolled resource consumption for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated user to potentially enable d… |
CVE-2025-20057 | Low | 3.5 | 2025-05-13 | Uncontrolled resource consumption for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated user to potentially enable d… |
CVE-2025-20030 | Low | 2.6 | 2025-05-13 | Exposure of sensitive information to an unauthorized actor for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated use… |
CVE-2024-31150 | Low | 3.8 | 2025-05-13 | Out-of-bounds read for some Intel(R) Graphics Driver software may allow an authenticated user to potentially enable information disclosure via local access. |
CVE-2024-35281 | Low | 2.5 | 2025-05-13 | An improper isolation or compartmentalization vulnerability [CWE-653] in FortiClientMac version 7.4.2 and below, version 7.2.8 and below, 7.0 all versions and… |
CVE-2024-12533 | Low | 3.3 | 2025-05-13 | Improper Check for Unusual or Exceptional Conditions vulnerability in Phoenix SecureCore Technology 4 allows Input Data Manipulation.This issue affects SecureC… |
CVE-2025-40571 | Low | 2.2 | 2025-05-13 | A vulnerability has been identified in Mendix OIDC SSO (Mendix 10.12 compatible) (All versions < V4.0.1), Mendix OIDC SSO (Mendix 9 compatible) (All versions <… |
CVE-2025-22246 | Low | 3.0 | 2025-05-13 | Cloud Foundry UAA release versions from v77.21.0 to v7.31.0 are vulnerable to a private key exposure in logs. |
CVE-2025-46748 | Low | 2.7 | 2025-05-12 | An authenticated user attempting to change their password could do so without using the current password. |
CVE-2025-46744 | Low | 2.7 | 2025-05-12 | An authenticated administrator could modify the Created By username for a user account |
CVE-2025-46718 | Low | 3.3 | 2025-05-12 | sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with limited sudo privileges (e.g. execution of a single… |
CVE-2025-46717 | Low | 3.3 | 2025-05-12 | sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with no (or very limited) sudo privileges can determine w… |
CVE-2025-4551 | Low | 3.5 | 2025-05-11 | A vulnerability, which was classified as problematic, was found in ContiNew Admin up to 3.6.0. Affected is an unknown function of the file /dev-api/common/file… |
CVE-2025-4547 | Low | 2.4 | 2025-05-11 | A vulnerability was found in SourceCodester Web-based Pharmacy Product Management System 1.0. It has been rated as problematic. Affected by this issue is some… |
CVE-2025-4542 | Low | 3.1 | 2025-05-11 | A vulnerability, which was classified as problematic, has been found in Freeebird Hotel 酒店管理系统 API up to 1.2. Affected by this issue is some unknown functional… |
CVE-2025-4537 | Low | 3.1 | 2025-05-11 | A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.8.9 and classified as problematic. Affected by this issue is some unknown functionality of the fil… |
CVE-2025-4534 | Low | 3.7 | 2025-05-11 | A vulnerability, which was classified as problematic, has been found in SunGrow Logger1000 01_A. This issue affects some unknown processing. The manipulation l… |
CVE-2025-4533 | Low | 2.7 | 2025-05-11 | A vulnerability classified as problematic was found in JeecgBoot up to 3.8.0. This vulnerability affects the function unzipFile of the file /jeecg-boot/airag/k… |
CVE-2025-4527 | Low | 3.7 | 2025-05-11 | A security flaw has been discovered in Dígitro NGC Explorer up to 3.48.21. The impacted element is an unknown function of the component Password Transmission H… |
CVE-2025-47816 | Low | 2.9 | 2025-05-10 | libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause an spvxml-helpers.c spvxml_parse_attributes out-of-bounds read, related to extra content at… |
CVE-2025-4495 | Low | 3.5 | 2025-05-10 | A vulnerability has been found in JAdmin-JAVA JAdmin 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2025-4470 | Low | 2.4 | 2025-05-09 | A vulnerability classified as problematic was found in SourceCodester Online Student Clearance System 1.0. Affected by this vulnerability is an unknown functio… |
CVE-2025-4469 | Low | 2.4 | 2025-05-09 | A vulnerability classified as problematic has been found in SourceCodester Online Student Clearance System 1.0. Affected is an unknown function of the file /ad… |
CVE-2025-4461 | Low | 2.4 | 2025-05-09 | A vulnerability classified as problematic was found in TOTOLINK N150RT 3.4.0-B20190525. This vulnerability affects unknown code of the component Virtual Server… |
CVE-2025-47737 | Low | 2.9 | 2025-05-09 | lib.rs in the trailer crate through 0.1.2 for Rust mishandles allocating with a size of zero. |
CVE-2025-47736 | Low | 2.9 | 2025-05-09 | dialect/mod.rs in the libsql-sqlite3-parser crate through 0.13.0 before 14f422a for Rust can crash if the input is not valid UTF-8. |
CVE-2025-47735 | Low | 2.9 | 2025-05-09 | inner::drop in inner.rs in the wgp crate through 0.2.0 for Rust lacks drop_slow thread synchronization. |
CVE-2025-4460 | Low | 2.4 | 2025-05-09 | A vulnerability classified as problematic has been found in TOTOLINK N150RT 3.4.0-B20190525. This affects an unknown part of the component URL Filtering Page… |
CVE-2025-46712 | Low | 3.7 | 2025-05-08 | Erlang/OTP is a set of libraries for the Erlang programming language. In versions prior to OTP-27.3.4 (for OTP-27), OTP-26.2.5.12 (for OTP-26), and OTP-25.3.2… |
CVE-2025-44021 | Low | 2.8 | 2025-05-08 | OpenStack Ironic before 29.0.1 can write unintended files to a target node disk during image handling (if a deployment was performed via the API). A malicious… |
CVE-2025-47729 | Low | 1.9 | 2025-05-08 | The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different functio… |
CVE-2023-7303 | Low | 3.5 | 2025-05-07 | A vulnerability, which was classified as problematic, was found in q2apro q2apro-on-site-notifications up to 1.4.6. This affects the function process_request o… |
CVE-2025-46824 | Low | 3.1 | 2025-05-07 | The Discourse Code Review Plugin allows users to review GitHub commits on Discourse. Prior to commit eed3a80, an attacker can execute arbitrary JavaScript on u… |
CVE-2025-46551 | Low | 3.7 | 2025-05-07 | JRuby-OpenSSL is an add-on gem for JRuby that emulates the Ruby OpenSSL native library. Starting in JRuby-OpenSSL version 0.12.1 and prior to version 0.15.4 (c… |
CVE-2025-20977 | Low | 3.3 | 2025-05-07 | Use of implicit intent for sensitive communication in translation in Samsung Notes prior to version 4.4.29.23 allows local attackers to get sensitive informati… |