Low-severity CVEs (page 6)
Page 6 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-13945 | Low | 3.1 | 2026-06-30 | Insufficient policy enforcement in Extensions in Google Chrome on Linux prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious… |
CVE-2026-13944 | Low | 3.1 | 2026-06-30 | Inappropriate implementation in DataTransfer in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specifi… |
CVE-2026-13942 | Low | 3.3 | 2026-06-30 | Inappropriate implementation in Video Capture in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a local attacker to perform UI spoofing via a crafted… |
CVE-2026-13939 | Low | 3.1 | 2026-06-30 | Insufficient validation of untrusted input in WebShare in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the ren… |
CVE-2026-9836 | Low | 3.5 | 2026-06-30 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is affected by an information disclosure vulnerability. |
CVE-2026-58371 | Low | 3.1 | 2026-06-30 | SeaweedFS before 4.30 reflects the callback query parameter verbatim into responses served with Content-Type application/javascript in the shared writeJson hel… |
CVE-2026-10654 | Low | 3.1 | 2026-06-30 | A race condition in the Zephyr Bluetooth Classic RFCOMM host stack (subsys/bluetooth/host/classic/rfcomm.c) mishandles a simultaneous bidirectional session dis… |
CVE-2026-13758 | Low | 3.7 | 2026-06-29 | CryptX versions before 0.088_001 for Perl compare AEAD authentication tags in non-constant time in the streaming decrypt_done path. The decrypt_done($tag) for… |
CVE-2026-57946 | Low | 3.7 | 2026-06-29 | Invidious before version 2.20260626.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve private playlist content… |
CVE-2026-13746 | Low | 3.6 | 2026-06-29 | Improper neutralization of local CLI parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. A user could trigger this issue by su… |
CVE-2026-13587 | Low | 3.7 | 2026-06-29 | A vulnerability was found in seladb PcapPlusPlus 25.05. The affected element is the function parse_by_block_type of the file light_pcapng.c of the component Li… |
CVE-2026-13574 | Low | 3.3 | 2026-06-29 | A vulnerability was determined in llvm llvm-project up to 22.1.6. This impacts the function GCRelocateInst::getBasePtr in the library llvm/lib/IR/IntrinsicInst… |
CVE-2026-13573 | Low | 3.3 | 2026-06-29 | A vulnerability was found in llvm llvm-project up to 22.1.6. This affects the function llvm::StringMap::insert in the library /lib/IR/ValueSymbolTable.cpp of t… |
CVE-2026-13570 | Low | 3.5 | 2026-06-29 | A vulnerability was detected in SourceCodester Inventory Management System 1.0. Impacted is an unknown function of the file /api/users_handler.php of the compo… |
CVE-2026-13558 | Low | 3.5 | 2026-06-29 | A security flaw has been discovered in CodeAstro Complaint Management System 1.0. This issue affects some unknown processing of the file /report/addreport of t… |
CVE-2025-0824 | Low | 3.7 | 2026-06-29 | Lack of validation for firmware update in Hitachi Hitachi Virtual Storage Platform One Block 23, 24, 26, 28. This issue affects Hitachi Virtual Storage Platfo… |
CVE-2026-13523 | Low | 3.3 | 2026-06-29 | A weakness has been identified in GPAC up to 26.02.0. This affects an unknown part of the file src/utils/base_encoding.c of the component ISOBMFF Parser. Execu… |
CVE-2026-13514 | Low | 2.4 | 2026-06-29 | A weakness has been identified in Chess Play and Learn App up to 4.9.42 on Android. This issue affects some unknown processing of the file AndroidManifest.xml… |
CVE-2026-13511 | Low | 3.1 | 2026-06-28 | A vulnerability was determined in VoltAgent up to 2.1.17. Affected by this issue is the function handleGetMemoryConversation of the file packages/server-core/s… |
CVE-2026-13510 | Low | 3.7 | 2026-06-28 | A vulnerability was found in SimStudioAI sim up to 0.6.92. Affected by this vulnerability is an unknown functionality in the library apps/sim/lib/core/security… |
CVE-2026-13504 | Low | 3.5 | 2026-06-28 | A vulnerability has been found in code-projects Project Management System 1.0. This vulnerability affects unknown code of the file /mail.php of the component M… |
CVE-2026-13493 | Low | 3.1 | 2026-06-28 | A flaw has been found in AIDC-AI ComfyUI-Copilot up to 2.0.28. This issue affects some unknown processing of the file backend/controller/conversation_api.py of… |
CVE-2026-13491 | Low | 3.7 | 2026-06-28 | A vulnerability was detected in 78 xiaozhi-esp32 up to 2.2.6. This vulnerability affects the function Application::GetInstance of the file main/protocols/mqtt_… |
CVE-2026-13490 | Low | 3.7 | 2026-06-28 | A security vulnerability has been detected in glpi-project glpi 11.0.5/11.0.6/11.0.7. This affects the function Document::canViewFile of the file front/documen… |
CVE-2026-13489 | Low | 3.1 | 2026-06-28 | A weakness has been identified in 78 xiaozhi-esp32 up to 2.2.6. Affected by this issue is the function ParseMessage of the file main/mcp_server.cc of the compo… |
CVE-2026-13483 | Low | 3.1 | 2026-06-28 | A flaw has been found in arc53 DocsGPT up to 0.18.0. The affected element is the function encrypt_credentials of the file application/security/encryption.py of… |
CVE-2026-13482 | Low | 3.7 | 2026-06-28 | A vulnerability was detected in skypilot-org skypilot up to 0.12.0. Impacted is the function username.encode of the file sky/users/server.py of the component U… |
CVE-2026-58052 | Low | 3.3 | 2026-06-28 | 7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supp… |
CVE-2026-3472 | Low | 3.5 | 2026-06-26 | Mattermost versions 10.11.x <= 10.11.18, 11.6.x <= 11.6.3, 11.5.x <= 11.5.6 fail to properly apply markdown image rendering restrictions to AI bot tool result… |
CVE-2026-57926 | Low | 2.6 | 2026-06-26 | In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack |
CVE-2026-57922 | Low | 3.1 | 2026-06-26 | In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible |
CVE-2026-48936 | Low | 3.3 | 2026-06-26 | A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission. This vulnerab… |
CVE-2026-48935 | Low | 3.3 | 2026-06-26 | A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`. This vulnera… |
CVE-2026-13322 | Low | 3.8 | 2026-06-26 | A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest requests using textproto.Reader.ReadLine(), which buffers input in… |
CVE-2026-57522 | Low | 3.5 | 2026-06-25 | Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens(), which substitutes user-controlled val… |
CVE-2026-48940 | Low | 3.4 | 2026-06-25 | A Joomla user with K2 "create item" rights (Author tier by default) can submit an article whose `embedVideo` POST field contains a raw `<script>` tag; K2 store… |
CVE-2026-57588 | Low | 3.3 | 2026-06-25 | A SQL injection vulnerability in Nessus allows an attacker to craft a malicious scan result file that, when imported by a privileged user, injects malicious SQ… |
CVE-2026-57234 | Low | 2.6 | 2026-06-25 | Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default… |
CVE-2026-12755 | Low | 2.7 | 2026-06-25 | Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the UserGro… |
CVE-2026-42004 | Low | 3.7 | 2026-06-25 | An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT record when EDNS Client… |
CVE-2026-40208 | Low | 3.7 | 2026-06-25 | An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame. |
CVE-2026-40011 | Low | 3.7 | 2026-06-25 | An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be pro… |
CVE-2026-3176 | Low | 3.1 | 2026-06-25 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain cond… |
CVE-2026-0934 | Low | 3.8 | 2026-06-25 | GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain cond… |
CVE-2026-8662 | Low | 3.3 | 2026-06-25 | Path Traversal vulnerability in the create_archive function of Rapid7 InsightConnect Compression Plugin on Linux allows authenticated attackers to write to uni… |
CVE-2026-49979 | Low | 2.7 | 2026-06-24 | Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.99, the POST /api/v1/admin/send-test-email endpoint accepts attacker-c… |
CVE-2026-39894 | Low | 2.9 | 2026-06-24 | Cacti is an open source performance and fault management framework. In versions 1.2.30 and below, the locale-dependent decimal formatting in rrdtool_function_u… |
CVE-2026-52796 | Low | 3.5 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, specially crafted issue index pattern can cause a panic when rendering, resulting in denial of… |
CVE-2026-57288 | Low | 3.7 | 2026-06-24 | Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native (ADSI) authentica… |
CVE-2026-56370 | Low | 3.3 | 2026-06-24 | ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in ConnectedComponentsImage() when processing connected-components artifacts with in… |
CVE-2026-56368 | Low | 3.7 | 2026-06-24 | ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed. A… |
CVE-2026-10753 | Low | 2.7 | 2026-06-24 | The Site Kit by Google WordPress plugin before 1.176.0 does not properly restrict a REST API write endpoint to administrators, allowing lower-privileged users… |
CVE-2026-46549 | Low | 2.0 | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the OAuth token strategy attached oauth_scope and oauth_granted_resources to the… |
CVE-2026-54327 | Low | 2.2 | 2026-06-23 | Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi stored API keys and OAuth credentials in auth.json. A race condition in the file write pa… |
CVE-2026-54326 | Low | 2.5 | 2026-06-23 | Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi HTML exports render session Markdown into a static HTML file. It did not consistently rej… |
CVE-2026-57062 | Low | 2.9 | 2026-06-23 | CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes… |
CVE-2026-56968 | Low | 3.7 | 2026-06-23 | GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a craf… |
CVE-2025-15619 | Low | 3.5 | 2026-06-23 | HCL Connections contains a broken access control vulnerability that may allow an unauthorized user to view data in a single specific scenario. |
CVE-2026-56376 | Low | 3.7 | 2026-06-23 | ImageMagick before 7.1.2-15 and 6.9.13-40 contains a heap use-after-free in the meta coder: when memory allocation fails, a single byte is written to a stale p… |
CVE-2026-55654 | Low | 3.7 | 2026-06-23 | A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programmi… |
CVE-2026-49460 | Low | 3.3 | 2026-06-22 | pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes… |
CVE-2026-48931 | Low | 3.7 | 2026-06-22 | A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affect… |
CVE-2026-53663 | Low | 3.1 | 2026-06-22 | React Router is a router for React. From 7.12.0 until 7.15.1, certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests… |
CVE-2026-54282 | Low | 3.7 | 2026-06-22 | Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because… |
CVE-2026-53540 | Low | 3.7 | 2026-06-22 | Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parse_form() did not validate the Content-Length header before using it to bound… |
CVE-2026-53538 | Low | 3.7 | 2026-06-22 | Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlenc… |
CVE-2026-53537 | Low | 3.7 | 2026-06-22 | Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, parse_options_header parsed Content-Disposition (and Content-Type) headers with e… |
CVE-2026-49356 | Low | 3.2 | 2026-06-22 | Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingU… |
CVE-2026-9610 | Low | 2.3 | 2026-06-22 | IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 exposes resources or functionality that isn't linked in the UI but is acc… |
CVE-2026-8823 | Low | 3.8 | 2026-06-22 | Mattermost versions 11.7.x <= 11.7.0, 10.11.x <= 10.11.17 fail to validate bot targets when demoting users to guests which allows a lower-privileged administra… |
CVE-2026-8074 | Low | 3.8 | 2026-06-22 | Mattermost versions 11.7.x <= 11.7.0, 10.11.x <= 10.11.17 fail to enforce bot-specific permission checks on the user active status endpoint, which allows a Use… |
CVE-2026-12823 | Low | 3.3 | 2026-06-22 | A security flaw has been discovered in Browserbase Skills up to 20260526. This impacts an unknown function of the component Autobrowse Trace Artifact Handler… |
CVE-2026-12812 | Low | 3.5 | 2026-06-21 | A security vulnerability has been detected in Radware Cyber Controller up to 10.11.0. This affects an unknown part of the component HTML Report Generation. The… |
CVE-2026-56378 | Low | 3.7 | 2026-06-21 | ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a… |
CVE-2026-56367 | Low | 3.7 | 2026-06-21 | ImageMagick before 7.1.2-15 and 6.9.x before 6.9.13-40 contains an integer overflow in the PSB (PSD v2) RLE decoding path (ReadPSDChannelRLE in coders/psd.c) t… |
CVE-2026-56355 | Low | 3.7 | 2026-06-20 | GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization. |
CVE-2026-56330 | Low | 3.5 | 2026-06-20 | Capgo before 12.128.2 contains an open redirect vulnerability in stripe_portal and stripe_checkout endpoints that accept unvalidated callbackUrl, successUrl, a… |
CVE-2026-56325 | Low | 3.1 | 2026-06-20 | Capgo before 12.128.2 uses ILIKE pattern matching instead of exact matching for app_id lookup in the preview subdomain resolver, allowing underscore characters… |
CVE-2026-56212 | Low | 3.8 | 2026-06-20 | Capgo before 12.128.2 contains an authentication logic flaw: a user with permission to manage team or organization security settings can enable mandatory two-f… |
CVE-2026-49358 | Low | 3.0 | 2026-06-19 | PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `AbstractGenerator::$temporaryFiles` is a public arr… |
CVE-2026-9143 | Low | 3.7 | 2026-06-19 | There is an incorrect conversion between numeric types vulnerability in NI grpc-device due to missing range checks in CodeGen. This may silently discard high… |
CVE-2026-12047 | Low | 3.5 | 2026-06-19 | HTML injection in pgAdmin 4's cloud deployment module. The verify_credentials, deploy, regions, and update-server endpoints under /rds/, /azure/, /google/, and… |
CVE-2026-48617 | Low | 1.8 | 2026-06-18 | A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confidentiality impact or… |
CVE-2026-12102 | Low | 2.7 | 2026-06-18 | The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Insecure Direct Obj… |
CVE-2026-50268 | Low | 1.9 | 2026-06-17 | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Configuration.Encrypti… |
CVE-2026-12567 | Low | 2.2 | 2026-06-17 | The github_workflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing th… |
CVE-2026-12566 | Low | 3.1 | 2026-06-17 | The docker_pull module uses the realm parameter from a Docker registry's WWW-Authenticate response header as the authentication endpoint without validation. An… |
CVE-2026-6733 | Low | 3.7 | 2026-06-17 | Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an u… |
CVE-2026-39199 | Low | 2.9 | 2026-06-17 | snes9x 1.63 allows an out-of-bounds write and denial of service via a crafted .ups file. |
CVE-2026-11525 | Low | 3.7 | 2026-06-17 | Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case… |
CVE-2026-35068 | Low | 3.5 | 2026-06-17 | Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnera… |
CVE-2026-12458 | Low | 3.1 | 2026-06-17 | Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2026-0057 | Low | 3.3 | 2026-06-17 | In Contacts Provider, there is a possible way to access an incoming call's phone number and associated metadata due to a missing permission check. This could l… |
CVE-2025-62340 | Low | 3.1 | 2026-06-17 | HCL iControl was affected by Inadequate Session Timeout vulnerability. The vulnerability involves a security risk where a web application fails to automaticall… |
CVE-2026-46977 | Low | 3.2 | 2026-06-17 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported version that is affected is 7.2.8. Easil… |
CVE-2026-46874 | Low | 3.2 | 2026-06-17 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.8. Easily exploit… |
CVE-2026-46816 | Low | 3.2 | 2026-06-17 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported version that is affected is 7.2.8. Easil… |
CVE-2026-46815 | Low | 3.2 | 2026-06-17 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported version that is affected is 7.2.8. Easil… |
CVE-2026-0158 | Low | 3.3 | 2026-06-16 | In Camera, there is a possible unauthorized way to access photos due to a missing permission check. This could lead to local information disclosure with no add… |
CVE-2026-0145 | Low | 3.3 | 2026-06-16 | In keymint, there is a possible Permission Bypass due to a logic error in the code. This could lead to local information disclosure with no additional executio… |