Low-severity CVEs (page 7)
Page 7 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-59314 | Low | 3.7 | 2026-08-27 | Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file… |
CVE-2026-59306 | Low | 3.1 | 2026-08-27 | Potential for deserialization of untrusted types in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Strea… |
CVE-2026-59305 | Low | 3.1 | 2026-08-27 | Partition interceptor may be improperly added while sending message. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4… |
CVE-2026-59304 | Low | 3.1 | 2026-08-27 | Improper caching of the original content type in Spring Cloud Stream Avro. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Str… |
CVE-2026-59303 | Low | 3.1 | 2026-08-27 | Dynamic destination cache size is not properly bound in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud S… |
CVE-2026-59302 | Low | 3.1 | 2026-08-27 | Potential for logging sensitive data in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4… |
CVE-2026-59301 | Low | 3.1 | 2026-08-27 | Potential for logging sensitive data in Spring Cloud Function Azure. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Funct… |
CVE-2026-59300 | Low | 3.1 | 2026-08-27 | Potential for logging sensitive data in Spring Cloud Function AWS. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Functio… |
CVE-2026-59299 | Low | 3.1 | 2026-08-27 | Composition lookup can potentially poison base function in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Sprin… |
CVE-2026-59298 | Low | 3.1 | 2026-08-27 | Potential for improper filtering of HTTP headers in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud… |
CVE-2026-59297 | Low | 3.1 | 2026-08-27 | Implementation of isSecure() call of ServerlessHttpServletRequest does not verify the actual scheme. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function… |
CVE-2026-59292 | Low | 3.2 | 2026-08-27 | PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to ${java.io.tmpdir}/spring-integration/metadata-store.pr… |
CVE-2026-59291 | Low | 2.0 | 2026-08-27 | Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring C… |
CVE-2026-59277 | Low | 3.7 | 2026-08-27 | Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a gi… |
CVE-2026-54713 | Low | 3.7 | 2026-08-27 | CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with shouldBe… |
CVE-2026-81725 | Low | 3.7 | 2026-08-27 | NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption… |
CVE-2026-81723 | Low | 3.7 | 2026-08-27 | NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment() that rescans accumulated XML fragments on ev… |
CVE-2026-81717 | Low | 3.5 | 2026-08-27 | openssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable d… |
CVE-2026-81715 | Low | 3.3 | 2026-08-27 | openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-to… |
CVE-2026-81696 | Low | 3.3 | 2026-08-27 | openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious… |
CVE-2026-81695 | Low | 3.3 | 2026-08-27 | openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values printed to stderr during decrypt auto-detection. Attackers can craft enc… |
CVE-2026-81694 | Low | 3.3 | 2026-08-27 | openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the AES-GCM authenticated manifest) before… |
CVE-2026-81685 | Low | 3.3 | 2026-08-27 | openssl_encrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line sepa… |
CVE-2026-81102 | Low | 3.1 | 2026-08-27 | The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcp_server_dash.py constructed the server for it… |
CVE-2025-62343 | Low | 3.1 | 2026-08-27 | HCL IntelliOps Event Management (IEM) is affected by an Admin Session Concurrency Vulnerability. it may allows user sessions to remain active after logout or s… |
CVE-2026-13416 | Low | 3.5 | 2026-08-27 | The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming-soon page, allowing users with the Edi… |
CVE-2026-21807 | Low | 3.9 | 2026-08-26 | HCL BigFix Quantum Risk Analyzer binary lacks several critical, industry-standard hardening protections that could allow an attacker to cause a stack-based buf… |
CVE-2025-62341 | Low | 3.7 | 2026-08-26 | HCL Connections is vulnerable to server-side request forgery (SSRF) when an internal server is compromised possibly allowing an attacker to send unauthorized r… |
CVE-2026-21809 | Low | 3.9 | 2026-08-26 | HCL BigFix Quantum Risk Analyzer has a certain validation process that provides overly descriptive error messages when it encounters malformed input which can… |
CVE-2026-77573 | Low | 3.5 | 2026-08-26 | Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted to manage component… |
CVE-2026-77508 | Low | 3.5 | 2026-08-26 | Weblate is a web based localization tool. Prior to 2026.8, an authenticated user can change the account's primary email through PUT or PATCH requests to /api/u… |
CVE-2026-56547 | Low | 3.5 | 2026-08-26 | The Apple profile generated for the Apple built-in Mail, Calendar and Contacts account to synchronize with HCL Traveler requires the Logon Name and Mail Addres… |
CVE-2026-47843 | Low | 3.7 | 2026-08-26 | In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS re… |
CVE-2026-54548 | Low | 3.3 | 2026-08-26 | kas is a setup tool for bitbake based projects. Prior to 5.4, internal SSH key setup triggered by SSH_PRIVATE_KEY or SSH_PRIVATE_KEY_FILE creates ~/.ssh/config… |
CVE-2026-13480 | Low | 3.1 | 2026-08-26 | The LoRaWAN TS004 Fragmented Data Block Transport handler frag_transport_package_callback() in subsys/lorawan/services/frag_transport.c parses downlink command… |
CVE-2026-13479 | Low | 3.1 | 2026-08-26 | The LoRaWAN application-layer clock-synchronization service parses downlinks in clock_sync_package_callback() (subsys/lorawan/services/clock_sync.c). Its comma… |
CVE-2026-7487 | Low | 3.5 | 2026-08-26 | GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain cond… |
CVE-2026-19220 | Low | 3.7 | 2026-08-26 | The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing u… |
CVE-2026-9805 | Low | 2.7 | 2026-08-26 | SMM IHISI command handler, FMTSWriteUseIntelLib, for FMTS command 0x32, read and write data without checking buffer size and could cause buffer overflow. |
CVE-2026-80201 | Low | 2.0 | 2026-08-26 | Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() me… |
CVE-2026-80199 | Low | 3.7 | 2026-08-26 | Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-… |
CVE-2026-79289 | Low | 3.1 | 2026-08-25 | Improper control of a resource through its lifetime in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the render… |
CVE-2026-79272 | Low | 3.1 | 2026-08-25 | Improper input validation in FindInPage in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cros… |
CVE-2026-79255 | Low | 3.1 | 2026-08-25 | Improper input validation in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web or… |
CVE-2026-79228 | Low | 3.1 | 2026-08-25 | Incorrect authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass s… |
CVE-2026-79203 | Low | 3.1 | 2026-08-25 | Improper input validation in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site… |
CVE-2026-79191 | Low | 3.1 | 2026-08-25 | Incorrect authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leverag… |
CVE-2026-79186 | Low | 3.1 | 2026-08-25 | Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site is… |
CVE-2026-79103 | Low | 3.1 | 2026-08-25 | Incorrect reference resolution in Speech in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass s… |
CVE-2026-79066 | Low | 3.1 | 2026-08-25 | Improper input validation in Navigation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass si… |
CVE-2026-79059 | Low | 3.1 | 2026-08-25 | Information leak in BFCache in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to obtain cross-origin d… |
CVE-2026-79053 | Low | 3.1 | 2026-08-25 | Missing authorization in Lighthouse in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged so… |
CVE-2026-79034 | Low | 3.1 | 2026-08-25 | Information leak in CORS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cross-origin data v… |
CVE-2026-79031 | Low | 3.1 | 2026-08-25 | Improper resource exposure in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chro… |
CVE-2026-79007 | Low | 3.1 | 2026-08-25 | Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially read me… |
CVE-2026-79004 | Low | 3.4 | 2026-08-25 | Out of bounds read in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to read memory outside t… |
CVE-2026-79002 | Low | 3.1 | 2026-08-25 | Incorrect authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass s… |
CVE-2026-78986 | Low | 3.1 | 2026-08-25 | Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain… |
CVE-2026-78984 | Low | 3.4 | 2026-08-25 | Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially read me… |
CVE-2026-78958 | Low | 3.1 | 2026-08-25 | Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain… |
CVE-2026-78953 | Low | 3.1 | 2026-08-25 | Missing authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass sit… |
CVE-2026-78949 | Low | 2.9 | 2026-08-25 | Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-instal… |
CVE-2026-78943 | Low | 3.1 | 2026-08-25 | Improper input validation in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged s… |
CVE-2026-78941 | Low | 3.1 | 2026-08-25 | Information leak in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation vi… |
CVE-2026-78936 | Low | 2.9 | 2026-08-25 | Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-instal… |
CVE-2026-78903 | Low | 3.1 | 2026-08-25 | Incomplete cleanup in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site i… |
CVE-2026-78894 | Low | 3.1 | 2026-08-25 | Race condition in Payments in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cross-origin data… |
CVE-2026-43657 | Low | 3.3 | 2026-08-25 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.5 and iPadOS 26.5. A malicious app may be able to enumerate insta… |
CVE-2026-79783 | Low | 3.6 | 2026-08-25 | rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/s… |
CVE-2026-79782 | Low | 3.1 | 2026-08-25 | rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host. Attackers can inter… |
CVE-2026-79777 | Low | 2.7 | 2026-08-25 | rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, modu… |
CVE-2026-70548 | Low | 3.5 | 2026-08-25 | Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency. |
CVE-2026-78887 | Low | 3.7 | 2026-08-25 | A weakness has been identified in liketrek TREK up to 3.0.22. This impacts the function validateShareTokenForAsset of the component Journey Photo Proxy. Execut… |
CVE-2026-78886 | Low | 3.7 | 2026-08-25 | A security flaw has been discovered in liketrek TREK up to 3.0.22. This affects an unknown function of the file server/src/nest/journey/journey-public.controll… |
CVE-2026-21758 | Low | 3.7 | 2026-08-25 | HCL Hive is affected by an information disclosure vulnerability, which could lead to an attacker gathering sensitive information about the host environment. |
CVE-2026-78638 | Low | 3.3 | 2026-08-25 | A flaw has been found in peerigon unzip-crx and unzip-crx-3 up to 0.2.0. This affects the function unzip of the file dist/index.js of the component Archive Ext… |
CVE-2026-72701 | Low | 3.7 | 2026-08-25 | Grav CMS before 2.0.16 contains a timing vulnerability in Utils::verifyNonce() that uses non-constant-time string comparison with the === operator instead of h… |
CVE-2026-78435 | Low | 3.8 | 2026-08-24 | A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsControlle… |
CVE-2026-76816 | Low | 3.5 | 2026-08-24 | Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client id… |
CVE-2026-78187 | Low | 3.1 | 2026-08-24 | A vulnerability has been found in Piwigo 16.3.0. This impacts an unknown function of the component Public Authentication Page. Such manipulation of the argumen… |
CVE-2026-19565 | Low | 3.7 | 2026-08-23 | Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey… |
CVE-2026-77003 | Low | 2.7 | 2026-08-23 | The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as l… |
CVE-2026-78049 | Low | 3.7 | 2026-08-22 | A vulnerability has been found in Systerel S2OPC up to 1.7.3. Impacted is the function SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes of the file src/Cli… |
CVE-2026-71514 | Low | 2.5 | 2026-08-22 | NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. _load_lang_ngrams joins the corpus root with crubadan_code, the colu… |
CVE-2026-14187 | Low | 2.7 | 2026-08-22 | The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor rol… |
CVE-2026-33333 | Low | 3.5 | 2026-08-21 | Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is sensitive information disclosure in the error messages. This issue has been fi… |
CVE-2026-69238 | Low | 3.5 | 2026-08-21 | There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.5 and prior that allows a remote, highly priviliged attacker to insert arbitrary… |
CVE-2026-69237 | Low | 3.8 | 2026-08-21 | There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to inse… |
CVE-2026-18356 | Low | 3.7 | 2026-08-21 | The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account f… |
CVE-2026-13176 | Low | 2.7 | 2026-08-21 | The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contr… |
CVE-2026-66721 | Low | 2.7 | 2026-08-21 | Missing authorization issue for domain admins in CloudStack's host tags listing functionality. Domain Admins, by default, have permission to call the listH… |
CVE-2026-19435 | Low | 2.7 | 2026-08-21 | The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to rea… |
CVE-2026-19085 | Low | 2.7 | 2026-08-21 | The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegat… |
CVE-2026-16577 | Low | 2.7 | 2026-08-21 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not validate a client-supplied payment amount against t… |
CVE-2026-14325 | Low | 3.5 | 2026-08-21 | The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag na… |
CVE-2026-76137 | Low | 3.3 | 2026-08-21 | Missing authentication for critical function vulnerability exists in VOCALOID6. Any process running under the same local user account as a running VOCALOID6 Ed… |
CVE-2026-43679 | Low | 2.4 | 2026-08-21 | This issue was addressed with improved permissions checking. This issue is fixed in watchOS 26.4. An attacker with physical access to a locked Apple Watch may… |
CVE-2026-77648 | Low | 2.2 | 2026-08-20 | In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs fro… |
CVE-2026-49245 | Low | 3.7 | 2026-08-20 | SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authent… |
CVE-2026-77640 | Low | 3.7 | 2026-08-20 | tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches Z_STREAM_END… |