Low-severity CVEs (page 7)
Page 7 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-0142 | Low | 3.3 | 2026-06-16 | In iavb_parse_key_data of avb_rsa.c, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure w… |
CVE-2026-0134 | Low | 3.3 | 2026-06-16 | In PostWipeData of recovery_ui.cpp, there is a possible data persistence issue after a factory reset due to a logic error in the code. This could lead to local… |
CVE-2026-0130 | Low | 3.5 | 2026-06-16 | In RtcpChunk::decodeRtcpChunk, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no a… |
CVE-2026-0129 | Low | 3.5 | 2026-06-16 | In RtcpByePacket::decodeByePacket, there is a possible due to a missing bounds check. This could lead to remote information disclosure with no additional exec… |
CVE-2026-10636 | Low | 3.7 | 2026-06-16 | In Zephyr's IPv4 IGMP implementation, igmp_send() in subsys/net/ip/igmp.c read the network interface back out of the packet via net_pkt_iface(pkt) after the pa… |
CVE-2026-48709 | Low | 3.7 | 2026-06-15 | OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, The ValidateArgumentType RPC endpoint in service/inter… |
CVE-2026-12211 | Low | 2.7 | 2026-06-15 | A flaw has been found in Intelbras iNVU 7016 FT 3.004.00IB000.0.T Build 2025-09-26. This impacts an unknown function of the file /RPC2_Loadfile/syslog/ of the… |
CVE-2026-12202 | Low | 2.4 | 2026-06-15 | A vulnerability has been found in Intelliants Subrion CMS up to 4.0.3. Affected by this issue is some unknown functionality of the component Blocks Endpoint. S… |
CVE-2026-9062 | Low | 3.4 | 2026-06-13 | The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administra… |
CVE-2026-9061 | Low | 3.5 | 2026-06-13 | The Store Locator WordPress plugin before 1.6.9 does not sanitize and escape store logo metadata before storing it and outputting it on the Store Locator WordP… |
CVE-2026-53837 | Low | 3.7 | 2026-06-12 | OpenClaw before 2026.5.6 contains an improper access control vulnerability in Mattermost event handlers that fails to validate channel type metadata. Attackers… |
CVE-2026-53607 | Low | 3.7 | 2026-06-12 | ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, when `prettyUrls: true` is enabled on `@apostrophecm… |
CVE-2026-12130 | Low | 3.5 | 2026-06-12 | A security flaw has been discovered in CodeAstro Human Resource Management System 1.0. This affects an unknown part of the file /Projects/Add_Projects of the c… |
CVE-2026-12129 | Low | 3.5 | 2026-06-12 | A vulnerability was identified in CodeAstro Human Resource Management System 1.0. Affected by this issue is some unknown functionality of the file /dashboard/a… |
CVE-2026-12065 | Low | 1.8 | 2026-06-12 | A vulnerability was identified in Groww Stock, Mutual Fund, Gold App up to 20260805 on Android. This affects an unknown part of the component WebView URL Handl… |
CVE-2026-9269 | Low | 3.5 | 2026-06-12 | The Secure Copy Content Protection and Content Locking WordPress plugin before 5.1.5 does not sanitise and escape some of its settings, which could allow high… |
CVE-2026-12032 | Low | 3.1 | 2026-06-11 | Inappropriate implementation in Passwords in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer proces… |
CVE-2026-12017 | Low | 3.1 | 2026-06-11 | Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to bypas… |
CVE-2026-53809 | Low | 3.8 | 2026-06-11 | OpenClaw before 2026.4.25 contains a policy bypass vulnerability in embedded runner policy that allows requests using provider aliases to compare against alias… |
CVE-2026-44489 | Low | 3.7 | 2026-06-11 | Axios is a promise based HTTP client for the browser and Node.js. From 1.15.2 to before 1.16.0, nested objects created by utils.merge() (e.g., config.proxy) ar… |
CVE-2026-11956 | Low | 3.7 | 2026-06-11 | A vulnerability was determined in TwiN gatus 5.36.0. Impacted is the function setSessionCookie of the file security/oidc.go of the component OIDC Session Cooki… |
CVE-2026-9694 | Low | 2.6 | 2026-06-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain… |
CVE-2026-6976 | Low | 3.7 | 2026-06-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain… |
CVE-2026-3553 | Low | 3.1 | 2026-06-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain… |
CVE-2026-41000 | Low | 3.7 | 2026-06-11 | Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks. As a result, protections aga… |
CVE-2026-47712 | Low | 3.3 | 2026-06-10 | Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to version 1.2.5, dulwich.porcelain.format_… |
CVE-2026-48011 | Low | 3.7 | 2026-06-10 | Shopware is an open commerce platform. Prior to versions 6.6.10.18 and 6.7.10.1, an attacker is able to enumerate the usernames of administrator users by perfo… |
CVE-2026-45380 | Low | 3.6 | 2026-06-10 | bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files. Prior to version 4.0.12, a one-byte off-by-one error in S… |
CVE-2022-48575 | Low | 3.5 | 2026-06-10 | A person with access to a Mac may be able to bypass Login Window. A consistency issue was addressed with improved state handling. This issue is fixed in macOS… |
CVE-2026-50568 | Low | 3.6 | 2026-06-10 | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version… |
CVE-2026-49497 | Low | 3.3 | 2026-06-10 | Ghidra before 12.1 contains a path traversal vulnerability in SameDirDebugInfoProvider that fails to validate filenames from ELF binary .gnu_debuglink sections… |
CVE-2024-58350 | Low | 2.9 | 2026-06-10 | Ghidra before 11.2 contains a use after free vulnerability in the Sleigh backend caused by undefined static initialization order of the SleighArchitecture::tra… |
CVE-2026-9060 | Low | 3.5 | 2026-06-10 | The Store Locator WordPress plugin before 1.6.6 does not sanitize and escape one of its settings before storing it and outputting it on the Store Locator WordP… |
CVE-2026-41694 | Low | 3.7 | 2026-06-10 | Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attacker… |
CVE-2026-48289 | Low | 3.5 | 2026-06-09 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by an Improper Input Validation vulnerability that could result in a Securi… |
CVE-2026-48288 | Low | 3.5 | 2026-06-09 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by an Improper Input Validation vulnerability that could result in a Securi… |
CVE-2026-45642 | Low | 3.9 | 2026-06-09 | Improper input validation in Microsoft Azure Attestation service and Device Health Attestation Service allows an authorized attacker to perform spoofing with a… |
CVE-2026-45485 | Low | 3.3 | 2026-06-09 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-45466 | Low | 3.3 | 2026-06-09 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-45459 | Low | 3.3 | 2026-06-09 | Protection mechanism failure in Microsoft Office Excel allows an unauthorized attacker to bypass a security feature locally. |
CVE-2026-45455 | Low | 3.3 | 2026-06-09 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-42770 | Low | 3.7 | 2026-06-09 | Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not properly checked for the subgroup membership. Impact… |
CVE-2026-42768 | Low | 3.7 | 2026-06-09 | Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to Bleichenbacher-style attack when an attacker is able to provide the CMS or S/MIME… |
CVE-2026-11792 | Low | 3.3 | 2026-06-09 | A heap buffer overflow flaw was found in 389 Directory Server. When audit logging is enabled, the create_masked_entry_string() function in auditlog.c copies a… |
CVE-2026-11786 | Low | 1.9 | 2026-06-09 | A flaw was found in 389 Directory Server. The LDIF parser reads past the end of a heap buffer when processing attribute types with trailing semicolons during d… |
CVE-2026-41986 | Low | 2.4 | 2026-06-09 | Logic bypass vulnerability in the file system. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-41974 | Low | 3.6 | 2026-06-09 | Permission control vulnerability in service notifications. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-8981 | Low | 3.5 | 2026-06-09 | The Custom Block Builder WordPress plugin before 4.3.0 does not consistently check the unfiltered_html capability across all paths that write to its block tem… |
CVE-2026-41852 | Low | 3.7 | 2026-06-09 | A vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only… |
CVE-2026-41848 | Low | 3.7 | 2026-06-09 | Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to provide a pattern which is then directly or i… |
CVE-2026-44743 | Low | 3.7 | 2026-06-09 | Under certain conditions, when an unauthorized attacker accesses a specific endpoint, SAP Business Objects application leaks sensitive information .This has a… |
CVE-2026-11691 | Low | 3.1 | 2026-06-09 | Insufficient validation of untrusted input in New Tab Page in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer… |
CVE-2026-11686 | Low | 3.1 | 2026-06-09 | Insufficient validation of untrusted input in Dawn in Google Chrome on macOS prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer… |
CVE-2026-11684 | Low | 3.1 | 2026-06-09 | Insufficient policy enforcement in Network in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the utility process to leak c… |
CVE-2026-11675 | Low | 3.1 | 2026-06-09 | Out of bounds read in Skia in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to leak cross-origin dat… |
CVE-2026-11555 | Low | 3.7 | 2026-06-08 | A vulnerability was identified in D-Link DGS-1100-08PD 1.00.006. This issue affects some unknown processing of the file /etc/boa.conf of the component Web Inte… |
CVE-2026-11534 | Low | 3.5 | 2026-06-08 | A vulnerability was detected in imvks786 student_management_system up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46. Affected by this issue is some unknown funct… |
CVE-2026-11520 | Low | 3.5 | 2026-06-08 | A weakness has been identified in SourceCodester Inventory System 1.0. Affected by this issue is some unknown functionality of the file header.php. This manipu… |
CVE-2026-11511 | Low | 3.5 | 2026-06-08 | A weakness has been identified in Bolt CMS up to 3.7.5. This vulnerability affects unknown code of the file src/Storage/Field/Type/TextType.php of the componen… |
CVE-2026-11502 | Low | 3.1 | 2026-06-08 | A weakness has been identified in JeecgBoot up to 3.9.2. Impacted is the function HttpServletResponse.sendRedirect of the file jeecg-module-system/jeecg-system… |
CVE-2026-11491 | Low | 2.4 | 2026-06-08 | A vulnerability was identified in CodeAstro Human Resource Management System 1.0. Impacted is an unknown function of the file /notice/All_notice of the compone… |
CVE-2026-11481 | Low | 2.5 | 2026-06-08 | A vulnerability was determined in yoanbernabeu grepai up to 0.35.0. The affected element is the function PostgresStore.LookupByContentHash of the file indexer/… |
CVE-2026-11478 | Low | 3.3 | 2026-06-08 | A flaw has been found in kokke tiny-regex-c up to f2632c6d9ed25272987471cdb8b70395c2460bdb. This vulnerability affects the function matchstar of the file re.c… |
CVE-2026-11468 | Low | 2.4 | 2026-06-08 | A vulnerability was detected in SourceCodester Hospitals Patient Records Management System 1.0. This issue affects some unknown processing of the file /admin/?… |
CVE-2026-11465 | Low | 3.1 | 2026-06-07 | A security flaw has been discovered in songquanpeng one-api up to 0.6.11-preview.7. Affected by this issue is the function Redeem of the file model/redemption… |
CVE-2026-11464 | Low | 3.1 | 2026-06-07 | A vulnerability was identified in JeecgBoot up to 3.9.2. Affected by this vulnerability is the function queryPageList of the file src\main\java\org\jeecg\modul… |
CVE-2026-11459 | Low | 3.3 | 2026-06-07 | A security vulnerability has been detected in SecureAge CatchPulse up to 10.9.3. Impacted is an unknown function in the library saappctl.sys of the component I… |
CVE-2026-11434 | Low | 2.4 | 2026-06-06 | A weakness has been identified in FluentCMS 0.0.5. The impacted element is an unknown function of the file /admin/blocks of the component Blocks Plugin. This m… |
CVE-2025-12656 | Low | 3.8 | 2026-06-06 | The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path va… |
CVE-2026-11338 | Low | 2.4 | 2026-06-05 | A security vulnerability has been detected in SourceCodester Ship Ferry Ticket Reservation System 1.0. Impacted is an unknown function of the file /admin/?page… |
CVE-2026-48102 | Low | 3.1 | 2026-06-05 | 7-Zip is a file archiver with a high compression ratio. Versions 9.11 through 26.00 contain a heap out-of-bounds read of up to 3 bytes in the UDF disc image ha… |
CVE-2026-11330 | Low | 3.6 | 2026-06-05 | A weakness has been identified in thedotmack claude-mem up to 11.0.1. The affected element is the function computeObservationContentHash of the file src/servic… |
CVE-2026-11329 | Low | 3.6 | 2026-06-05 | A vulnerability has been found in onnx onnx-mlir up to 0.5.0.0. Affected by this issue is the function generate_hash_key of the file src/Runtime/python/torch_o… |
CVE-2026-21034 | Low | 3.3 | 2026-06-05 | Improper export of android application components in Samsung Auto prior to version 3.1.2.61 in Android 15 and 3.2.0.38 in Android 16 allows local attacker to c… |
CVE-2026-21027 | Low | 3.3 | 2026-06-05 | Improper export of android application components in ImsSettings prior to SMR Jun-2026 Release 1 allows local attackers to trigger logging function. |
CVE-2026-9088 | Low | 2.7 | 2026-06-05 | A flaw was found in org.keycloak.services. An administrator with delegated access to read group memberships and users can bypass user profile permissions by ac… |
CVE-2026-11312 | Low | 3.3 | 2026-06-05 | A vulnerability was found in bytedance InfiniStore up to 0.2.33. The impacted element is the function purge_kv_map in the library /src/infinistore.h of the com… |
CVE-2026-11251 | Low | 3.1 | 2026-06-05 | Insufficient policy enforcement in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-11247 | Low | 3.1 | 2026-06-05 | Insufficient policy enforcement in CustomTabs in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a craf… |
CVE-2026-11244 | Low | 3.1 | 2026-06-05 | Insufficient validation of untrusted input in WebAuthentication in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the rende… |
CVE-2026-11240 | Low | 3.1 | 2026-06-05 | Insufficient validation of untrusted input in Loader in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-50266 | Low | 2.2 | 2026-06-04 | In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set device_owner to a value… |
CVE-2026-10813 | Low | 3.6 | 2026-06-04 | A flaw has been found in LMCache up to 0.4.6. This affects the function hex_hash_to_int16 of the file lmcache/integration/vllm/utils.py of the component KV Cac… |
CVE-2026-45739 | Low | 3.1 | 2026-06-04 | Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.288.4 through 0.315.3, Strawberry's bundled GraphiQL template wrote values from the Gr… |
CVE-2026-10812 | Low | 3.6 | 2026-06-04 | A vulnerability was detected in zilliztech GPTCache up to 0.1.44. Affected by this issue is the function BufferedReader.peek of the file gptcache/processor/pre… |
CVE-2025-62338 | Low | 3.3 | 2026-06-04 | HCL BigFix Cloud Lifecycle Management is affected by lack of input validation. This low-level flaw allows unauthorized access and may lead to information expo… |
CVE-2026-10804 | Low | 3.6 | 2026-06-04 | A vulnerability has been found in Streamlit up to 1.53.0. Impacted is an unknown function in the library lib/streamlit/runtime/caching/hashing.py of the compon… |
CVE-2026-10803 | Low | 3.6 | 2026-06-04 | A flaw has been found in MLflow up to 3.10.0. This issue affects the function mlflow.data.digest_utils of the file mlflow/data/digest_utils.py of the component… |
CVE-2025-52611 | Low | 3.1 | 2026-06-04 | HCL iControl v4.0.0 was affected by Unhandled Exception - Stack Trace Disclosure vulnerability. The error occurs due to an undefined property being accessed in… |
CVE-2025-52609 | Low | 3.7 | 2026-06-04 | HCL iControl was affected by Missing Security Headers vulnerability. which lead to cross-site scripting (XSS) attacks by enabling the built-in XSS filtering me… |
CVE-2025-52608 | Low | 3.1 | 2026-06-04 | HCL iControl was affected by Missing Cookie Attributes vulnerability. It was observed that the application is missing several critical cookie attributes, incl… |
CVE-2026-10801 | Low | 3.6 | 2026-06-04 | A security vulnerability has been detected in modelscope ms-swift up to 4.2.0. This affects the function Template._save_pil_image of the file swift/template/ba… |
CVE-2026-10800 | Low | 3.6 | 2026-06-04 | A weakness has been identified in PaddlePaddle FastDeploy up to 2.4.1. Affected by this issue is the function hash_features of the file fastdeploy/multimodal/h… |
CVE-2026-10783 | Low | 2.5 | 2026-06-04 | A security flaw has been discovered in gradio-app gradio 6.14.0. This affects the function save_audio_to_cache of the component Audio Cache Key Handler. Perfor… |
CVE-2026-10775 | Low | 3.6 | 2026-06-03 | A vulnerability was determined in sgl-project SGLang up to 0.5.11. Affected by this vulnerability is the function data_hash of the component Cache Handler. Thi… |
CVE-2026-10766 | Low | 3.6 | 2026-06-03 | A vulnerability has been found in mlrun up to 1.12.0-rc3. This impacts the function mlrun.utils.helpers.calculate_dataframe_hash of the file mlrun/utils/helper… |
CVE-2026-8404 | Low | 3.1 | 2026-06-03 | An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does not match `Cache-Contr… |
CVE-2026-7666 | Low | 3.1 | 2026-06-03 | An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.core.mail.backends.smtp.EmailBackend` in Django fails to prevent reuse of a p… |
CVE-2026-6873 | Low | 3.1 | 2026-06-03 | An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.http.HttpRequest.get_signed_cookie` in Django uses a non-injective salt deriv… |
CVE-2026-48587 | Low | 3.1 | 2026-06-03 | An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.utils.cache.has_vary_header()` in Django does not strip leading or trailing w… |