Search
2,007 CVEs · Low severity
CVEs (2,007, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 351–375 of 2,007 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-111581 | LOW | 3.3 | 2026-10-16 | A flaw was found in libblockdev. The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pass caller-supplied label values as bare positional arguments to the ntfsl… | |
| CVE-2026-110805 | LOW | Patched | 2.6 | 2026-10-16 | Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored Pin… |
| CVE-2026-110191 | LOW | Patched | 2.7 | 2026-10-16 | The Product Delivery Date for WooCommerce WordPress plugin before 3.3.2 does not perform a capability check before disclosing order details through its calendar view AJAX … |
| CVE-2026-110039 | LOW | Patched | 2.7 | 2026-10-16 | The Smush WordPress plugin before 4.3.4 does not restrict changes to a network-wide access setting to network administrators, allowing an administrator of a single site on… |
| CVE-2026-109401 | LOW | 2.7 | 2026-10-16 | The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.17.0 via the 'email_address' parameter. Thi… | |
| CVE-2026-111448 | LOW | Patched | 3.7 | 2026-10-16 | Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip entries, package mappin… |
| CVE-2026-111376 | LOW | Patched | 5.0 | 2026-10-16 | FreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bounds read vulnerability in the Windows client's CliprdrStream_New that allows malicious RDP servers to trigger in… |
| CVE-2026-111212 | LOW | 4.8 | 2026-10-16 | A security flaw has been discovered in ImprintLab Medical-SAM-Adapter 0.1.0-alpha/0.1.0. Affected by this issue is the function session.get_modelmeta.custom_metadata_map of… | |
| CVE-2026-111354 | LOW | 3.1 | 2026-10-15 | crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers. Atta… | |
| CVE-2026-111351 | LOW | 4.2 | 2026-10-15 | metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass role and… | |
| CVE-2026-111350 | LOW | 5.0 | 2026-10-15 | Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authenticated users to delete other teams' viewer grou… | |
| CVE-2026-111233 | LOW | Patched | 4.7 | 2026-10-15 | Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to inject script via the u… |
| CVE-2026-111225 | LOW | Patched | 5.0 | 2026-10-15 | Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands … |
| CVE-2026-111169 | LOW | 3.1 | 2026-10-15 | La Suite Docs through 6.0.1 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannot access. A… | |
| CVE-2026-55876 | LOW | Patched | 3.5 | 2026-10-15 | Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upl… |
| CVE-2026-55467 | LOW | Patched | 2.5 | 2026-10-15 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/… |
| CVE-2026-55453 | LOW | Patched | 3.3 | 2026-10-15 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quote_string() function preserves ca… |
| CVE-2026-61610 | LOW | Patched | — | 2026-10-15 | Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photos_star_visibility is set to anonymous, POST /api/v2/Photo::highlight can fetch and modify a p… |
| CVE-2026-57569 | LOW | Patched | — | 2026-10-15 | Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resolved addresses in app/Rules/Photo… |
| CVE-2026-55184 | LOW | Patched | 3.5 | 2026-10-15 | EspoCRM is an open source customer relationship management application. Prior to 9.3.9, a user with Email Template or PDF Template edit permission can store crafted HTML th… |
| CVE-2026-53575 | LOW | Patched | 2.7 | 2026-10-15 | EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an authenticated administrator can place crafted content in the applicationName sett… |
| CVE-2026-79835 | LOW | 2.8 | 2026-10-15 | A crafted input message can cause a buffer overflow in HPE Nonstop KMS Server. | |
| CVE-2025-29897 | LOW | — | 2026-10-15 | A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the v… | |
| CVE-2025-29896 | LOW | — | 2026-10-15 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to la… | |
| CVE-2025-29895 | LOW | — | 2026-10-15 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to la… |