Search
17,826 CVEs · Low severity
CVEs (17,826, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 401–425 of 17,826 (capped at 500)
| CVE ID | Severity ↑ | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-110604 | LOW | 3.6 | 2026-10-14 | Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxml_strtod() when the locale decimal point is not '.'. Attackers can supply XML with a 63-… | |
| CVE-2026-88842 | LOW | 3.3 | 2026-10-14 | A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocati… | |
| CVE-2026-73792 | LOW | 3.8 | 2026-10-14 | A security vulnerability in HPE NonStop Java JToolkit can allow command Injection and buffer overflow. | |
| CVE-2026-73791 | LOW | 2.0 | 2026-10-14 | A security vulnerability in HPE NonStop Hpjmeter can cause stack and heap buffer overflow. | |
| CVE-2026-108066 | LOW | Patched | 2.7 | 2026-10-14 | The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authentication configuration, allowing a sit… |
| CVE-2026-110458 | LOW | 3.7 | 2026-10-14 | A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to create or truncate f… | |
| CVE-2026-110457 | LOW | 3.7 | 2026-10-14 | A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to obtain information a… | |
| CVE-2026-77205 | LOW | 3.7 | 2026-10-13 | Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates wit… | |
| CVE-2026-110141 | LOW | Patched | 3.1 | 2026-10-13 | Observable discrepancy in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security seve… |
| CVE-2026-108388 | LOW | Patched | 3.5 | 2026-10-13 | Indico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the user supplied to Contribution.can… |
| CVE-2026-110239 | LOW | Patched | 4.4 | 2026-10-13 | Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component that outputs bound model values as raw HTML without s… |
| CVE-2026-110223 | LOW | 3.1 | 2026-10-13 | Kavita 0.9.0 through 0.9.1.4 contains a server-side request forgery vulnerability that allows authenticated users to bypass the SSRF blocklist through DNS rebinding or HTTP… | |
| CVE-2026-110036 | LOW | 3.3 | 2026-10-13 | A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service (DoS) by inducing a user or system tool to process crafted device metadata… | |
| CVE-2026-106176 | LOW | 3.8 | 2026-10-13 | A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via Specially crafted HTTP requests | |
| CVE-2026-106175 | LOW | 2.3 | 2026-10-13 | A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.7, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.… | |
| CVE-2026-88834 | LOW | 3.7 | 2026-10-13 | A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An a… | |
| CVE-2026-110106 | LOW | 4.2 | 2026-10-13 | RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supp… | |
| CVE-2026-110107 | LOW | 4.2 | 2026-10-13 | RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by su… | |
| CVE-2026-109827 | LOW | 6.3 | 2026-10-13 | A vulnerability has been found in GPAC up to 26.07.0. This vulnerability affects the function gf_m2ts_decode_ait of the file src/media_tools/ait.c of the component AIT Pars… | |
| CVE-2026-109828 | LOW | 4.3 | 2026-10-13 | A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file src/wavlike.c of the component WAV Parsing. Performi… | |
| CVE-2026-109526 | LOW | 3.3 | 2026-10-13 | A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. This affects an unknown function of the component exportData Endpoint. Such manipulation leads to infor… | |
| CVE-2026-65200 | LOW | 3.5 | 2026-10-13 | The openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP responses from on-bus devices, and three response parsers in the shared transport libraries … | |
| CVE-2026-65197 | LOW | 3.1 | 2026-10-13 | H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file `/conf/public.pem`. That file is writable by an authenti… | |
| CVE-2026-11730 | LOW | 5.4 | 2026-10-13 | Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credentials) to p… | |
| CVE-2026-109409 | LOW | 5.3 | 2026-10-13 | A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. The affected element is the function child_process.exec of the file src/routes/setting/fileManagement/openFolder… |