Search
913 CVEs · Low severity
CVEs (913, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 913 (capped at 500)
| CVE ID ↑ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2024-4412 | LOW | 2.7 | 2026-10-19 | The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution… | |
| CVE-2025-1218 | LOW | Patched | 3.4 | 2026-09-25 | The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL serv… |
| CVE-2025-15703 | LOW | Patched | 3.5 | 2026-10-12 | The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page,… |
| CVE-2025-29895 | LOW | — | 2026-10-15 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to la… | |
| CVE-2025-29896 | LOW | — | 2026-10-15 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to la… | |
| CVE-2025-29897 | LOW | — | 2026-10-15 | A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the v… | |
| CVE-2025-71435 | LOW | Patched | 4.2 | 2026-10-17 | Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is iss… |
| CVE-2026-0311 | LOW | — | 2026-10-14 | A server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local unauthenticated user to make unauthorized network requests from h… | |
| CVE-2026-0316 | LOW | — | 2026-10-14 | A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript pa… | |
| CVE-2026-0317 | LOW | — | 2026-10-14 | A denial of service vulnerability in Palo Alto Networks PAN-OS software enables an authenticated user with a read-only administrator role to cause a denial of service (DoS)… | |
| CVE-2026-100104 | LOW | Patched | 3.5 | 2026-10-13 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, co… |
| CVE-2026-100264 | LOW | Patched | 2.7 | 2026-09-30 | In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host |
| CVE-2026-100270 | LOW | Patched | 3.3 | 2026-09-30 | In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations |
| CVE-2026-100271 | LOW | Patched | 2.7 | 2026-09-30 | In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects |
| CVE-2026-100280 | LOW | Patched | 3.1 | 2026-09-30 | In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible |
| CVE-2026-100311 | LOW | 3.5 | 2026-09-26 | A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The affected element is an unknown function of the… | |
| CVE-2026-100417 | LOW | Patched | 3.1 | 2026-09-25 | RustDesk before 1.5.0 on Windows fails to enforce the one-way file transfer option against peer clipboard file requests, allowing authenticated peers to read files from the… |
| CVE-2026-100534 | LOW | Patched | 3.1 | 2026-09-26 | OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in webhook TaskFlow cancellation that allows attackers to cancel unrelated sessions. An atta… |
| CVE-2026-100537 | LOW | Patched | 3.1 | 2026-09-26 | OpenClaw (npm package 'openclaw') before 2026.8.1 fails to apply the originating requester's effective tool policy during Active Memory automatic recall. In deployments tha… |
| CVE-2026-100539 | LOW | Patched | 2.6 | 2026-09-26 | OpenClaw (npm package 'openclaw') before 2026.8.1 fails to revoke memory tool access when an operator hot-disables memory configuration. Existing memory_search and memory_g… |
| CVE-2026-100542 | LOW | Patched | 3.1 | 2026-09-26 | OpenClaw (npm package 'openclaw') versions >= 2026.5.28 and < 2026.8.1 mishandle archive listings in the tar.bz2 skill installer: bounded command-output suffixes were treat… |
| CVE-2026-100573 | LOW | Patched | 3.3 | 2026-09-26 | OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools ex… |
| CVE-2026-100837 | LOW | 3.7 | 2026-09-27 | Contrast (Edgeless Systems) through 1.20.0 performs unanchored suffix matching when selecting per-registry configuration in the imagepuller. Config.registryFor strips a sin… | |
| CVE-2026-100866 | LOW | 3.3 | 2026-09-27 | onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape sequence injection. Attacke… | |
| CVE-2026-100867 | LOW | 3.3 | 2026-09-27 | spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before rendering them in the zsh prompt. Attackers can embed ANSI/… |