Search
913 CVEs · Low severity
CVEs (913, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 913 (capped at 500)
| CVE ID ↓ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-9825 | LOW | 3.7 | 2026-10-20 | IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections, potentially enabling an attack… | |
| CVE-2026-97897 | LOW | 3.5 | 2026-09-25 | A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media U… | |
| CVE-2026-97896 | LOW | 3.5 | 2026-09-25 | A vulnerability was identified in krayin laravel-crm up to 2.2.5. This vulnerability affects the function ConfigurationForm::rules of the file packages/Webkul/Admin/src/Htt… | |
| CVE-2026-97868 | LOW | 3.5 | 2026-09-25 | A security vulnerability has been detected in sheshbabu zen up to 1.5.0. Affected by this issue is the function dangerouslySetInnerHTML of the file features/notes/NotesEdit… | |
| CVE-2026-97764 | LOW | Patched | 3.7 | 2026-09-25 | django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of di… |
| CVE-2026-97721 | LOW | 2.7 | 2026-09-25 | A weakness has been identified in Sanluan PublicCMS up to 6.202506.e. This vulnerability affects the function CmsContentAdminController of the file publiccms-parent/publicc… | |
| CVE-2026-97399 | LOW | 3.7 | 2026-09-28 | The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program … | |
| CVE-2026-97233 | LOW | 3.5 | 2026-09-24 | A vulnerability was identified in volotat Anagnorisis up to 0.4.11. Affected by this issue is the function html of the file PlaylistManager.js of the component Media Filena… | |
| CVE-2026-97228 | LOW | Patched | 2.7 | 2026-09-25 | Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component (`get_export_status` in `src/export_manager.p… |
| CVE-2026-97204 | LOW | 3.1 | 2026-10-18 | Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences overlap. A user with write ac… | |
| CVE-2026-97027 | LOW | 3.6 | 2026-09-28 | Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application's Desktop Entry (.desktop) and D-Bus Service (.service) files, instead of va… | |
| CVE-2026-97026 | LOW | 3.9 | 2026-09-28 | Flatpak creates temporary child repository directories under the user cache with world-writable permissions (0777). On multi-user systems with a permissive umask, other loc… | |
| CVE-2026-97025 | LOW | 3.2 | 2026-09-28 | Flatpak writes the OCI repository authentication token with world-readable permissions (0644) in the system-helper's cache directory, allowing other local users on a multi-… | |
| CVE-2026-96962 | LOW | Patched | 3.7 | 2026-10-03 | The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code… |
| CVE-2026-96901 | LOW | Patched | 3.7 | 2026-10-21 | The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before acting on it and still accepts … |
| CVE-2026-96810 | LOW | 3.5 | 2026-09-24 | A vulnerability was identified in huanzi-qch base-admin up to 52816b760cd53244989fd664bbb2b3d4edbfdbf1. This issue affects the function Save of the file base-admin-master\s… | |
| CVE-2026-96618 | LOW | Patched | — | 2026-10-12 | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the ma… |
| CVE-2026-96526 | LOW | Patched | 2.7 | 2026-09-26 | The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the… |
| CVE-2026-96525 | LOW | Patched | 2.7 | 2026-09-26 | The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an ownership or sufficient capability check on its workflow create, update and delete REST rout… |
| CVE-2026-96395 | LOW | Patched | 3.6 | 2026-10-09 | The Affinity by Canva app for macOS before 3.3.1 (October 2026 release) did not perform adequate bounds checking when generating QuickLook thumbnails and previews of Affini… |
| CVE-2026-96394 | LOW | Patched | 2.9 | 2026-10-09 | The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not validate image dimensions against the size of the pixel data when generating QuickLo… |
| CVE-2026-96393 | LOW | Patched | 3.6 | 2026-10-09 | The Affinity by Canva app before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing Affinity document files, leading to an out-of-bounds poi… |
| CVE-2026-96392 | LOW | 3.5 | 2026-10-22 | Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal AI CKEditor allows Code Injection. This issue affects AI CKEditor versions: fr… | |
| CVE-2026-96387 | LOW | 3.8 | 2026-10-22 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows Authentication Bypass. This issue affects Stop administrato… | |
| CVE-2026-96384 | LOW | 3.5 | 2026-10-22 | Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing. This issue affects Mermaid Diagram Field versions: from 1.0.4 to 1.0.9. |