Search
2,007 CVEs · Low severity
CVEs (2,007, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 2,007 (capped at 500)
| CVE ID ↓ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-9825 | LOW | 3.7 | 2026-10-20 | IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections, potentially enabling an attack… | |
| CVE-2026-9805 | LOW | 2.7 | 2026-08-26 | SMM IHISI command handler, FMTSWriteUseIntelLib, for FMTS command 0x32, read and write data without checking buffer size and could cause buffer overflow. | |
| CVE-2026-97897 | LOW | 3.5 | 2026-09-25 | A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media U… | |
| CVE-2026-97896 | LOW | 3.5 | 2026-09-25 | A vulnerability was identified in krayin laravel-crm up to 2.2.5. This vulnerability affects the function ConfigurationForm::rules of the file packages/Webkul/Admin/src/Htt… | |
| CVE-2026-97868 | LOW | 3.5 | 2026-09-25 | A security vulnerability has been detected in sheshbabu zen up to 1.5.0. Affected by this issue is the function dangerouslySetInnerHTML of the file features/notes/NotesEdit… | |
| CVE-2026-97764 | LOW | Patched | 3.7 | 2026-09-25 | django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of di… |
| CVE-2026-97721 | LOW | 2.7 | 2026-09-25 | A weakness has been identified in Sanluan PublicCMS up to 6.202506.e. This vulnerability affects the function CmsContentAdminController of the file publiccms-parent/publicc… | |
| CVE-2026-97399 | LOW | 3.7 | 2026-09-28 | The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program … | |
| CVE-2026-97233 | LOW | 3.5 | 2026-09-24 | A vulnerability was identified in volotat Anagnorisis up to 0.4.11. Affected by this issue is the function html of the file PlaylistManager.js of the component Media Filena… | |
| CVE-2026-97228 | LOW | Patched | 2.7 | 2026-09-25 | Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component (`get_export_status` in `src/export_manager.p… |
| CVE-2026-97204 | LOW | 3.1 | 2026-10-18 | Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences overlap. A user with write ac… | |
| CVE-2026-97027 | LOW | 3.6 | 2026-09-28 | Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application's Desktop Entry (.desktop) and D-Bus Service (.service) files, instead of va… | |
| CVE-2026-97026 | LOW | 3.9 | 2026-09-28 | Flatpak creates temporary child repository directories under the user cache with world-writable permissions (0777). On multi-user systems with a permissive umask, other loc… | |
| CVE-2026-97025 | LOW | 3.2 | 2026-09-28 | Flatpak writes the OCI repository authentication token with world-readable permissions (0644) in the system-helper's cache directory, allowing other local users on a multi-… | |
| CVE-2026-96962 | LOW | Patched | 3.7 | 2026-10-03 | The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code… |
| CVE-2026-9693 | LOW | Patched | 3.5 | 2026-08-17 | Mattermost versions 10.11.x <= 10.11.20, 11.7.x <= 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a … |
| CVE-2026-96901 | LOW | Patched | 3.7 | 2026-10-21 | The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before acting on it and still accepts … |
| CVE-2026-96810 | LOW | 3.5 | 2026-09-24 | A vulnerability was identified in huanzi-qch base-admin up to 52816b760cd53244989fd664bbb2b3d4edbfdbf1. This issue affects the function Save of the file base-admin-master\s… | |
| CVE-2026-96675 | LOW | 3.3 | 2026-09-23 | alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices before array access. Attackers ca… | |
| CVE-2026-96618 | LOW | Patched | — | 2026-10-12 | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the ma… |
| CVE-2026-96552 | LOW | 3.1 | 2026-09-23 | A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected element is the function MD5.getMD5 of the file ssm_pro/sr… | |
| CVE-2026-96550 | LOW | 3.7 | 2026-09-23 | A vulnerability was found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This issue affects the function getProperties of the file ssm_pro/src/main/… | |
| CVE-2026-96549 | LOW | 3.3 | 2026-09-23 | A vulnerability has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This vulnerability affects unknown code of the file ssm_pro/src/main/j… | |
| CVE-2026-96546 | LOW | 2.5 | 2026-09-23 | A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. When a user opens an uncompressed DDS image, the file-dds plug-in performs an unc… | |
| CVE-2026-96526 | LOW | Patched | 2.7 | 2026-09-26 | The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the… |