Search
344 CVEs · Low severity
CVEs (344)
Showing 1–25 of 344
| CVE ID | Severity | Patch | CVSS ↑ | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-90798 | LOW | Patched | — | 2026-10-20 | A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of servi… |
| CVE-2026-90799 | LOW | Patched | — | 2026-10-20 | Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion. … |
| CVE-2026-60964 | LOW | 1.9 | 2026-10-20 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Open Query). Supported versions that are affected are 8.61 and 8.62. Diffi… | |
| CVE-2026-115358 | LOW | Patched | 2.0 | 2026-10-22 | OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending malformed plugin parameters. A… |
| CVE-2026-113715 | LOW | Patched | — | 2026-10-20 | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines() and merge… |
| CVE-2026-84490 | LOW | Patched | 2.0 | 2026-10-20 | This issue was addressed through improved state management. This issue is fixed in iOS 27 and iPadOS 27. An attacker with physical access to a locked device may be able to … |
| CVE-2026-115897 | LOW | Patched | — | 2026-10-23 | Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic … |
| CVE-2026-95620 | LOW | — | 2026-10-23 | A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support of the Qt Network module allows a malicious or compromised HTTP/2 server to cause the c… | |
| CVE-2026-115519 | LOW | — | 2026-10-22 | Missing security attributes on sensitive cookies in KNIME Business Hub before version 1.19.0 allow an unauthenticated remote attacker to compromise user sessions if other s… | |
| CVE-2026-112945 | LOW | Patched | — | 2026-10-20 | Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an u… |
| CVE-2026-115369 | LOW | Patched | 2.2 | 2026-10-22 | OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a CSR when use_csr_sans is enabled. Authenticated calle… |
| CVE-2026-115362 | LOW | Patched | 2.2 | 2026-10-22 | OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid until the periodic tidy … |
| CVE-2026-115364 | LOW | Patched | 2.2 | 2026-10-22 | OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header. When require_request_head… |
| CVE-2026-115357 | LOW | Patched | 2.2 | 2026-10-22 | OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints… |
| CVE-2026-21812 | LOW | 2.2 | 2026-10-22 | HCL AppScan Azure Boards Plugin is affected by a Cleartext Transmission of Sensitive Information vulnerability when configured to communicate with the AppScan server over H… | |
| CVE-2026-83388 | LOW | 2.2 | 2026-10-20 | Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics). Supported versions that are affected are 12.2.3-12.2.15. Diff… | |
| CVE-2026-101397 | LOW | 2.2 | 2026-10-20 | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.9. Difficult to exploit … | |
| CVE-2026-115389 | LOW | Patched | 2.3 | 2026-10-22 | Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account for host allocations when lifting guest values through the dynamically-t… |
| CVE-2026-105938 | LOW | Patched | — | 2026-10-21 | Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription authentication mode, which requires a subscription name to sta… |
| CVE-2026-105931 | LOW | Patched | — | 2026-10-21 | The Apache Pulsar broker exposes a transaction administration REST API under /admin/v3/transactions. When authentication and authorization are enabled, most of the read end… |
| CVE-2026-105932 | LOW | Patched | — | 2026-10-21 | The Apache Pulsar broker admin REST API provides endpoints to read, set and remove the topic-level entry filter policy of a topic. For persistent topics these endpoints che… |
| CVE-2026-105933 | LOW | Patched | — | 2026-10-21 | Apache Pulsar allows an administrator to require end-to-end message encryption for all topics in a namespace by setting the encryption_required namespace policy. When this … |
| CVE-2026-114127 | LOW | Patched | — | 2026-10-21 | Astro is a web framework for content-driven websites. From 7.1.0 until 7.3.3, Astro's server-side View Transition CSS generator does not keep string animation properties wi… |
| CVE-2026-114130 | LOW | Patched | — | 2026-10-21 | Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.0, an incomplete fix for CVE-2026-53722 allows an application with pages disabled to render a scri… |
| CVE-2026-105927 | LOW | Patched | — | 2026-10-21 | The Apache Pulsar WebSocket service allows a WebSocket consumer to configure a dead letter policy through query parameters of the consumer endpoint, including the deadLette… |