Search
2,007 CVEs · Low severity
CVEs (2,007, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 2,007 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↑ | Description |
|---|---|---|---|---|---|
| CVE-2026-14189 | LOW | Patched | 3.8 | 2026-07-27 | The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with administrator ac… |
| CVE-2026-40000 | LOW | 1.8 | 2026-07-27 | The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files. Third-party applications can launch this… | |
| CVE-2026-17512 | LOW | 3.3 | 2026-07-27 | A vulnerability has been found in ggml-org whisper.cpp 1.8.4-58. This impacts the function log_mel_spectrogram of the file src/whisper.cpp. The manipulation leads to out-of… | |
| CVE-2026-56537 | LOW | Patched | 3.5 | 2026-07-27 | HCL Connections is vulnerable to information disclosure which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of re… |
| CVE-2026-56538 | LOW | Patched | 3.5 | 2026-07-27 | An endpoint in HCL Connections is vulnerable to information disclosure. In certain scenarios this might lead to disclosing sensitive information to unauthorized users. |
| CVE-2026-17513 | LOW | 3.3 | 2026-07-27 | A vulnerability was found in ggml-org whisper.cpp 95ea8f9b. Affected is the function ggml_ftype_to_ggml_type of the file ggml/src/ggml.c. The manipulation of the argument f… | |
| CVE-2026-48051 | LOW | Patched | 3.5 | 2026-07-27 | Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's webhook delivery system contains an SSRF protection bypass that allows … |
| CVE-2026-10683 | LOW | Patched | 2.4 | 2026-07-27 | In the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) operating in target/slave mode, the rx_full interrupt handler gates the write_requested() callback on dw->state… |
| CVE-2026-64745 | LOW | Patched | 2.4 | 2026-07-27 | This issue was addressed with additional restrictions on the lock screen. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. A person with physical access to a … |
| CVE-2026-14819 | LOW | Patched | 3.5 | 2026-07-28 | The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users with … |
| CVE-2026-14821 | LOW | Patched | 2.7 | 2026-07-28 | The Quiz and Survey Master (QSM) WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with contributor-level… |
| CVE-2026-55977 | LOW | 3.3 | 2026-07-28 | Successful exploitation of this vulnerability could allow an attacker with local network access to bypass the application's rate-limiting mechanism, enabling brute-forcing … | |
| CVE-2026-17072 | LOW | 3.3 | 2026-07-28 | A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM… | |
| CVE-2026-66753 | LOW | 3.7 | 2026-07-28 | tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to inject carriage return (0x0D) and line feed (0x0A) bytes into HTTP header … | |
| CVE-2026-54619 | LOW | Patched | — | 2026-07-28 | sqlite3 provides Ruby bindings for the SQLite3 embedded database. In version 2.9.4 and earlier, redefining a SQLite function with a different arity frees the previously reg… |
| CVE-2026-54620 | LOW | Patched | — | 2026-07-28 | sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced… |
| CVE-2026-55403 | LOW | Patched | 3.7 | 2026-07-28 | datamodel-code-generator generates Python data models from schema definitions. Prior to 0.63.0, src/datamodel_code_generator/http.py get_body reuses Authorization, Cookie, … |
| CVE-2026-63228 | LOW | 2.6 | 2026-07-29 | An unrestricted image upload vulnerability in Koollab LMS allowed an authenticated attacker to upload malicious content disguised as an image file via the feedback mail reg… | |
| CVE-2026-63235 | LOW | 3.7 | 2026-07-29 | An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to forcibly terminate the session of any user given their email address via the … | |
| CVE-2026-63236 | LOW | 3.7 | 2026-07-29 | An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to read another user's name, internal identifier, scores, lesson status, lesson … | |
| CVE-2026-63241 | LOW | 3.1 | 2026-07-29 | An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisati… | |
| CVE-2026-10684 | LOW | 3.0 | 2026-07-29 | In subsys/debug/coredump/coredump_shell.c, print_coredump_hdr() used the 16-bit tgt_code field of a stored Zephyr coredump header directly as an index into coredump_target_… | |
| CVE-2026-2482 | LOW | Patched | 3.1 | 2026-07-29 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unau… |
| CVE-2025-14562 | LOW | Patched | 3.1 | 2026-07-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions coul… |
| CVE-2026-17702 | LOW | Patched | 3.1 | 2026-07-30 | Inappropriate implementation in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data vi… |