Search
4,421 CVEs · Low severity
EOL hidden · Show all products
CVEs (4,421, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 4,421 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-115897 | LOW | Patched | — | 2026-10-23 | Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic … |
| CVE-2026-115801 | LOW | 5.3 | 2026-10-23 | A security flaw has been discovered in Kakao khaiii up to 0.4. The impacted element is the function khaiii::nn::Linear::open of the file src/main/cpp/khaiii/nn/Linear.cpp o… | |
| CVE-2026-83813 | LOW | Patched | 3.1 | 2026-10-23 | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response… |
| CVE-2026-115800 | LOW | 5.3 | 2026-10-23 | A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2. The affected element is the function load_model of the file pymllm/mobile/convertor/__init__.py of th… | |
| CVE-2026-79978 | LOW | 3.6 | 2026-10-23 | The RTIO streaming completion callback adxl345_process_fifo_samples_cb() in drivers/sensor/adi/adxl345/adxl345_stream.c clamps the amount of FIFO data it will report (read_… | |
| CVE-2026-115797 | LOW | 3.7 | 2026-10-23 | A weakness has been identified in Tenda F6 12.02.01.73. Affected is an unknown function of the component Web Management Interface. Executing a manipulation of the argument … | |
| CVE-2026-115796 | LOW | 4.3 | 2026-10-23 | A security flaw has been discovered in Tenda F6 12.02.01.73. This impacts an unknown function of the component Web Management Interface. Performing a manipulation results i… | |
| CVE-2026-115569 | LOW | Patched | 3.3 | 2026-10-23 | Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project r… |
| CVE-2026-106073 | LOW | 3.3 | 2026-10-23 | A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-2171… | |
| CVE-2026-106071 | LOW | 3.6 | 2026-10-23 | A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the req… | |
| CVE-2026-106070 | LOW | 3.7 | 2026-10-23 | A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When `… | |
| CVE-2026-115754 | LOW | Patched | 4.7 | 2026-10-23 | serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized f… |
| CVE-2026-54711 | LOW | Patched | — | 2026-10-23 | pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.1, when using .pgpass, database connection in… |
| CVE-2026-115752 | LOW | Patched | 4.2 | 2026-10-23 | Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URL… |
| CVE-2026-115730 | LOW | 3.1 | 2026-10-23 | i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a sl… | |
| CVE-2026-95620 | LOW | — | 2026-10-23 | A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support of the Qt Network module allows a malicious or compromised HTTP/2 server to cause the c… | |
| CVE-2026-115725 | LOW | Patched | 4.2 | 2026-10-23 | Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox sou… |
| CVE-2026-115724 | LOW | Patched | 2.9 | 2026-10-23 | VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based only on the com.fsck.k9.attachment… |
| CVE-2026-113501 | LOW | Patched | 3.1 | 2026-10-23 | The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce it relies on is not bound to the … |
| CVE-2026-112230 | LOW | Patched | 3.7 | 2026-10-23 | The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated r… |
| CVE-2026-111737 | LOW | Patched | 3.5 | 2026-10-23 | The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before outputting them in the head of front-end pages, which could allow… |
| CVE-2026-110537 | LOW | Patched | 3.8 | 2026-10-23 | The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval… |
| CVE-2026-110510 | LOW | Patched | 3.5 | 2026-10-23 | The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to build markup, which could… |
| CVE-2026-115537 | LOW | 4.3 | 2026-10-23 | A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This affects the function simpan of the file application/mo… | |
| CVE-2026-115536 | LOW | 4.3 | 2026-10-23 | A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The impacted element is the function simpan of the fil… |