Search
17,701 CVEs · Low severity
CVEs (17,701, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 17,701 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-115569 | LOW | Patched | 3.3 | 2026-10-23 | Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project r… |
| CVE-2026-106073 | LOW | 3.3 | 2026-10-23 | A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-2171… | |
| CVE-2026-106071 | LOW | 3.6 | 2026-10-23 | A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the req… | |
| CVE-2026-106070 | LOW | 3.7 | 2026-10-23 | A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When `… | |
| CVE-2026-115754 | LOW | Patched | 4.7 | 2026-10-23 | serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized f… |
| CVE-2026-54711 | LOW | Patched | — | 2026-10-23 | pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.1, when using .pgpass, database connection in… |
| CVE-2026-115752 | LOW | Patched | 4.2 | 2026-10-23 | Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URL… |
| CVE-2026-115730 | LOW | 3.1 | 2026-10-23 | i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a sl… | |
| CVE-2026-95620 | LOW | — | 2026-10-23 | A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support of the Qt Network module allows a malicious or compromised HTTP/2 server to cause the c… | |
| CVE-2026-115725 | LOW | Patched | 4.2 | 2026-10-23 | Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox sou… |
| CVE-2026-115724 | LOW | Patched | 2.9 | 2026-10-23 | VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based only on the com.fsck.k9.attachment… |
| CVE-2026-113501 | LOW | Patched | 3.1 | 2026-10-23 | The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce it relies on is not bound to the … |
| CVE-2026-112230 | LOW | Patched | 3.7 | 2026-10-23 | The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated r… |
| CVE-2026-111737 | LOW | Patched | 3.5 | 2026-10-23 | The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before outputting them in the head of front-end pages, which could allow… |
| CVE-2026-110537 | LOW | Patched | 3.8 | 2026-10-23 | The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval… |
| CVE-2026-110510 | LOW | Patched | 3.5 | 2026-10-23 | The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to build markup, which could… |
| CVE-2026-115537 | LOW | 4.3 | 2026-10-23 | A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This affects the function simpan of the file application/mo… | |
| CVE-2026-115536 | LOW | 4.3 | 2026-10-23 | A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The impacted element is the function simpan of the fil… | |
| CVE-2026-115535 | LOW | 2.4 | 2026-10-23 | A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected element is the function sistem.php::simpan of … | |
| CVE-2026-115534 | LOW | 4.3 | 2026-10-23 | A vulnerability was determined in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function kirim of the file application/modu… | |
| CVE-2026-115449 | LOW | 3.5 | 2026-10-22 | A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific conditions w… | |
| CVE-2026-114614 | LOW | Patched | 2.6 | 2026-10-22 | Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.is_secure_transport() uses a textual prefix compar… |
| CVE-2026-115509 | LOW | Patched | 4.2 | 2026-10-22 | Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownershi… |
| CVE-2026-95721 | LOW | 3.3 | 2026-10-22 | No description provided | |
| CVE-2026-115519 | LOW | — | 2026-10-22 | Missing security attributes on sensitive cookies in KNIME Business Hub before version 1.19.0 allow an unauthenticated remote attacker to compromise user sessions if other s… |