LOW Severity CVEs

Use after free in GPU in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the rendere

Object corruption in Compositing in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised

Insufficient validation of untrusted input in ReadingMode in Google Chrome on Mac prior to 148.0.7778.168 allowed a remo

libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, a wrong NULL check aft

Nuxt OG Image generates OG Images with Vue templates in Nuxt. The isBlockedUrl() denylist introduced in nuxt-og-image@6.

Due to improper input handling under certain conditions, SAP NetWeaver Application Server ABAP allows an attacker to inj

A side-channel attack, which requires a physical presence to the TPM, can lead to extraction of an Elliptic Curve Diffie

PoDoFo is a C++17 PDF manipulation library. From 1.0.0 to before 1.0.4, a double-free vulnerability exists in compute_ha

HCL AION is affected by a vulnerability where sensitive information may be included in URL parameters. Passing sensitive

HCL AION is affected by a vulnerability where certain security-related HTTP response headers are not properly configured

HCL AION is affected by a vulnerability where basic authorization tokens are used for authentication. Use of basic autho

HCL AION is affected by a vulnerability where auto-complete functionality is enabled for certain input fields. This may

SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table cre

GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 18.9.7, 18.10 before 18.10.6, and 18

GitLab has remediated an issue in GitLab EE affecting all versions from 15.7 before 18.9.7, 18.10 before 18.10.6, and 18

GitLab has remediated an issue in GitLab EE affecting all versions from 16.10 before 18.9.7, 18.10 before 18.10.6, and 1

Improper management of the idle timeout parameter in the Keycloak interface of the Arqit SKA-Platform enables an attacke

Protection Mechanism Failure in Zoom Workplace for iOS before version 7.0.0 may allow an authenticated user to conduct a

A vulnerability in Palo Alto Networks Broker VM allows an authenticated administrator to inject arbitrary content into c

Next.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React S

Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an exte

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, improper validat

When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the loc

Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applicat

ciguard is a static security auditor for CI/CD pipelines. From 0.8.0 to 0.8.1 , the discover_pipeline_files() function i

ciguard is a static security auditor for CI/CD pipelines. From 0.6.0 to 0.8.1, both SCA HTTP clients (src/ciguard/analyz

ciguard is a static security auditor for CI/CD pipelines. From 0.1.0 to 0.8.1, the published ghcr.io/jo-jo98/ciguard con

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability ex

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a denial-of-service vulnerability exists i

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an integer divide-by-zero exists in the UF

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a null-pointer dereference exists in the U

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability ex

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an

A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.2, FortiClientWindo

Unchecked return value for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applic

Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tomca

Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_all

The application does not impose strict enough restrictions on directory access permissions, posing a risk that other mal

The automatic folder creation feature of Lhaz and Lhaz+ provided by Chitora soft contains a path traversal vulnerability

SQL injection vulnerability exists in @sap/hdi-deploy package, where SQL queries are dynamically constructed using user

Sangoma Switchvox before 8.4 places cleartext SIP authentication credentials in a backup file.

Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Prior to 2.9.3, a server-side request

An issue with app access to camera metadata was addressed with improved logic. This issue is fixed in iOS 18.7.9 and iPa

This issue was addressed with improved permissions checking. This issue is fixed in macOS Tahoe 26.4. A malicious app ma

Microdot is a minimalistic Python web framework. Prior to 2.6.1, the Response.set_cookie() method does not sanitize its

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows HTTP request split

OpenClaw before 2026.4.15 contains an arbitrary local file read vulnerability in the webchat audio embedding helper that

Zen is a firefox-based browser. Prior to 1.19.12b, RSS feed URLs entered by the user are validated to http: or https: in

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Page/Art

A flaw has been found in bettercap up to 2.41.5. Affected by this issue is some unknown functionality of the file module