By severity

Low-severity vulnerabilities

CVEs rated Low by CVSS, with SEC.co remediation and prioritization guidance.

211 published vulnerabilities · page 3 of 3

• CVE-2026-41986LOW 2.4

  CVE-2026-41986 is a logic bypass vulnerability affecting file system operations. An attacker with physical access to a system could exploit this flaw to disrupt availability—for example, by manipulating file system behavior to cause denial of service. The vulnerability requires direct physical interaction with the machine and carries a low severity rating. The primary concern is operational disruption rather than data theft or system compromise.

• CVE-2026-49317LOW 2.4

  The 2025 Indian Motorcycle Scout Bobber + Tech infotainment system has a logic flaw in how it initializes during boot. The system is supposed to require a PIN to unlock, but it uses a problematic shortcut: it checks whether it detects wireless messages from the motorcycle's Wireless Control Module (WCM) during startup. If those messages are absent, the system assumes no immobilizer is present and skips the PIN screen entirely, granting immediate access to the infotainment interface. An attacker with adjacent network access can silence the WCM during the boot window—using techniques like a CAN bus-off attack—to trick the system into thinking the immobilizer is not installed, thereby bypassing the PIN protection that should guard the interface.

• CVE-2026-49318LOW 2.4

  A flaw in the 2025 Indian Motorcycle Scout Bobber + Tech's infotainment system allows someone with physical proximity to the motorcycle to unlock the digital display without entering the correct PIN. The system incorrectly assumes that if it doesn't detect wireless signals from a control module during startup, no security PIN is needed. An attacker can exploit this by blocking those signals during the boot process, causing the system to skip the PIN screen entirely and display the full user interface.

• CVE-2026-12567LOW 2.2

  CVE-2026-12567 is a local privilege escalation flaw in the github_workflows module that fails to validate repository names for symlink attacks. An attacker with local access to the scan directory can create a malicious symlink at a predictable output location, tricking the module into writing workflow data wherever the attacker directs. This requires local system access and user interaction, limiting immediate blast radius but creating a path for data exfiltration or code injection in multi-user or CI/CD environments.

• CVE-2026-50266LOW 2.2

  A flaw in OpenStack Neutron versions before 28.0.1 allows project managers to perform network spoofing attacks on shared networks. The vulnerability stems from overly permissive role-based access control (RBAC) policies that allow any project manager to create or modify ports on networks they don't own, and crucially, to assign those ports special "trusted" network service identities (like DHCP servers). This bypasses normal anti-spoofing rules and security group protections, enabling attackers to spoof DHCP, MAC, or IP addresses to target other tenants sharing the same network. This is a reintroduction of a vulnerability that was supposedly fixed nearly a decade ago.

• CVE-2026-45403LOW 2.0

  AnythingLLM versions before 1.13.0 contain a path traversal vulnerability in the agent filesystem copy tool. When copying files, the application only validates the top-level source and destination directories but fails to validate nested files or reject symbolic links. An attacker with high privileges could create or exploit a symlink nested within an allowed source directory to read files outside the intended filesystem boundaries and copy them to an allowed destination, potentially exposing sensitive data. The vulnerability requires high user privileges, complex conditions, and user interaction to exploit, making practical real-world abuse unlikely despite the core weakness.

• CVE-2026-47713LOW 2.0

  AnythingLLM versions before 1.13.0 contain a token persistence flaw that can leak sensitive data when administrators migrate from single-user to multi-user mode. A mobile device token issued in single-user mode may remain valid after the migration, allowing it to bypass user-scoping controls and access workspaces and chat content belonging to other users. The vulnerability requires an attacker to have had a legitimate mobile device token before the migration, then exploit it post-migration in the multi-user environment.

• CVE-2026-11786LOW 1.9

  A parsing flaw in 389 Directory Server can cause the LDIF (LDAP Data Interchange Format) parser to read past the boundary of allocated memory when it encounters attribute types ending with semicolons during database imports. The defect is detectable only under memory instrumentation tools (such as AddressSanitizer) and does not cause immediate functional failure or crashes under normal operation. This is a low-severity out-of-bounds read affecting local, high-privileged operations.

• CVE-2026-50268LOW 1.9

  Steeltoe.Configuration.Encryption versions 4.0.0 through 4.1.0 contain a configuration bug where the OAEP encryption algorithm setting does not work as intended. When administrators configure the system to use OAEP (a stronger RSA encryption variant), the software incorrectly falls back to the weaker PKCS#1 v1.5 algorithm instead. This occurs due to an incorrect transformation string passed to the BouncyCastle cryptographic library. The vulnerability requires local access and administrative privileges to exploit, making it a low-risk issue in most environments. Version 4.2.0 corrects this defect.

• CVE-2026-12065LOW 1.8

  A vulnerability in the Groww Stock, Mutual Fund, and Gold app (Android versions up to 20260805) allows attackers with physical access to a device to bypass authorization checks on custom URL schemes handled by the app's WebView component. An attacker would need to be present at the device and have some level of authentication context, making this a low-risk issue in typical operational environments. The issue affects the app's custom protocol handlers, which are entry points for inter-app communication on Android.

• CVE-2026-48617LOW 1.8

  Node.js versions 22, 24, and 26 contain a flaw in how they enforce the Permission Model security feature. Specifically, the `process.report.writeReport()` function does not properly validate file paths, allowing an authenticated local attacker with high privileges to bypass the intended security boundary. The risk is limited to integrity impact in this case, though the vulnerability could expose sensitive information under certain configurations. This is a low-severity issue that requires local access and user interaction to exploit.