2026 · Low

Low-severity vulnerabilities disclosed in 2026

Low-rated CVEs published in 2026, with SEC.co remediation and prioritization guidance.

385 published vulnerabilities · page 4 of 4

• CVE-2026-45426LOW 3.1

  Apache Airflow's log server uses a flawed string-matching approach to authorize workers' access to task logs. Instead of checking if a worker's JWT token matches a specific Dag name exactly, the system strips characters from the left side of requested Dag names in a way that can match multiple unintended Dags. An authenticated worker with a token for 'dag_a' could read logs from 'dag_attacker', 'aaaa_target', or '_dag_secret'—any Dag whose name starts with characters found in 'dag_a'. This breaks the intended per-Dag log isolation in multi-team environments.

• CVE-2026-45739LOW 3.1

  Strawberry GraphQL, a popular library for building GraphQL APIs, has a flaw in its bundled GraphiQL interface (versions 0.288.4 through 0.315.3) where sensitive headers entered by developers are inadvertently exposed in the browser URL. When a developer pastes an authorization token or other credential into the GraphiQL headers editor, that value becomes part of the page URL and persists in browser history, shareable links, and server access logs. This creates a credential leakage risk if someone gains access to those logs or if links are shared. The issue has been patched in version 0.315.4.

• CVE-2026-48102LOW 3.1

  7-Zip versions 9.11 through 26.00 contain a flaw in how they parse UDF (Universal Disk Format) disc images—used in .iso and .udf files. When processing certain malformed UDF file structures, the parser reads 1 to 3 bytes beyond the allocated memory buffer. This out-of-bounds read occurs during the file open operation and can reveal small amounts of memory content or cause the application to crash. The vulnerability requires user interaction (opening a crafted archive) and affects only information disclosure and stability, not file integrity or system compromise.

• CVE-2026-48587LOW 3.1

  Django's cache handling function has a flaw where whitespace in HTTP Vary headers isn't properly cleaned up before comparison. An attacker can exploit this by crafting requests that cause the application to serve cached responses intended for different users, potentially leaking sensitive information. The vulnerability affects Django 5.2 before version 5.2.15 and 6.0 before version 6.0.6, though older unsupported versions may also be vulnerable.

• CVE-2026-48588LOW 3.1

  Django's caching middleware can inadvertently store and serve responses to users who shouldn't have access to them. Specifically, when a web application uses Django's built-in cache features, the system may cache sensitive data tied to one user's session and then deliver it to another user if they send requests with different cookies. This happens because the cache doesn't properly distinguish between requests based on unrelated cookie values. An attacker would need to craft requests to trigger the cache to serve cached private data, making this a read-only exposure rather than an active attack vector.

• CVE-2026-49380LOW 3.1

  JetBrains TeamCity versions before 2026.1 contain an open redirect vulnerability in the SAML authentication plugin. An attacker could craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled website after authentication. This requires user interaction and offers limited direct impact, but could be chained with phishing or credential harvesting tactics.

• CVE-2026-53663LOW 3.1

  React Router versions 7.12.0 through 7.15.0 had incomplete cross-site request forgery (CSRF) protections in Framework Mode. The framework checked for CSRF tokens on POST requests but skipped this validation entirely for PUT, PATCH, and DELETE requests. However, the practical risk is limited because modern browsers already enforce CORS preflight checks and SameSite cookie policies that prevent most cross-origin attacks. The issue is resolved in React Router 7.15.1.

• CVE-2026-56325LOW 3.1

  Capgo versions before 12.128.2 have a flaw in how they look up application identifiers when serving preview content. Instead of checking for exact matches, the system uses pattern matching that treats underscore characters as wildcards—similar to how some database queries work. An attacker with an account on Capgo can exploit this by creating apps with slightly different names that leverage these wildcard behaviors, potentially breaking preview functionality for legitimate applications or causing confusion about which app is being accessed.

• CVE-2026-57922LOW 3.1

  JetBrains YouTrack versions before 2026.2.16593 contained a flaw that allowed authenticated users to disclose project settings through the Model Context Protocol (MCP) integration. The vulnerability requires valid login credentials and specific conditions to exploit, making it a lower-risk issue suited for standard patch cycles rather than emergency response.

• CVE-2026-58371LOW 3.1

  SeaweedFS versions before 4.30 have a reflected cross-site scripting (XSS) vulnerability in their JSON response handling. An attacker can craft a malicious web page that, when visited by a user with network access to a SeaweedFS cluster, silently extracts sensitive information like cluster topology, server locations, and file listings. The vulnerability exists because SeaweedFS echoes back user-supplied callback parameters in responses labeled as JavaScript, without proper validation or security headers to prevent browsers from executing the reflected content.

• CVE-2026-59215LOW 3.1

  Open WebUI versions before 0.10.0 contain a vulnerability that allows authenticated users to view thread conversations from other private channels or direct messages they shouldn't have access to. The flaw exists because the system doesn't properly verify that a message thread belongs to the channel being accessed—an attacker can reference a message ID from a different channel to read its context. This is a low-severity issue requiring authentication and specific conditions to exploit, but it does enable unauthorized information disclosure.

• CVE-2026-59226LOW 3.1

  Open WebUI versions 0.9.0 through 0.9.x contain a privilege and access control flaw where deactivated users can still trigger scheduled automation tasks and access AI models they should no longer have permission to use. The vulnerability stems from insufficient re-validation when executing stored automations and overly lenient model access checks. An attacker with a deactivated account could potentially continue running automations or accessing restricted models until the account is fully removed from the system.

• CVE-2026-59715LOW 3.1

  Open WebUI versions 0.6.16 through 0.9.x contain a flaw in how their real-time collaboration features handle user authentication. The Socket.IO server—which powers live document editing—was misconfigured to accept certain collaboration events (specifically document awareness updates and leave notifications) from any connection, even those without a valid user login. This allows an unauthenticated attacker to interfere with the state of shared documents, though the impact is limited to integrity (not confidentiality or availability). The vulnerability was resolved in version 0.10.0.

• CVE-2026-6873LOW 3.1

  Django's signed cookie verification contains a cryptographic flaw in how it generates salts for cookie signatures. By exploiting collisions in salt derivation, an authenticated attacker can repurpose a legitimately signed cookie in an unintended context—for example, using a cookie signed for one feature to authenticate requests for a different feature. This is a low-severity issue requiring prior authentication and careful attack setup, but it undermines the integrity guarantee that signed cookies are meant to provide.

• CVE-2026-7666LOW 3.1

  Django's email system has a vulnerability that can expose email content over the network under specific conditions. When Django is configured to silently ignore mail delivery errors (`fail_silently=True`) and a secure connection attempt fails, the system may reuse a partially-initialized connection that falls back to unencrypted communication. An attacker positioned on the network path between your application and the mail server could potentially read email content in transit. This requires multiple conditions to align: configuration settings, network positioning, and a failed STARTTLS handshake.

• CVE-2026-8404LOW 3.1

  Django's cache middleware has a case-sensitivity bug in how it reads `Cache-Control` directives. When a web application uses uppercase or mixed-case values in `Cache-Control` headers (e.g., `PRIVATE` instead of `private`), the middleware fails to recognize them as valid directives. This causes responses that should not be cached to be cached anyway, potentially exposing sensitive data to unauthorized users who can trigger cache hits.

• CVE-2026-9920LOW 3.1

  Google Chrome on Android contains a vulnerability in GPU memory handling that could allow an attacker who has already compromised the browser's renderer process to access sensitive data from websites that should be isolated from each other. The vulnerability stems from uninitialized memory in the GPU code path, which under specific conditions could leak cross-origin data through a malicious webpage. This requires the renderer process to be compromised first, making it a secondary exploitation step rather than a direct entry point.

• CVE-2026-9944LOW 3.1

  CVE-2026-9944 is a memory safety issue in the ANGLE graphics library used by Google Chrome. An attacker who has already compromised Chrome's renderer process can craft a malicious webpage to leak sensitive data from other websites or origins. The vulnerability requires the renderer to be compromised first, limiting the attack surface, but the data leakage potential is real once that initial foothold exists. Chrome versions before 148.0.7778.216 are vulnerable on Windows, macOS, and Linux.

• CVE-2026-9950LOW 3.1

  A same-origin policy bypass vulnerability exists in Google Chrome on iOS versions prior to 148.0.7778.216. The flaw stems from insufficient validation of untrusted input that allows an attacker who has already compromised Chrome's renderer process to craft a malicious HTML page that circumvents browser security boundaries. This means an attacker could potentially access data or perform actions from a different website origin than the one a user is visiting, but only if the renderer process has already been compromised through another attack vector.

• CVE-2026-9959LOW 3.1

  A race condition in WebRTC functionality within Google Chrome on Windows allows an attacker to leak data across origin boundaries. The vulnerability requires user interaction (clicking on a crafted HTML page) and is difficult to exploit reliably due to timing constraints. While the underlying issue is rated High severity by Chromium, the CVSS 3.1 score of 3.1 reflects the practical barriers to exploitation and limited scope—an attacker can extract sensitive information, but cannot modify data or disrupt service.

• CVE-2026-9991LOW 3.1

  A vulnerability in Google Chrome's media handling on Windows allows an attacker who has already compromised the browser's renderer process to extract sensitive data across security boundaries. The attacker would need to host a malicious webpage and trick a user into visiting it while the renderer is already under their control. The exposure is information disclosure—no system takeover or crashes—and the barrier to exploitation is relatively high because the attacker must first achieve renderer compromise.

• CVE-2026-49358LOW 3.0

  PhpWeasyPrint, a PHP library used to generate PDFs from URLs or HTML content, contains a flaw in how it manages temporary files. Before version 2.6.0, the list of temporary files is stored in a public variable that any code in the application can modify. When the library shuts down, it deletes every file listed in that variable without checking whether those files actually belong to the temporary folder. This means an attacker with code execution could trick the library into deleting arbitrary files on the system by adding them to the list. The vulnerability requires an attacker to have already compromised the application or have another way to run PHP code in the same process.

• CVE-2024-58350LOW 2.9

  Ghidra, the reverse-engineering framework maintained by the NSA, contains a memory management flaw that can cause the application to hang or crash during shutdown. The problem stems from improperly ordered cleanup of internal components, where the program attempts to access memory that has already been freed. An attacker with local access can trigger this condition, resulting in a denial-of-service effect. This is a low-severity issue with limited real-world impact, as it requires local execution and only affects availability during the shutdown phase.

• CVE-2026-39199LOW 2.9

  snes9x version 1.63 contains a flaw that allows an attacker to cause a denial of service by supplying a maliciously crafted .ups file. The vulnerability involves writing data outside the intended memory boundaries, but exploitation requires local access and specific conditions to be met. This is a low-severity issue primarily affecting users who process untrusted patch files on systems running the vulnerable version.

• CVE-2026-39894LOW 2.9

  Cacti, an open-source performance monitoring framework, has a data integrity flaw in versions 1.2.30 and earlier. The issue stems from how the system handles decimal numbers when the server is configured with certain locales (like German) that use commas instead of periods as decimal separators. When Cacti sends metric data to RRDtool for storage, locale-dependent formatting causes the decimal separator to change from a period to a comma, which RRDtool doesn't recognize. This causes monitoring data to be misaligned or discarded entirely. The flaw requires specific server locale misconfiguration and is not remotely exploitable, but it silently corrupts your metrics—potentially masking real performance issues. The fix is available in version 1.2.31.

• CVE-2026-57062LOW 2.9

  GnuPG's gpgsm tool, which handles digitally signed and encrypted messages in a standard format called CMS (Cryptographic Message Syntax), has a flaw in how it validates a specific cryptographic parameter. When using AES-GCM encryption, the tool should reject messages where a security tag is shorter than 12 bytes, but instead it incorrectly accepts messages with a 4-byte tag. This laxness in validation could allow an attacker to forge or tamper with encrypted messages in ways that might not be detected, though the practical impact is limited and requires local access.

• CVE-2026-10078LOW 2.7

  Quay's config-tool contains a flaw in how it handles GitLab OAuth setup. When administrators configure GitLab as an identity provider, sensitive credentials (client ID and secret) are passed in plaintext within the URL query string of POST requests. This is problematic because these credentials can be logged by web servers, reverse proxies, load balancers, and monitoring systems—anywhere that records HTTP request details. An attacker who gains access to these logs could extract the credentials and impersonate Quay's OAuth client to GitLab, potentially gaining unauthorized access to repositories or other GitLab resources.

• CVE-2026-10753LOW 2.7

  The Site Kit by Google WordPress plugin before version 1.176.0 contains a privilege escalation vulnerability affecting its REST API. Users with Editor-level access or those granted dashboard sharing permissions can modify plugin settings that should be restricted to administrators only. This occurs because the REST API endpoint lacks proper role-based access controls. While the technical impact is limited to unauthorized configuration changes, the vulnerability could allow lower-privileged users to alter site-wide plugin behavior without administrative approval.

• CVE-2026-11578LOW 2.7

  Fluent Forms, a popular WordPress form-building plugin, contains an authorization flaw in versions before 6.2.5. Administrators who restrict certain user accounts (called Managers) to manage only specific forms can inadvertently expose a security gap: those restricted Managers can delete submission data from forms they're not supposed to have access to. This is a low-severity issue that only affects WordPress sites using a non-default setup where form access has been deliberately restricted by role.

• CVE-2026-11781LOW 2.7

  The Adminify WordPress plugin before version 4.2.10 has a weakness in its administration search feature that fails to properly check user permissions. This allows lower-privilege users (such as Contributors) to view sensitive information they shouldn't have access to, including unpublished posts from other authors, pending comments, inventory data, and usernames. The vulnerability requires an authenticated attacker with at least Contributor-level access, limiting exposure but still posing a confidentiality risk in multi-author environments.

• CVE-2026-12102LOW 2.7

  A WordPress plugin called UsersWP has a flaw that allows editors and higher-level users to delete profile images (avatars and banners) belonging to any other user, including administrators. The vulnerability exists because the plugin doesn't properly validate which user a person is trying to modify when they submit a request to change or remove an image. While the impact is limited to image deletion and requires elevated account privileges to exploit, it could be used to deface user profiles or cause minor disruption.

• CVE-2026-12211LOW 2.7

  A path traversal vulnerability has been discovered in Intelbras iNVU 7016 FT running firmware version 3.004.00IB000.0.T (Build 2025-09-26). An attacker with high-level administrative privileges can manipulate requests to the web interface's /RPC2_Loadfile/syslog/ endpoint to access files outside their intended directory. The vulnerability requires authentication and has limited confidentiality impact, but the vendor has already released a patched version. Public exploit code is available, though practical exploitation remains constrained by privilege requirements.

• CVE-2026-12755LOW 2.7

  Devolutions Server contains a flaw in how it validates user input on Active Directory discovery endpoints used for PAM (Privileged Access Management) functions. An authenticated user with UserGroupsView permission can manipulate the DomainName parameter to trick the server into attempting authentication to a system they control, thereby capturing NTLMv2 credential hashes from the PAM provider. This is a credential exposure risk limited to authenticated users with specific permissions.

• CVE-2026-27790LOW 2.7

  CVE-2026-27790 is a low-severity vulnerability affecting Gallagher Command Centre and its T20 reader hardware. An authenticated operator with proper authorization can send crafted requests to trigger an unhandled exception that forces the T20 Readers to restart, causing temporary unavailability. Because it requires valid credentials and administrator-level access to exploit, the practical risk is contained, but the impact in access control environments where reader downtime disrupts operations should not be dismissed.

• CVE-2026-27844LOW 2.7

  A flaw in Gallagher's Command Centre diagnostic web interface allows an authenticated operator to restart the Controller 6000 or Controller 7000 by sending specially crafted requests. This causes temporary unavailability of access control functions. The vulnerability requires valid credentials and high-level operator privileges, limiting real-world exposure. Affected versions span from 9.10 and earlier through 9.50, though multiple maintenance releases have introduced patches.

• CVE-2026-44367LOW 2.7

  Klaw, a Kafka topic management and governance platform, contains a vulnerability in how it handles usernames during registration and login. The system doesn't consistently apply case sensitivity rules—treating 'Admin' and 'admin' as different or the same depending on the operation—which allows authenticated users with administrative privileges to deliberately lock out accounts or trigger denial of service conditions. This is a low-severity issue requiring administrative access to exploit, but it can impact operational availability if administrators use it maliciously or if the inconsistency is exploited in targeted attacks. The flaw was fixed in version 2.10.4.

• CVE-2026-45076LOW 2.7

  Synapse, an open-source Matrix homeserver implementation used for federated messaging, contains a flaw in how it handles room history in cross-server deployments. Malicious homeservers can craft specially formed room events that cause Synapse instances to withhold historical messages from clients requesting older conversation data. Users may see incomplete chat histories or missing messages when paginating through room archives. This is a low-severity issue because it requires a compromised or malicious federated peer and affects data availability rather than confidentiality or integrity.

• CVE-2026-46466LOW 2.7

  Dell PowerProtect Data Domain is vulnerable to a flaw where high-privileged attackers with remote network access can manipulate information on the system. The vulnerability stems from the software trusting data from less reliable sources than it should. This affects multiple versions across different release lines (7.7.1.0–8.7, plus specific LTS versions from 2024–2026). While the flaw requires administrator-level credentials to exploit, organizations relying on Data Domain for backup and deduplication should treat this as a data integrity risk.

• CVE-2026-49979LOW 2.7

  Appsmith versions before 1.99 contain a vulnerability in the test email functionality that allows high-privileged users to perform internal network reconnaissance. When an authenticated admin tests the email configuration, the application accepts custom SMTP server addresses without validating whether they point to internal IP ranges. An attacker with admin access can abuse this to probe internal services, discover what's running on specific ports, and gather system information through detailed error messages—all without leaving the admin panel. The vulnerability requires existing admin credentials, limiting its practical attack scope.

• CVE-2026-53480LOW 2.7

  Dell PowerProtect Data Domain—a backup and deduplication appliance used in enterprise data protection—contains a path traversal vulnerability affecting multiple release branches. An attacker with high-level administrative or service credentials who can reach the device remotely could modify files outside intended directories, potentially altering system behavior or corrupting protected data. The vulnerability is rated LOW severity due to the requirement for elevated privileges and limited immediate impact.

• CVE-2026-57961LOW 2.7

  phpMyFAQ versions before 4.1.5 contain a path traversal vulnerability that allows authenticated users with FAQ editing privileges to read files outside the intended content directory. An attacker would craft malicious image paths in HTML content stored in FAQ entries. When that content is exported to PDF, the vulnerable path-resolution logic fails to properly constrain file access, potentially exposing sensitive files on the server. This requires both authentication and FAQ editing permissions, significantly limiting the attack surface.

• CVE-2026-6352LOW 2.7

  GitLab Enterprise Edition contains an authorization flaw that allows authenticated users with auditor-level access to modify compliance violation records through GraphQL API calls. The vulnerability affects multiple version branches and requires high privilege credentials to exploit, limiting real-world impact to insider threats or compromised admin accounts.

• CVE-2026-8800LOW 2.7

  Progress MOVEit Transfer contains an authorization flaw in its Audit User module that allows high-privileged users to access information they shouldn't have permission to see. The vulnerability is limited in scope—it only exposes confidential data, does not allow modification or deletion, and requires an authenticated account with elevated privileges to exploit. Most organizations running recent versions are either already patched or face minimal risk from this issue.

• CVE-2026-9088LOW 2.7

  Keycloak contains a flaw in how it enforces user profile visibility rules for delegated administrators. An admin with permission to view group memberships and users can circumvent access controls by querying the group members endpoint, allowing them to see sensitive user attributes that should be hidden from them. This is a controlled-access issue—the attack requires administrative privileges and does not affect regular users or public-facing functionality.

• CVE-2026-45154LOW 2.6

  Nextcloud, an open-source content collaboration platform, contains a flaw affecting versions 2.6.0 through 4.2.x that allows guest users to retrieve deleted collaborative pages from the trash when the parent collective is shared in view-only mode. An attacker with guest access could circumvent intended deletion by directly accessing removed content, though the exposure is limited to information disclosure and requires prior access to the shared collective. The vulnerability has been resolved in version 4.3.0.

• CVE-2026-45155LOW 2.6

  Nextcloud Server contains a flaw in its circles feature that allows authenticated users to add unknown circles to other circles by directly referencing their IDs, potentially enabling membership tracking. While circle IDs are designed with high complexity (62^15 combinations), if an attacker obtains a valid circle ID through other means, they could exploit this missing access control. The vulnerability requires an authenticated session and user interaction to exploit, making opportunistic attacks unlikely but targeted attacks possible if circle IDs are discovered.

• CVE-2026-57234LOW 2.6

  Nokogiri, a widely-used Ruby library for parsing XML and HTML, has a flaw in its JRuby implementation that bypasses a security setting meant to prevent external network access during schema parsing. An attacker with authenticated access could craft a malicious schema file that, when parsed, fetches resources from attacker-controlled servers. This could enable Server-Side Request Forgery (SSRF) or XML External Entity (XXE) attacks, potentially leaking sensitive data or compromising internal systems. The vulnerability affects JRuby users only; the standard Ruby implementation is not impacted. The issue is resolved in version 1.19.4.

• CVE-2026-57926LOW 2.6

  JetBrains YouTrack versions before 2026.2.16593 contain a prototype pollution vulnerability in the websandbox bridge component. An authenticated user with user-interaction involvement could exploit this flaw to modify object properties, potentially leading to limited integrity compromise. The vulnerability has a low CVSS score of 2.6, reflecting its narrow attack surface and minimal impact.

• CVE-2026-9694LOW 2.6

  GitLab CE/EE contains a vulnerability in its Service Desk feature that allows an unauthenticated attacker to impersonate the GitLab Support Bot through a specially crafted email reply. The attacker can inject arbitrary content into email template processing under specific conditions. While the vulnerability requires certain setup conditions and user interaction to exploit, it could lead to content injection that misleads users interacting with the support system.

• CVE-2026-10783LOW 2.5

  A weakness in Gradio 6.14.0's audio caching function allows a local user with limited privileges to potentially access confidential information through use of a weak cryptographic hash. The attack is technically difficult to execute and requires hands-on access to the system. While a public exploit exists, real-world exploitation remains unlikely due to high complexity requirements and low impact scope.

• CVE-2026-11481LOW 2.5

  A weakness in the grepai project (versions up to 0.35.0) allows a local user with login privileges to manipulate how the Postgres Embedding Cache stores and retrieves content hashes, potentially causing the system to use weak cryptographic hashing. The vulnerability requires significant technical knowledge to exploit and poses limited immediate risk, but should be addressed through the pending patch once merged.

• CVE-2026-14702LOW 2.5

  CVE-2026-14702 is a low-severity flaw in the markdownify-mcp library (versions up to 1.1.0) that weakens the randomness used to generate temporary file names. An attacker with local access to a system running this library could potentially predict or manipulate temporary file names, though doing so requires significant technical skill and knowledge of the affected code. The vulnerability does not enable remote exploitation and has minimal direct impact on system confidentiality or availability.

• CVE-2026-15168LOW 2.5

  Wireshark's BLF (Binary Logging Format) file parser in recent versions contains a flaw that could leak sensitive information when a user opens a specially crafted BLF file. An attacker would need to trick a user into opening a malicious file locally—this is not a remote attack and requires user interaction. The risk is limited to potential disclosure of small amounts of data; the vulnerability does not enable system compromise, privilege escalation, or denial of service.

• CVE-2026-41514LOW 2.5

  OP-TEE, a security processor for Arm-based systems, has a weakness in how it decrypts RSA-encrypted data when using Hisilicon hardware acceleration. The flaw allows an attacker who can send specially crafted encrypted messages to gradually extract the original plaintext—similar to attacks on poorly implemented encryption padding schemes. This requires approximately 1000–2000 attempts and local system access, making it a low-risk issue in most deployments. The vulnerability exists only when a specific optional hardware driver is enabled, and it is disabled by default.

• CVE-2026-41515LOW 2.5

  OP-TEE, a security technology that runs on Arm processors, contains a flaw in how it decrypts certain encrypted messages. The vulnerability allows an attacker with local access to recover the contents of RSA-OAEP encrypted data by sending many specially crafted messages and observing how the system responds. The flaw stems from a timing-sensitive implementation detail that inadvertently leaks information about decryption failures. While the recovery process requires thousands of attempts, the theoretical risk is real for systems processing sensitive encrypted material. The issue affects OP-TEE versions 3.9.0 through 4.10.x; patched version 4.11.0 is available.

• CVE-2026-41516LOW 2.5

  OP-TEE, a security layer that runs trusted code on Arm processors, contains a flaw in how it decrypts RSA-encrypted messages when using Hisilicon hardware accelerators. The vulnerability allows an attacker with local access to recover the original encrypted data through timing analysis—observing slight differences in how long decryption takes depending on the input. This is a well-known class of attack against RSA encryption implementations that fail to run in constant time. The issue affects OP-TEE versions 4.5.0 through 4.10.x and is resolved in version 4.11.0.

• CVE-2026-54326LOW 2.5

  Pi is a lightweight terminal-based code editor that lets developers export their work sessions as static HTML files for documentation or sharing. Between versions 0.74.0 and 0.78.0, the application failed to properly validate link and image URLs in these exports, allowing potentially harmful URLs to slip through. An attacker could craft a malicious Markdown file that, when exported to HTML, would contain dangerous links—such as those beginning with 'javascript:' or other browser-executable schemes. The flaw exploited a bypass technique: sneaking C0 control characters (invisible, non-printing characters) into the URL scheme to fool the security filter. Browsers automatically clean up these hidden characters before acting on URLs, meaning the malicious intent survives. This is a low-severity issue because it requires local access to the Pi application and user interaction to trigger. It was patched in version 0.78.1.

• CVE-2026-10112LOW 2.4

  CVE-2026-10112 is a stored or reflected cross-site scripting (XSS) vulnerability in the Dashboard Page component of STUDENT-MANAGEMENT-SYSTEM version 1.0. An attacker with high privileges can inject malicious scripts through the Name parameter, which are then executed in the browsers of users who view the affected page. The vulnerability requires user interaction and has a low CVSS score of 2.4, but exploitation has already been disclosed publicly.

• CVE-2026-10514LOW 2.4

  A cross-site scripting (XSS) vulnerability exists in CordysCRM versions up to 1.6.2. The flaw is located in a request parameter handling component and allows attackers with administrative privileges to inject malicious scripts that execute in users' browsers. While public exploit code is available, the attack requires both high-level credentials and user interaction (such as clicking a malicious link), significantly limiting real-world risk. Upgrading to version 1.7.0 resolves the issue.

• CVE-2026-10529LOW 2.4

  A cross-site scripting (XSS) vulnerability has been discovered in westboy CicadasCMS affecting the Task Scheduling Management Module. The flaw exists in the ScheduleJobController component and can be triggered by an authenticated user with elevated privileges through a specially crafted request. While the vulnerability requires administrative or high-privilege access to exploit, the presence of user interaction (rendering) combined with public availability of exploit details elevates attention. The CMS uses a rolling release model, making definitive version tracking difficult, though the affected commit hash has been identified.

• CVE-2026-11338LOW 2.4

  A reflected cross-site scripting (XSS) vulnerability exists in SourceCodester Ship Ferry Ticket Reservation System version 1.0. An authenticated administrative user with high privileges can inject malicious JavaScript into the Username parameter on the user management page, which executes in the browsers of other users who view the manipulated content. The vulnerability requires user interaction and administrative access to trigger, limiting its immediate exposure but potentially enabling unauthorized account manipulation or credential theft within administrative workflows.

• CVE-2026-11434LOW 2.4

  FluentCMS version 0.0.5 contains a cross-site scripting (XSS) vulnerability in its Blocks Plugin, specifically within the /admin/blocks file. An authenticated administrator with high privileges can inject malicious scripts that execute in the browsers of other users viewing the affected page. The vulnerability requires user interaction (such as clicking a link) to trigger. Public exploit code is available, though the low CVSS score reflects the requirement for high-privilege authentication and user interaction to succeed.

• CVE-2026-11468LOW 2.4

  A cross-site scripting (XSS) vulnerability exists in SourceCodester Hospitals Patient Records Management System version 1.0. An authenticated administrator with high privileges can inject malicious scripts through the room_types page by manipulating the room parameter. When another user visits the affected page, the injected script executes in their browser, potentially allowing session hijacking, credential theft, or malware distribution. The vulnerability requires both administrative access to initiate the attack and user interaction (clicking a link or visiting a crafted URL) for the payload to execute. While the CVSS score is low, the healthcare context and potential for patient data exposure warrant careful attention.

• CVE-2026-11491LOW 2.4

  CodeAstro Human Resource Management System version 1.0 contains a stored cross-site scripting (XSS) vulnerability in its Notice Board Management feature. An attacker with high privileges can inject malicious JavaScript into the Notice Title field, which is then executed in the browsers of other users viewing that notice. The vulnerability requires user interaction (a victim must view the affected notice) and has already been disclosed publicly with exploit code available.

• CVE-2026-12202LOW 2.4

  A stored or reflected cross-site scripting (XSS) vulnerability exists in Intelliants Subrion CMS versions up to 4.0.3. The flaw resides in the Blocks Endpoint component, where improper handling of CSS class name parameters allows an attacker to inject malicious scripts. Because the vulnerability requires administrative privileges to exploit and user interaction is needed for the attack to succeed, the overall risk is low. However, the public disclosure of this issue means threat actors now have detailed information about how to craft attacks.

• CVE-2026-13514LOW 2.4

  Chess Play and Learn App for Android (versions up to 4.9.42) contains a security flaw in how it handles backup files specified in its AndroidManifest.xml configuration. An attacker with physical access to a device can potentially expose sensitive backup data that should remain protected. While the flaw is real and a proof-of-concept has been publicly disclosed, exploitation requires direct hands-on access to the device itself, which significantly limits the attack surface in most enterprise and personal use scenarios.

• CVE-2026-14655LOW 2.4

  A cross-site scripting (XSS) vulnerability exists in code-projects Assessment Management version 1.0, specifically in the admin/view-users.php file. An authenticated administrator with elevated privileges can inject malicious code through the User parameter, which executes in the browsers of other users viewing the affected page. This allows an attacker to steal session tokens, redirect users, or perform actions on their behalf. Exploitation requires both high-level access and user interaction, limiting real-world attack surface.

• CVE-2026-15321LOW 2.4

  MyEMS versions up to 6.4.0 contain a stored cross-site scripting (XSS) vulnerability in the Admin Backend API. The issue exists in the svg.py file's on_post function, where user-supplied data in the 'new_values' parameter is not properly sanitized before being stored or rendered. An authenticated administrator with high privileges can inject malicious scripts that will execute in the browsers of other users who interact with the affected feature. The vulnerability has a public exploit, though the low CVSS score reflects the requirement for administrative credentials and user interaction to trigger the attack.

• CVE-2026-41986LOW 2.4

  CVE-2026-41986 is a logic bypass vulnerability affecting file system operations. An attacker with physical access to a system could exploit this flaw to disrupt availability—for example, by manipulating file system behavior to cause denial of service. The vulnerability requires direct physical interaction with the machine and carries a low severity rating. The primary concern is operational disruption rather than data theft or system compromise.

• CVE-2026-49317LOW 2.4

  The 2025 Indian Motorcycle Scout Bobber + Tech infotainment system has a logic flaw in how it initializes during boot. The system is supposed to require a PIN to unlock, but it uses a problematic shortcut: it checks whether it detects wireless messages from the motorcycle's Wireless Control Module (WCM) during startup. If those messages are absent, the system assumes no immobilizer is present and skips the PIN screen entirely, granting immediate access to the infotainment interface. An attacker with adjacent network access can silence the WCM during the boot window—using techniques like a CAN bus-off attack—to trick the system into thinking the immobilizer is not installed, thereby bypassing the PIN protection that should guard the interface.

• CVE-2026-49318LOW 2.4

  A flaw in the 2025 Indian Motorcycle Scout Bobber + Tech's infotainment system allows someone with physical proximity to the motorcycle to unlock the digital display without entering the correct PIN. The system incorrectly assumes that if it doesn't detect wireless signals from a control module during startup, no security PIN is needed. An attacker can exploit this by blocking those signals during the boot process, causing the system to skip the PIN screen entirely and display the full user interface.

• CVE-2026-8387LOW 2.4

  ClearML, an open-source ML operations platform, contains a flaw in how it extracts compressed files from remote sources. When users download datasets, models, or artifacts, the system unpacks `.zip` files without properly validating file paths. An attacker can craft a malicious archive containing specially-named files that, when extracted, write to sensitive locations on the server—such as configuration directories or cron job folders. While the CVSS score is low due to requiring high-level authentication and user interaction, the potential for abuse exists in multi-tenant or shared environments where dataset or model files pass through untrusted sources.

• CVE-2026-41124LOW 2.3

  Dell PowerProtect Data Domain contains a path traversal vulnerability that allows a high-privileged local attacker to read sensitive files on affected systems. The vulnerability affects multiple versions across four release lines (7.13.1.x, 8.3.1.x, 8.6.1.x, and 7.7.1.0 through 8.6). While the impact is limited to information disclosure and requires both elevated privileges and local access, organizations running these backup appliances should assess their exposure and plan remediation.

• CVE-2026-9610LOW 2.3

  IBM Datacap and Datacap Navigator versions 9.1.7, 9.1.8, and 9.1.9 contain a flaw where certain features or data are accessible directly via URL without proper authorization checks, even though those features are not advertised in the user interface. An attacker with local access and elevated privileges could bypass intended security boundaries to view sensitive information.

• CVE-2026-12567LOW 2.2

  CVE-2026-12567 is a local privilege escalation flaw in the github_workflows module that fails to validate repository names for symlink attacks. An attacker with local access to the scan directory can create a malicious symlink at a predictable output location, tricking the module into writing workflow data wherever the attacker directs. This requires local system access and user interaction, limiting immediate blast radius but creating a path for data exfiltration or code injection in multi-user or CI/CD environments.

• CVE-2026-50266LOW 2.2

  A flaw in OpenStack Neutron versions before 28.0.1 allows project managers to perform network spoofing attacks on shared networks. The vulnerability stems from overly permissive role-based access control (RBAC) policies that allow any project manager to create or modify ports on networks they don't own, and crucially, to assign those ports special "trusted" network service identities (like DHCP servers). This bypasses normal anti-spoofing rules and security group protections, enabling attackers to spoof DHCP, MAC, or IP addresses to target other tenants sharing the same network. This is a reintroduction of a vulnerability that was supposedly fixed nearly a decade ago.

• CVE-2026-54327LOW 2.2

  Pi is a lightweight terminal-based coding tool that manages API authentication through a local configuration file. Between versions 0.74.0 and 0.78.1, a timing vulnerability could temporarily expose stored API keys and OAuth tokens with overly permissive file access before the application locked down security settings. This window is extremely brief but theoretically allows a local user with active session privileges to read credentials meant to be private. The issue has been patched in version 0.78.1.

• CVE-2026-45403LOW 2.0

  AnythingLLM versions before 1.13.0 contain a path traversal vulnerability in the agent filesystem copy tool. When copying files, the application only validates the top-level source and destination directories but fails to validate nested files or reject symbolic links. An attacker with high privileges could create or exploit a symlink nested within an allowed source directory to read files outside the intended filesystem boundaries and copy them to an allowed destination, potentially exposing sensitive data. The vulnerability requires high user privileges, complex conditions, and user interaction to exploit, making practical real-world abuse unlikely despite the core weakness.

• CVE-2026-46549LOW 2.0

  NocoDB, a spreadsheet-like database platform, contained a flaw in how it handled OAuth token permissions. When administrators issued OAuth tokens with intentionally restricted scopes—such as limiting access to specific features or databases—the system failed to actually enforce those restrictions. A user with such a restricted token could gain access to resources and perform actions far beyond what the token was meant to allow, effectively inheriting the full permissions of the underlying user account. This issue has been patched in version 2026.04.1.

• CVE-2026-47713LOW 2.0

  AnythingLLM versions before 1.13.0 contain a token persistence flaw that can leak sensitive data when administrators migrate from single-user to multi-user mode. A mobile device token issued in single-user mode may remain valid after the migration, allowing it to bypass user-scoping controls and access workspaces and chat content belonging to other users. The vulnerability requires an attacker to have had a legitimate mobile device token before the migration, then exploit it post-migration in the multi-user environment.

• CVE-2026-11786LOW 1.9

  A parsing flaw in 389 Directory Server can cause the LDIF (LDAP Data Interchange Format) parser to read past the boundary of allocated memory when it encounters attribute types ending with semicolons during database imports. The defect is detectable only under memory instrumentation tools (such as AddressSanitizer) and does not cause immediate functional failure or crashes under normal operation. This is a low-severity out-of-bounds read affecting local, high-privileged operations.

• CVE-2026-50268LOW 1.9

  Steeltoe.Configuration.Encryption versions 4.0.0 through 4.1.0 contain a configuration bug where the OAEP encryption algorithm setting does not work as intended. When administrators configure the system to use OAEP (a stronger RSA encryption variant), the software incorrectly falls back to the weaker PKCS#1 v1.5 algorithm instead. This occurs due to an incorrect transformation string passed to the BouncyCastle cryptographic library. The vulnerability requires local access and administrative privileges to exploit, making it a low-risk issue in most environments. Version 4.2.0 corrects this defect.

• CVE-2026-56364LOW 1.9

  ImageMagick versions prior to 7.1.2-13 contain a memory leak in code that processes OpenCL device configuration files. An attacker with write access to ImageMagick's OpenCL cache directory can place a specially crafted XML file with incomplete device elements. When ImageMagick reads this file, the memory leak causes the application to consume increasing amounts of memory until it runs out, rendering the service unavailable. This requires both local file system access and knowledge of where the cache directory is located, significantly limiting real-world attack scenarios.

• CVE-2026-12065LOW 1.8

  A vulnerability in the Groww Stock, Mutual Fund, and Gold app (Android versions up to 20260805) allows attackers with physical access to a device to bypass authorization checks on custom URL schemes handled by the app's WebView component. An attacker would need to be present at the device and have some level of authentication context, making this a low-risk issue in typical operational environments. The issue affects the app's custom protocol handlers, which are entry points for inter-app communication on Android.

• CVE-2026-48617LOW 1.8

  Node.js versions 22, 24, and 26 contain a flaw in how they enforce the Permission Model security feature. Specifically, the `process.report.writeReport()` function does not properly validate file paths, allowing an authenticated local attacker with high privileges to bypass the intended security boundary. The risk is limited to integrity impact in this case, though the vulnerability could expose sensitive information under certain configurations. This is a low-severity issue that requires local access and user interaction to exploit.