Low vulnerabilities — 3,726 matching vulnerabilities

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed — no installation and no source-code access required.

Scan your app free →

Severity	Vulnerability	Package	Ecosystem	Disclosed	Fixed version
2.3 low	CVE-2026-114130: NuxtLink script execution with pages disabled	`nuxt`	npm	22 Oct 2026	4.6.0
3.1 low	CVE-2026-113797: Electron extensions can read tab URLs and titles without permission	`electron`	npm	22 Oct 2026	45.0.0-alpha.4
3.9 low	CVE-2026-114122: Electron frame subscription can expose memory or crash apps	`electron`	npm	22 Oct 2026	42.11.6
3.9 low	CVE-2026-114124: Electron off-screen rendering on macOS can read out-of-bounds memory	`electron`	npm	22 Oct 2026	42.11.6
3.7 low	CVE-2026-107832: Fastify header validation bypass in propertyNames constraints	`fastify`	npm	22 Oct 2026	5.12.6
2.3 low	CVE-2026-114127: CSS injection in Astro View Transitions	`astro`	npm	22 Oct 2026	7.3.3
Low	GHSA-c6gr-qvv4-5v3f: DOMPurify XHTML-mode SVG sanitization allows click-triggered XSS	`dompurify`	npm	22 Oct 2026	3.4.17
2.3 low	CVE-2026-113786: pypdf Arbitrary Image Parser Invocation via Unvalidated JPEG Data	`pypdf`	PyPI	21 Oct 2026	6.21.1
3.3 low	CVE-2026-113731: djust Arbitrary Absolute-Path File Read Vulnerability	`djust`	PyPI	21 Oct 2026	1.0.10
3.1 low	CVE-2026-113648: ApostropheCMS Import-Export Package Lacks Authentication in Clean Export Route	`@apostrophecms/import-export`	npm	21 Oct 2026	3.7.1
2.1 low	CVE-2026-112945: Cross-origin script execution through Vite custom middleware	`vite`	npm	21 Oct 2026	8.3.3
3.7 low	CVE-2026-111766: markdown-it Quadratic-Time Denial of Service in Inline HTML Parsing	`markdown-it`	npm	20 Oct 2026	14.3.3
2.3 low	CVE-2026-111749: AIOHTTP Cookie Vulnerability Allows Subdomains to Remove Host-Only Flag	`aiohttp`	PyPI	20 Oct 2026	3.14.4
3.7 low	CVE-2026-113665: ApostropheCMS Notification Module Lacks Authorization on PATCH/DELETE Endpoints	`apostrophe`	npm	20 Oct 2026	4.33.0
3.3 low	CVE-2026-113651: ApostropheCMS uploadfs Path Traversal Vulnerability	`uploadfs`	npm	20 Oct 2026	1.28.0
3.7 low	CVE-2026-113657: sanitize-html Package XSS Vulnerability via SMIL Animation Namespace-Prefix Bypass	`sanitize-html`	npm	20 Oct 2026	2.18.0
Low	CVE-2026-111063: AIOHTTP - Secure Attribute Not Enforced for Shared Cookie	`aiohttp`	PyPI	19 Oct 2026	3.14.4
2.3 low	CVE-2026-111062: russh Package Vulnerability in Public Key Authentication Algorithm Verification	`russh`	crates.io	19 Oct 2026	0.64.0
3.7 low	CVE-2026-62994: CoreDNS Vulnerability in k8s_external Headless AXFR Leading to Panic	`github.com/coredns/coredns`	Go	16 Oct 2026	1.14.5
3.1 low	CVE-2026-76894: ckan-mcp-server DataStore Table UI Lacks postMessage Origin Validation	`@aborruso/ckan-mcp-server`	npm	16 Oct 2026	0.4.112

Showing the first 200 matches. Add filters to narrow the results.

Subscribe to Vulert on Telegram

Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.

Join the channel →

Questions

Searching the database

How do I search for a CVE or a package?

Type a CVE id, package name, ecosystem or keyword into the search field. Results include the severity, the affected package, the ecosystem, the disclosure date and the fixed version.

Can I filter by severity or by whether a fix exists?

Yes. The filters on the left narrow the list to critical, high, medium or low vulnerabilities, to a single ecosystem, and to vulnerabilities that have a fix available or none yet.

What does "No fix published" mean?

No patched version has been released for that vulnerability yet. The vulnerability page still shows the affected range and any workaround that can reduce exposure in the meantime.