2026

Improper input validation in Samsung Members prior to version 5.6.00.11 allows remote attackers to connect arbitrary URL

Improper handling of insufficient permission in Galaxy Wearable installed on non-Samsung Device prior to version 2.2.68

Improper export of android application components in Samsung Dialer prior to SMR Feb-2026 Release 1 allows local attacke

Path traversal in ShortcutService prior to SMR Feb-2026 Release 1 allows privileged local attacker to create file with s

Improper input validation in FacAtFunction prior to SMR Feb-2026 Release 1 allows privileged physical attacker to execut

Improper input validation in PACM prior to SMR Feb-2026 Release 1 allows physical attacker to execute arbitrary commands

Improper privilege management in Settings prior to SMR Feb-2026 Release 1 allows local attackers to launch arbitrary act

Improper authorization in KnoxGuardManager prior to SMR Feb-2026 Release 1 allows local attackers to bypass the persiste

Improper access control in Emergency Sharing prior to SMR Feb-2026 Release 1 allows local attackers to interrupt its fun

The WP FOFT Loader plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in

Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Hancom Inc. Hancom Office 2018, Hancom In

Unrestricted Upload of File with Dangerous Type vulnerability in Hillstone Networks Operation and Maintenance Security G

An arbitrary file overwrite vulnerability in the file import process of Comic Book Reader v1.0.95 allows attackers to ov

A path traversal in Moo Chan Song v4.5.7 allows attackers to cause a Denial of Service (DoS) via writing files to the in

A vulnerability was identified in lcg0124 BootDo up to e93dd428ef6f5c881aa74d49a2099ab0cf1e0fcb. This affects an unknown

A vulnerability was found in bolo-blog bolo-solo up to 2.6.4. Affected is an unknown function of the file src/main/java/

The Synectix LAN 232 TRIO 3-Port serial to ethernet adapter exposes its web management interface without requiring authe

A security issue was discovered in ingress-nginx where the validating admission controller feature is subject to a denia

A security issue was discovered in ingress-nginx where the protection afforded by the `auth-url` Ingress annotation may

A security issue was discovered in ingress-nginx where the `rules.http.paths.path` Ingress field can be used to inject c

A vulnerability has been found in bolo-blog bolo-solo up to 2.6.4. This impacts the function importFromCnblogs of the fi

The Menu Icons by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_wp_attachment_im

MOMA Seismic Station Version v2.4.2520 and prior exposes its web management interface without requiring authentication,

A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/auth-method` Ingress annotation

IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and

IBM Engineering Lifecycle Management - Global Configuration Management 7.0.3 through 7.0.3 Interim Fix 017, and 7.1.0 th

IBM Concert 1.0.0 through 2.1.0 stores potentially sensitive information in log files that could be read by a local user

Easy Transfer Wifi Transfer v1.7 for iOS contains a persistent cross-site scripting vulnerability that allows remote att

School ERP Pro 1.0 contains a remote code execution vulnerability that allows authenticated admin users to upload arbitr

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorizati

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorizati

Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.3, a denial-of-service vulnerability

Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation bypass vulnerability

Qwik is a performance focused javascript framework. Prior to version 1.12.0, a typo in the regular expression within isC

Qwik is a performance focused javascript framework. Prior to version 1.19.0, Qwik City’s server-side request handler inc

Qwik is a performance focused javascript framework. Prior to version 1.19.0, a prototype pollution vulnerability exists

Qwik is a performance focused javascript framework. Prior to version 1.19.0, an Open Redirect vulnerability in Qwik City

Qwik is a performance focused javascript framework. Prior to version 1.19.0, a Cross-Site Scripting vulnerability in Qwi

A flaw has been found in bolo-blog bolo-solo up to 2.6.4. This affects the function importFromMarkdown of the file src/m

Avation Light Engine Pro exposes its configuration and control interface without any authentication or access control.

Edimax EW-7438RPn 1.13 contains an information disclosure vulnerability that exposes WiFi network configuration details

Edimax EW-7438RPn 1.13 contains a cross-site request forgery vulnerability in the MAC filtering configuration interface.

EspoCRM 5.7.0 prior to 5.9.0 contains an authentication token reuse vulnerability that allows authenticated attackers to

Netis E1+ 1.2.32533 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve W

Netis E1+ version 1.2.32533 contains a hardcoded root account vulnerability that allows unauthenticated attackers to acc

Maian Support Helpdesk 4.3 contains a cross-site request forgery vulnerability that allows attackers to create administr

School ERP Pro 1.0 contains a file upload vulnerability that allows students to upload arbitrary PHP files to the messag

School ERP Pro 1.0 contains a SQL injection vulnerability in the 'es_messagesid' parameter that allows attackers to mani

School ERP Pro 1.0 contains a file disclosure vulnerability that allows unauthenticated attackers to read arbitrary file

Easy Transfer 1.7 iOS mobile application contains a directory traversal vulnerability that allows remote attackers to ac