2026

Privilege escalation via dll hijacking in Inno Setup 6.2.1 and ealier versions.

A security vulnerability has been detected in LLM-Claw 0.1.0/0.1.1/0.1.1a/0.1.1a-p1. The affected element is the functio

The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and inc

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnera

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to privilege esca

Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verificatio

Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain v

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metada

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metada

theshit is a command-line utility that automatically detects and fixes common mistakes in shell commands. Prior to versi

AFFiNE is an open-source, all-in-one workspace and an operating system. Prior to version 0.25.4, there is a one-click re

In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information due

In multiple functions of mem_protect.c, there is a possible way to execute arbitrary code due to a logic error in the co

In multiple functions of ffa.c, there is a possible memory corruption due to a logic error in the code. This could lead

In createRequest of MediaProvider.java, there is a possible way for an app to gain read/write access to non-existing fil

In setPackageOrComponentEnabled of ManagedServices.java, there is a possible notification policy desync due to improper

In multiple functions of mem_protect.c, there is a possible out-of-bounds write due to a logic error in the code. This c

In multiple functions of mem_protect.c, there is a possible out of bounds write due to an integer overflow. This could l

In __host_check_page_state_range of mem_protect.c, there is a possible out of bounds write due to an incorrect bounds ch

In __pkvm_init_vm of pkvm.c, there is a possible memory corruption due to a logic error in the code. This could lead to

In __pkvm_host_share_guest of mem_protect.c, there is a possible out of bounds write due to an integer overflow. This co

In removePermission of PermissionManagerServiceImpl.java, there is a possible way to override any system permission due

In hasImage of Notification.java, there is a possible way to reveal information across users due to a permissions bypass

In createSessionInternal of PackageInstallerService.java, there is a possible way for an app to update its ownership due

In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permission bypass due to a c

In parsePermissionGroup of ParsedPermissionUtils.java, there is a possible way to bypass a consent dialog to obtain perm

In onChange of BiometricService.java, there is a possible way to enable fingerprint unlock due to a logic error in the c

In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confuse

In enableSystemPackageLPw of Settings.java, there is a possible way to prevent location access from working due to a log

In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bounds check. This cou

In multiple locations, there is a possible privilege escalation due to a confused deputy. This could lead to local esca

In writeToParcel of WindowInfo.cpp, there is a possible way to trick a user into accepting a permission due to a tapjack

In onStart of CompanionDeviceManagerService.java, there is a possible confused deputy due to a logic error in the code.

In loadDataAndPostValue of multiple files, there is a possible way to obscure permission usage due to a logic error in t

In multiple locations, there is a possible information disclosure due to SQL injection. This could lead to local escalat

In executeRequest of ActivityStarter.java, there is a possible launch anywhere due to a confused deputy. This could lead

In loadDescription of DeviceAdminInfo.java, there is a possible persistent package due to improper input validation. Thi

In multiple functions of Nfc.h, there is a possible use after free due to a race condition. This could lead to local esc

In openFile of BugreportContentProvider.java, there is a possible way to read and write unauthorized files due to a path

In multiple functions of TaskFragmentOrganizerController.java, there is a possible activity token leak due to a logic er

In relayoutWindow of WindowManagerService.java, there is a possible tapjack attack due to a missing permission check. Th

In drawLayersInternal of SkiaRenderEngine.cpp, there is a possible way to access the GPU cache due to side channel infor

In multiple functions of ContentProvider.java, there is a possible way for an app with read-only access to truncate file

In VBMeta, there is a possible way to modify and resign VBMeta using a test key, assuming the original image was previou

In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the co

In exitKeyguardAndFinishSurfaceBehindRemoteAnimation of KeyguardViewMediator.java, there is a possible lockscreen bypass

In multiple locations, there is a possible way to delete media without the MANAGE_EXTERNAL_STORAGE permission due to an

In multiple functions of MediaProvider.java, there is a possible external storage write permission bypass due to a confu

In multiple functions of MediaProvider.java, there is a possible way to bypass the WRITE_EXTERNAL_STORAGE permission due

In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a race condition. This