2026

Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability where an attacker sending a large v

HelloTalk through 3.4.1 stores full-precision GPS coordinates even when the user had intended to share only a country or

Lyrion Music Server 9.2.0 contains a reflected cross-site scripting vulnerability in advanced search parameters that fai

Lyrion Music Server 9.2.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrar

Lyrion Music Server 9.2.0 contains an arbitrary directory listing vulnerability in its readdirectory query, exposed thro

Lyrion Music Server 9.2.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious

Lyrion Music Server 9.2.0 contains an unauthenticated stored cross-site scripting vulnerability in the log viewer that a

Lyrion Music Server 9.2.0 contains an unauthenticated reflected cross-site scripting vulnerability in the server.log end

The Comment API (GET /api/Comment and POST /api/Comment) in the affected application fails to perform authorization chec

A weakness has been identified in thedotmack claude-mem up to 11.0.1. The affected element is the function computeObserv

A vulnerability has been found in onnx onnx-mlir up to 0.5.0.0. Affected by this issue is the function generate_hash_key

An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A cli

A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow(). A client can trigger a use-af

An out-of-bounds read flaw was found in the X.Org X server and Xwayland in __glXDisp_ChangeDrawableAttributes(). A wrong

A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that sets up multipl

A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that sets up multiple Sync

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks() declares a fixed-siz

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers

A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multip

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the

Ericsson Packet Core Gateway (PCG) versions prior to 1.30 contain an Improper Handling of Missing Values (CWE-230) vulne

Ericsson Packet Core Gateway (PCG) versions prior to 1.30 contain an Improper Handling of Missing Values (CWE-230) vulne

Ericsson Packet Core Gateway (PCG) versions prior to 1.30 contain an Improper Handling of Syntactically Invalid Structur

A Server-Side Request Forgery (SSRF) vulnerability in the custom process creation feature of linqi allows an authenticat

An Improper Authentication vulnerability in the /api/Cdn/GetFile endpoint of linqi allows unauthenticated, remote attack

In Teltonika Networks RUTOS devices, running versions 7.22 through 7.23.2 and TSWOS devices running versions 1.09 throug

Improper input validation in Samsung Android USB Driver for Windows prior to version 1.9.5.0 allows local attacker to ac

Improper input validation in Samsung Members prior to version 5.8.01.5 allows local attackers to access arbitrary URL an

Improper authorization in Samsung Internet prior to version 30.0.0.39 allows local attackers to access sensitive informa

Improper input validation in Samsung Plus TV prior to version 1.0.28.6 allows remote attackers to access sensitive infor

Improper export of android application components in Samsung Auto prior to version 3.1.2.61 in Android 15 and 3.2.0.38 i

Improper export of android application components in ExpressHomeWidgetReceiver of Samsung Assistant prior to version 9.3

Improper export of android application components in SmartHomeWidgetReceiver of Samsung Assistant prior to version 9.3.1

Improper authorization in AppBlock prior to SMR Jun-2026 Release 1 allows local attacker to launch arbitrary activity. U

Improper access control in MediaTek Audio HAL prior to SMR Jun-2026 Release 1 allows local attackers to trigger privileg

Improper export of android application components in Galaxy Editing Service prior to SMR Jun-2026 Release 1 allows local

Improper access control in AuditLogService prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive in

Improper export of android application components in ImsSettings prior to SMR Jun-2026 Release 1 allows local attackers

Improper export of android application components in SpriteWallpaper prior to SMR Jun-2026 Release 1 allows local attack

Incorrect privilege assignment in Telephony prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive i

Improper handling of insufficient privileges in SecTelephonyProvider prior to SMR Jun-2026 Release 1 allows local attack

The linqi application contains hardcoded cryptographic keys. Additionally, the application uses a weak algorithm with a

Improper Authentication, Missing authentication for critical function, Weak Authentication vulnerability in DTS Electron

Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a rol

A flaw was found in org.keycloak.services. An administrator with delegated access to read group memberships and users ca

A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated us

HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API.  An att

HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection.  An attacker ca

HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center.