CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-107193 MEDIUM · 6.5 A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its identifier and does not apply the…
- CVE-2025-15703 LOW · 3.5 The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area…
- CVE-2026-87690 HIGH · 8.8 The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22). The module interpolates file names taken from a Meterpreter directory…
- CVE-2026-21139 NONE Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the connected mobile device.
- CVE-2026-21138 NONE Insufficient verification of data authenticity in Smart Switch prior to version 3.7.73 allows physical attackers to install arbitrary applications.
- CVE-2026-21137 NONE Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege.
- CVE-2026-21136 NONE Improper authorization in Smart Switch prior to version 3.7.73 allows physical attackers to invoke application restore process.
- CVE-2026-21135 NONE Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information.
- CVE-2026-21134 NONE Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sensitive information.
- CVE-2026-21133 NONE Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data.
- CVE-2026-21132 NONE Improper input validation in Samsung Internet prior to version 30.0.5.24 allows remote attackers to inject arbitrary script. User interaction is required for triggering this vulnerability.
- CVE-2026-21131 NONE Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung Flow privileges on the connected…
- CVE-2026-21130 NONE Improper input validation in CreditCardRetrieveActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges.
- CVE-2026-21129 NONE Improper input validation in GuestCreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges.
- CVE-2026-21128 NONE Improper input validation in CreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch arbitrary activity with Samsung Checkout privileges.
- CVE-2026-21127 NONE Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive data.
- CVE-2026-21126 NONE Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.
- CVE-2026-21125 NONE Improper input validation in parsing sheifd in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code.
- CVE-2026-21124 NONE Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code.
- CVE-2026-21123 NONE Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to access data of the tied profile…
- CVE-2026-21122 NONE Out-of-bounds write in libsamsungtts.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code.
- CVE-2026-21121 NONE Improper handling of insufficient permission in CmcCore prior to SMR Oct-2026 Release 1 allows local attackers to use the privileged APIs.
- CVE-2026-21120 NONE Use after free in WSM service prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code with system privilege.
- CVE-2026-21119 NONE Buiten de grenzen lezen en schrijven in lib_sag_ai_sound_sep_v2.00.so voorafgaand aan SMR oktober-2026 Release 1 stelt lokale aanvallers in staat om buiten de grenzen geheugen te…
- CVE-2026-21118 NONE Improper access control in DownloadProvider prior to SMR Oct-2026 Release 1 allows local attackers to access files in scoped storage.
- CVE-2026-21117 NONE Improper access control in CocktailBarService prior to SMR Oct-2026 Release 1 allows local attackers to access sensitive information.
- CVE-2026-21116 NONE Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.
- CVE-2026-21115 NONE Out-of-bounds write in libcodec2-sec-flacdec.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.
- CVE-2026-21114 NONE Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code.
- CVE-2026-108801 MEDIUM · 6.3 A security flaw has been discovered in prasathmani TinyFileManager up to 2.6. The impacted element is the function move_uploaded_file of the file tinyfilemanager.php. Performing a…
- CVE-2026-108800 MEDIUM · 4.3 A vulnerability was identified in yangzongzhuan RuoYi 4.8.3. The affected element is an unknown function. Such manipulation leads to cross-site request forgery. The attack can…
- CVE-2026-108799 HIGH · 7.3 A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacted is the function PublicController::sendFindPwdMail of the file Admin/Home/Controller/PublicController.class.php of the component Password Recovery Mail…
- CVE-2026-108798 HIGH · 7.3 A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key…
- CVE-2026-108797 MEDIUM · 4.3 A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This vulnerability affects unknown code of the file /personnel/api/employees/ of the component Employee REST…
- CVE-2026-108796 MEDIUM · 4.3 A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/finger_data/ of the component Biometric Data…
- CVE-2026-108795 MEDIUM · 4.3 A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component…
- CVE-2026-108985 HIGH · 7.1 ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array(). The caller-supplied maxsize value is…
- CVE-2026-108982 NONE VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to decrypted data. It does not terminate the FUSE-T auxiliary service (go-nfsv4) and its associated…
- CVE-2026-108981 LOW · 3.6 ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the…
- CVE-2026-108794 MEDIUM · 6.3 A security vulnerability has been detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this vulnerability is an unknown functionality of the file /base/api/v1.0/systemSettings/db_migrate_setting/ of…
- CVE-2026-108791 MEDIUM · 4.3 A weakness has been identified in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. Affected is the function TemplateController.input of the file /system/cms/template/input of the component Template Management.…
- CVE-2026-108790 MEDIUM · 4.7 A security flaw has been discovered in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. This impacts the function TemplateController.save of the file /system/cms/template/save of the component Backend…
- CVE-2026-108789 MEDIUM · 5.5 A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.1-rc.2. This affects the function agent of the component dsh-workflow-worker-thread. The manipulation leads to enforcement of…
- CVE-2026-107437 MEDIUM · 6.2 GV-E-Map Server V18.2.0A contains a plaintext database password embedded within an application component. The credential can be recovered through static analysis of the distributed binary…
- CVE-2026-87765 MEDIUM · 5.5 In the kernel apsys DVFS driver, there is a possible out-of-bounds read or hardware register corruption due to improper input validation of the frequency index.…
- CVE-2026-66086 CRITICAL · 9.8 In the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation of scheduling information in SIB1 messages. This could lead…
- CVE-2026-66085 MEDIUM · 5.5 In modem, there is a possible information disclosure due to missing filtering of sensitive data in crash dumps. This could lead to local information disclosure…
- CVE-2026-108980 HIGH · 8.8 Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path from an unsanitized name in server/routerTrpc/plugin.ts,…
- CVE-2026-108788 MEDIUM · 5.3 A vulnerability was determined in deepseek-ai deepseek-harness up to 0.1.1-rc.2. The impacted element is the function spawn of the component Sandbox. Executing a manipulation of…
- CVE-2026-108787 MEDIUM · 6.3 A vulnerability was found in houtini-ai voice-analyser-mcp up to 2.1.1. The affected element is the function fetch of the file src/utils/crawler.ts of the component collect_corpus.…