2026

Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Update Service due to in

An authenticated OS command injection vulnerability exists in the BigPond Cable (BPA) WAN configuration module in TL-WR9

An authenticated OS command injection vulnerability exists in the IPv6 PPPoE configuration handler in TL-WR940N v6 due t

Open redirection vulnerability in the authentication system allows an attacker to use manipulated values in the X-Forwar

Open redirection vulnerability due to insufficient validation of the X-Forwarded-Host HTTP header. An attacker could cre

Improper handling of HTTP headers that allows a remote attacker to manipulate the value of the Host header using special

A Path Traversal vulnerability affecting SOLIDWORKS Visualize from SOLIDWORKS Desktop Release 2024 through SOLIDWORKS De

In Package Manager, there is a possible device lock controller bypass due to a missing permission check. This could lead

In Nfc::eventCallback() of Nfc.h, there is a possible use after free due to a race condition. This could lead to local e

In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permission assignment due to

In NFC, there is a possible way to spoof an NFC event due to a missing permission check. This could lead to local escala

In SettingsLib, there is a possible missing permission check due to a logic error in the code. This could lead to local

In createSessionInternal of PackageInstallerService.java, there is a possible method to remove a DPC app from a managed

In multiple places, there is a possible persistent denial of service due to resource exhaustion. This could lead to loca

In setAllowedCarriers of PhoneInterfaceManager.java, there is a possible way to disable carrier restrictions due to a lo

In Contacts Provider, there is a possible way to access an incoming call's phone number and associated metadata due to a

In SettingsLib, there is a possible way to disable system components due to a logic error in the code. This could lead t

Unauthenticated Privilege Escalation in Support Ticket Management System <= 1.9 versions.

Unauthenticated Local File Inclusion in Truemag <= 4.3.14.2 versions.

Unauthenticated Local File Inclusion in Roneous <= 2.1.5 versions.

Unauthenticated Local File Inclusion in ITactics <= 1.0 versions.

Unauthenticated Local File Inclusion in Tipsy <= 1.1 versions.

Unauthenticated Local File Inclusion in Resurs <= 1.3 versions.

Unauthenticated Local File Inclusion in Orpheus <= 1.3 versions.

Unauthenticated Local File Inclusion in Spike <= 1.2 versions.

Unauthenticated Local File Inclusion in Eros <= 1.3 versions.

Unauthenticated Local File Inclusion in Choreo <= 1.6 versions.

Unauthenticated Local File Inclusion in WineShop <= 3.17 versions.

Unauthenticated Local File Inclusion in Grecko <= 5.17 versions.

Unauthenticated Local File Inclusion in Snowy <= 1.13 versions.

Unauthenticated Local File Inclusion in Gita <= 1.11 versions.

Unauthenticated Local File Inclusion in Printo <= 1.11 versions.

Unauthenticated Cross Site Scripting (XSS) in Grand Car Rental <= 3.7 versions.

Unauthenticated Local File Inclusion in Medeus <= 1.14 versions.

Unauthenticated Local File Inclusion in Top Dog <= 1.0.5 versions.

Unauthenticated Local File Inclusion in Quirky <= 1.23 versions.

Unauthenticated Local File Inclusion in Putter <= 1.17 versions.

Unauthenticated Local File Inclusion in Dom <= 1.24 versions.

Unauthenticated Local File Inclusion in Gat <= 1.16 versions.

Unauthenticated Local File Inclusion in Mission <= 1.22 versions.

Unauthenticated Local File Inclusion in Abelle <= 1.22 versions.

Unauthenticated Local File Inclusion in Kelly Young <= 1.1.0 versions.

Unauthenticated Arbitrary File Deletion in Car Zone <= 3.7 versions.

Subscriber Privilege Escalation in Genemy <= 1.6.6 versions.

Subscriber Broken Access Control in Genemy <= 1.6.6 versions.

Unauthenticated Local File Inclusion in Wanium <= 1.9.8 versions.

Subscriber SQL Injection in Events Schedule - WordPress Events Calendar Plugin <= 2.7.2 versions.

Unauthenticated Arbitrary File Download in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7 ve

Unauthenticated Arbitrary File Upload in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7 vers

Unauthenticated Local File Inclusion in Food Drop <= 1.3 versions.