2026

An out-of-bounds read flaw was found in the X.Org X server and Xwayland in __glXDisp_ChangeDrawableAttributes(). A wrong

A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that sets up multipl

A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that sets up multiple Sync

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks() declares a fixed-siz

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers

A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multip

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the

Ericsson Packet Core Gateway (PCG) versions prior to 1.30 contain an Improper Handling of Missing Values (CWE-230) vulne

Ericsson Packet Core Gateway (PCG) versions prior to 1.30 contain an Improper Handling of Missing Values (CWE-230) vulne

Ericsson Packet Core Gateway (PCG) versions prior to 1.30 contain an Improper Handling of Syntactically Invalid Structur

A Server-Side Request Forgery (SSRF) vulnerability in the custom process creation feature of linqi allows an authenticat

An Improper Authentication vulnerability in the /api/Cdn/GetFile endpoint of linqi allows unauthenticated, remote attack

In Teltonika Networks RUTOS devices, running versions 7.22 through 7.23.2 and TSWOS devices running versions 1.09 throug

Improper input validation in Samsung Android USB Driver for Windows prior to version 1.9.5.0 allows local attacker to ac

Improper input validation in Samsung Members prior to version 5.8.01.5 allows local attackers to access arbitrary URL an

Improper authorization in Samsung Internet prior to version 30.0.0.39 allows local attackers to access sensitive informa

Improper input validation in Samsung Plus TV prior to version 1.0.28.6 allows remote attackers to access sensitive infor

Improper export of android application components in Samsung Auto prior to version 3.1.2.61 in Android 15 and 3.2.0.38 i

Improper export of android application components in ExpressHomeWidgetReceiver of Samsung Assistant prior to version 9.3

Improper export of android application components in SmartHomeWidgetReceiver of Samsung Assistant prior to version 9.3.1

Improper authorization in AppBlock prior to SMR Jun-2026 Release 1 allows local attacker to launch arbitrary activity. U

Improper access control in MediaTek Audio HAL prior to SMR Jun-2026 Release 1 allows local attackers to trigger privileg

Improper export of android application components in Galaxy Editing Service prior to SMR Jun-2026 Release 1 allows local

Improper access control in AuditLogService prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive in

Improper export of android application components in ImsSettings prior to SMR Jun-2026 Release 1 allows local attackers

Improper export of android application components in SpriteWallpaper prior to SMR Jun-2026 Release 1 allows local attack

Incorrect privilege assignment in Telephony prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive i

Improper handling of insufficient privileges in SecTelephonyProvider prior to SMR Jun-2026 Release 1 allows local attack

The linqi application contains hardcoded cryptographic keys. Additionally, the application uses a weak algorithm with a

Improper Authentication, Missing authentication for critical function, Weak Authentication vulnerability in DTS Electron

Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a rol

A flaw was found in org.keycloak.services. An administrator with delegated access to read group memberships and users ca

A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated us

HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API.  An att

HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection.  An attacker ca

HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center.

All versions of the package decompress are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) when ext

Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions, because slotat d

A heap-based buffer overflow vulnerability in the morse.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software

A heap-based buffer overflow vulnerability in the dot11ah.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 softwa

In Znuny LTS before 6.5.21 and Znuny before 7.3.3, there is reflected XSS in AdminCommunicationLog (aka the communicat

In Znuny LTS before 6.5.21 and Znuny before 7.3.3, XSS can occur via stored user preferences.

In Mimecast Incydr before 2.6.0, arbitrary file access can occur.

Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, whe

OpenAI Atlas before 1.2025.288.15 exposed privileged browser APIs to web content on *.openai.com origins. A cross-site s

A vulnerability was found in bytedance InfiniStore up to 0.2.33. The impacted element is the function purge_kv_map in th

In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpo

Insufficient policy enforcement in History in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform

Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a u