2026

An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml. There is an EC public key out-of-bounds

An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a

An issue was discovered in the utcp package before 0.0.6 for OCaml. Out-of-order segment reassembly allows remote denial

An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions {P256,P384,P521}.Ds

An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM.authenticate_decrypt_into and C

Improper export of android application components in Visual Voicemail prior to version 20.1.00.05 allows local attackers

Improper input validation in Samsung Tips prior to Android 17 allows local attackers to launch arbitrary activity with S

Out-of-bounds write in libsthmbc.so prior to One UI 8.5 allows local attackers to write out-of-bounds memory.

Out-of-bounds write in libsavscmn.so prior to One UI 8.5 allows local attackers to execute arbitrary code.

Improper access control in Watch Plugin prior to Android Watch 17 allows local attackers to access sensitive information

Improper export of android application components in Bixby Touch prior to version 4.3.01.17 allows local attackers to ac

Out-of-bounds write in Samsung Notes prior to version 4.4.45.5 allows local attackers to write out-of-bounds memory.

Improper verification of intent by broadcast receiver in Samsung Cloud Assistant prior to version 9.0.5 allows local att

Improper access control in Collection prior to version 1.0.1.14 in Android 15 and 2.0.02.7 in Android 16 allows local at

Heap-based buffer overflow in KnoxVault trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to ex

Path traversal in GalaxyDiagnostics prior to SMR Sep-2026 Release 1 allows physical attackers to access files with syste

Use after free in DualDAR prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code wi

Improper input validation in DualDAR driver prior to SMR Sep-2026 Release 1 allows local privileged attackers to potenti

Improper access control in SystemUI prior to SMR Sep-2026 Release 1 allows local attackers to launch arbitrary activity.

Improper access control in SettingsProvider prior to SMR Sep-2026 Release 1 allows local attackers to access sensitive i

Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allows local attackers to establish a connect

Improper authentication in ActivityTaskManagerService prior to SMR Sep-2026 Release 1 allows local privileged attackers

Heap-based buffer overflow in JPEG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attac

Heap-based buffer overflow in DNG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attack

Improper input validation in wpa_supplicant prior to SMR Sep-2026 Release 1 allows adjacent attackers to write out-of-bo

Stack-based buffer overflow in PROCA trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to write

Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to create image files with system s

Out-of-bounds write in libcodec2secevrcdec.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bou

Out-of-bounds write in libsaviextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds

Improper input validation in removing style tag in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attac

Improper input validation in loading a subtitle frame in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local

Out-of-bounds write in libmdnie.so prior to SMR Sep-2026 Release 1 allows local attackers to execute arbitrary code with

Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configurat

Out-of-bounds write in Keymaster trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to write out

The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to a

The Repeater Fields for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeated Mul

Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affec

Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affec

DoS vulnerability in the preview service module. Impact: Successful exploitation of this vulnerability may affect availa

The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'before

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallba

The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'episode_contributor

UEFI BIOS embedded Shell could be used to bypass Secure Boot via shell commands or startup scripts.

In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishan

DoS vulnerability in the input device module. Impact: Successful exploitation of this vulnerability may affect availabil

OOB write vulnerability in the rendering and composition module. Impact: Successful exploitation of this vulnerability m

Permission control vulnerability in the app lock module. Impact: Successful exploitation of this vulnerability may affec

Permission control vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect