Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
101,153 matching · page 122/2024Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2026-21137(opens NVD record) | Unscored | — | Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege. | Oct 12, 2026 |
| CVE-2026-21136(opens NVD record) | Unscored | — | Improper authorization in Smart Switch prior to version 3.7.73 allows physical attackers to invoke application restore process. | Oct 12, 2026 |
| CVE-2026-21135(opens NVD record) | Unscored | — | Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information. | Oct 12, 2026 |
| CVE-2026-21134(opens NVD record) | Unscored | — | Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sensitive information. | Oct 12, 2026 |
| CVE-2026-21133(opens NVD record) | Unscored | — | Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data. | Oct 12, 2026 |
| CVE-2026-21132(opens NVD record) | Unscored | — | Improper input validation in Samsung Internet prior to version 30.0.5.24 allows remote attackers to inject arbitrary script. User interaction is required for triggering this vulnerability. | Oct 12, 2026 |
| CVE-2026-21131(opens NVD record) | Unscored | — | Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung Flow privileges on the connected device. | Oct 12, 2026 |
| CVE-2026-21130(opens NVD record) | Unscored | — | Improper input validation in CreditCardRetrieveActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges. | Oct 12, 2026 |
| CVE-2026-21129(opens NVD record) | Unscored | — | Improper input validation in GuestCreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges. | Oct 12, 2026 |
| CVE-2026-21128(opens NVD record) | Unscored | — | Improper input validation in CreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch arbitrary activity with Samsung Checkout privileges. | Oct 12, 2026 |
| CVE-2026-21127(opens NVD record) | Unscored | — | Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive data. | Oct 12, 2026 |
| CVE-2026-21126(opens NVD record) | Unscored | — | Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory. | Oct 12, 2026 |
| CVE-2026-21125(opens NVD record) | Unscored | — | Improper input validation in parsing sheifd in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code. | Oct 12, 2026 |
| CVE-2026-21124(opens NVD record) | Unscored | — | Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code. | Oct 12, 2026 |
| CVE-2026-21123(opens NVD record) | Unscored | — | Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to access data of the tied profile in before first unlock. | Oct 12, 2026 |
| CVE-2026-21122(opens NVD record) | Unscored | — | Out-of-bounds write in libsamsungtts.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code. | Oct 12, 2026 |
| CVE-2026-21121(opens NVD record) | Unscored | — | Improper handling of insufficient permission in CmcCore prior to SMR Oct-2026 Release 1 allows local attackers to use the privileged APIs. | Oct 12, 2026 |
| CVE-2026-21120(opens NVD record) | Unscored | — | Use after free in WSM service prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code with system privilege. | Oct 12, 2026 |
| CVE-2026-21119(opens NVD record) | Unscored | — | Out-of-bounds read and write in lib_sag_ai_sound_sep_v2.00.so prior to SMR Oct-2026 Release 1 allows local attackers to read and write out-of-bounds memory. | Oct 12, 2026 |
| CVE-2026-21118(opens NVD record) | Unscored | — | Improper access control in DownloadProvider prior to SMR Oct-2026 Release 1 allows local attackers to access files in scoped storage. | Oct 12, 2026 |
| CVE-2026-21117(opens NVD record) | Unscored | — | Improper access control in CocktailBarService prior to SMR Oct-2026 Release 1 allows local attackers to access sensitive information. | Oct 12, 2026 |
| CVE-2026-21116(opens NVD record) | Unscored | — | Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory. | Oct 12, 2026 |
| CVE-2026-21115(opens NVD record) | Unscored | — | Out-of-bounds write in libcodec2-sec-flacdec.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory. | Oct 12, 2026 |
| CVE-2026-21114(opens NVD record) | Unscored | — | Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code. | Oct 12, 2026 |
| CVE-2026-108801(opens NVD record) | Medium | 6.3 | A security flaw has been discovered in prasathmani TinyFileManager up to 2.6. The impacted element is the function move_uploaded_file of the file tinyfilemanager.php. Performing a manipulation of the argument fullpath results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | Oct 12, 2026 |
| CVE-2026-108800(opens NVD record) | Medium | 4.3 | A vulnerability was identified in yangzongzhuan RuoYi 4.8.3. The affected element is an unknown function. Such manipulation leads to cross-site request forgery. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way. | Oct 12, 2026 |
| CVE-2026-108799(opens NVD record) | High | 7.3 | A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacted is the function PublicController::sendFindPwdMail of the file Admin/Home/Controller/PublicController.class.php of the component Password Recovery Mail Endpoint. This manipulation of the argument email causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. | Oct 12, 2026 |
| CVE-2026-108798(opens NVD record) | High | 7.3 | A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key . The attack may be launched remotely. Upgrading to version 9.5.6 Build 3623 is capable of addressing this issue. It is suggested to upgrade the affected component. | Oct 12, 2026 |
| CVE-2026-108797(opens NVD record) | Medium | 4.3 | A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This vulnerability affects unknown code of the file /personnel/api/employees/ of the component Employee REST API. The manipulation leads to authorization bypass. The attack may be initiated remotely. Upgrading to version 9.5.6 Build 3623 is able to resolve this issue. The affected component should be upgraded. | Oct 12, 2026 |
| CVE-2026-108796(opens NVD record) | Medium | 4.3 | A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/finger_data/ of the component Biometric Data Endpoint. Executing a manipulation of the argument emp_code can lead to authorization bypass. The attack can be launched remotely. Upgrading to version 9.5.6 Build 3623 is able to mitigate this issue. You should upgrade the affected component. | Oct 12, 2026 |
| CVE-2026-108795(opens NVD record) | Medium | 4.3 | A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated remotely. Upgrading to version 9.5.6 Build 3623 can resolve this issue. It is advisable to upgrade the affected component. | Oct 12, 2026 |
| CVE-2026-108985(opens NVD record) | High | 7.1 | ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array(). The caller-supplied maxsize value is not honored. | Oct 12, 2026 |
| CVE-2026-108982(opens NVD record) | Unscored | — | VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to decrypted data. It does not terminate the FUSE-T auxiliary service (go-nfsv4) and its associated VeraCrypt core-service helper processes when a volume is dismounted. After VeraCrypt reports the volume as dismounted, the auxiliary mount continues to serve the decrypted volume image (volume.dmg) over a loopback SMB session, and the leaked processes retain an open handle to the underlying raw device. A local user or process can therefore remount and access the decrypted volume without the passphrase, e.g., by reopening a previously accessed path (such as through a macOS Open Recent menu) or by attaching volume.dmg from the stale auxiliary mount. (The macFUSE build of VeraCrypt is not affected.) | Oct 12, 2026 |
| CVE-2026-108981(opens NVD record) | Low | 3.6 | ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symlink created at an arbitrary earlier time, but does not resolve an applicable TOCTOU race condition. (The ngx_cache_purge module follows symlinks while walking the cache directory tree during purge operations. The module relies on nginx's ngx_walk_tree(), which relies on stat() and therefore follows symlinks.) | Oct 12, 2026 |
| CVE-2026-108794(opens NVD record) | Medium | 6.3 | A security vulnerability has been detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this vulnerability is an unknown functionality of the file /base/api/v1.0/systemSettings/db_migrate_setting/ of the component Database Migration Functionality. Such manipulation leads to sql injection. It is possible to launch the attack remotely. Upgrading to version 9.5.6 Build 3623 addresses this issue. Upgrading the affected component is advised. | Oct 12, 2026 |
| CVE-2026-108791(opens NVD record) | Medium | 4.3 | A weakness has been identified in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. Affected is the function TemplateController.input of the file /system/cms/template/input of the component Template Management. This manipulation of the argument filePath causes path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | Oct 12, 2026 |
| CVE-2026-108790(opens NVD record) | Medium | 4.7 | A security flaw has been discovered in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. This impacts the function TemplateController.save of the file /system/cms/template/save of the component Backend Template Editor. The manipulation results in path traversal. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | Oct 12, 2026 |
| CVE-2026-108789(opens NVD record) | Medium | 5.5 | A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.1-rc.2. This affects the function agent of the component dsh-workflow-worker-thread. The manipulation leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. | Oct 12, 2026 |
| CVE-2026-107437(opens NVD record) | Medium | 6.2 | GV-E-Map Server V18.2.0A contains a plaintext database password embedded within an application component. The credential can be recovered through static analysis of the distributed binary and may also be exposed in process memory during runtime. | Oct 12, 2026 |
| CVE-2026-87765(opens NVD record) | Medium | 5.5 | In the kernel apsys DVFS driver, there is a possible out-of-bounds read or hardware register corruption due to improper input validation of the frequency index. This could lead to system instability or denial of service with local privileges. | Oct 12, 2026 |
| CVE-2026-66086(opens NVD record) | Critical | 9.8 | In the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation of scheduling information in SIB1 messages. This could lead to remote code execution or denial of service with no additional execution privileges needed. | Oct 12, 2026 |
| CVE-2026-66085(opens NVD record) | Medium | 5.5 | In modem, there is a possible information disclosure due to missing filtering of sensitive data in crash dumps. This could lead to local information disclosure with no additional execution privileges needed. | Oct 12, 2026 |
| CVE-2026-108980(opens NVD record) | High | 8.8 | Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path from an unsanitized name in server/routerTrpc/plugin.ts, and the plugin.installPlugin tRPC procedure is open to any authenticated user. Thus, a name containing ../ sequences writes the downloaded plugin files outside the plugins directory. Because the official Docker image runs as root, an authenticated attacker overwrites a root-owned startup file and achieves remote code execution as root. Self-registration for an account may be possible. | Oct 12, 2026 |
| CVE-2026-108788(opens NVD record) | Medium | 5.3 | A vulnerability was determined in deepseek-ai deepseek-harness up to 0.1.1-rc.2. The impacted element is the function spawn of the component Sandbox. Executing a manipulation of the argument Profile can lead to sandbox issue. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. | Oct 12, 2026 |
| CVE-2026-108787(opens NVD record) | Medium | 6.3 | A vulnerability was found in houtini-ai voice-analyser-mcp up to 2.1.1. The affected element is the function fetch of the file src/utils/crawler.ts of the component collect_corpus. Performing a manipulation of the argument sitemap_url results in server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | Oct 12, 2026 |
| CVE-2026-108786(opens NVD record) | Medium | 6.3 | A vulnerability has been found in houtini-ai seo-crawler-mcp up to 2.1.5. Impacted is the function run_seo_audit of the file src/core/CrawlOrchestrator.ts of the component Crawler. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | Oct 12, 2026 |
| CVE-2026-108785(opens NVD record) | Medium | 6.3 | A flaw has been found in macrozheng mall up to 1.0.3. This issue affects the function JwtTokenUtil.refreshHeadToken of the file /admin/refreshToken of the component JwtAuthenticationTokenFilter. This manipulation of the argument token causes session expiration. The attack may be initiated remotely. The exploit has been published and may be used. Patch name: 9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a. To fix this issue, it is recommended to deploy a patch. | Oct 12, 2026 |
| CVE-2026-108784(opens NVD record) | Medium | 6.5 | A vulnerability was detected in macrozheng mall up to 1.0.3. This vulnerability affects the function AlipayServiceImpl.pay of the file com/macro/mall/portal/service/impl/AlipayServiceImpl.java of the component Payment Endpoint. The manipulation of the argument total_amount results in business logic errors. The attack can be launched remotely. The exploit is now public and may be used. The patch is identified as dcaa93b3150352e5044708d7211b5bed0af4509f. A patch should be applied to remediate this issue. | Oct 12, 2026 |
| CVE-2026-108783(opens NVD record) | High | 7.3 | A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.6.2/1.7.2. This affects an unknown part of the file app.py of the component Backup Download. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | Oct 12, 2026 |
| CVE-2026-108782(opens NVD record) | Medium | 6.3 | A weakness has been identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this issue is the function CommonServiceImpl.getAutoList of the file src/main/java/org/jeecgframework/core/common/service/impl/CommonServiceImpl.java of the component Autocomplete Handler. Executing a manipulation of the argument trem/searchField/entityName can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | Oct 12, 2026 |