Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
38,006 matching · page 228/761Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2026-21084(opens NVD record) | Unscored | — | Improper access control in SmartThings prior to version 1.8.47.24 allows local attackers to access sensitive information. | Aug 10, 2026 |
| CVE-2026-21083(opens NVD record) | Medium | 6.5 | Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data. | Aug 10, 2026 |
| CVE-2026-21082(opens NVD record) | Medium | 5.5 | Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information. | Aug 10, 2026 |
| CVE-2026-21081(opens NVD record) | Unscored | — | Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitive information. User interaction is required for triggering this vulnerability. | Aug 10, 2026 |
| CVE-2026-21080(opens NVD record) | Medium | 6.5 | Cleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data. | Aug 10, 2026 |
| CVE-2026-21079(opens NVD record) | Medium | 6.5 | Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data. | Aug 10, 2026 |
| CVE-2026-21078(opens NVD record) | Medium | 6.5 | Insufficient verification of data authenticity in Smart Switch trouble scanning mode prior to version 3.7.72.6 allows adjacent attackers to spoof device identity. | Aug 10, 2026 |
| CVE-2026-21077(opens NVD record) | Medium | 5.5 | Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information. | Aug 10, 2026 |
| CVE-2026-21076(opens NVD record) | Medium | 5.5 | Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information. | Aug 10, 2026 |
| CVE-2026-21075(opens NVD record) | Unscored | — | Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information. | Aug 10, 2026 |
| CVE-2026-21074(opens NVD record) | Unscored | — | Incorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute arbitrary commands with Bixby privilege. | Aug 10, 2026 |
| CVE-2026-21073(opens NVD record) | Medium | 6.1 | Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrary activity. | Aug 10, 2026 |
| CVE-2026-21072(opens NVD record) | High | 7.8 | Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. | Aug 10, 2026 |
| CVE-2026-21071(opens NVD record) | High | 7.8 | Improper input validation in MPEG4 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. | Aug 10, 2026 |
| CVE-2026-21070(opens NVD record) | Medium | 4.6 | Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access sensitive information. | Aug 10, 2026 |
| CVE-2026-21069(opens NVD record) | High | 7.8 | Incorrect conversion between numeric types in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. | Aug 10, 2026 |
| CVE-2026-21068(opens NVD record) | High | 7.8 | Stack-based buffer overflow in libril_sem.so prior to SMR Aug-2026 Release 1 allows privileged local attackers to execute arbitrary code. | Aug 10, 2026 |
| CVE-2026-21067(opens NVD record) | High | 7.8 | Improper input validation in libsmsd.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. | Aug 10, 2026 |
| CVE-2026-21066(opens NVD record) | High | 7.8 | Improper input validation in libcodec2_sec_flacdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. | Aug 10, 2026 |
| CVE-2026-21065(opens NVD record) | High | 7.8 | Out-of-bounds write in libcodec2secqcelpdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. | Aug 10, 2026 |
| CVE-2026-21064(opens NVD record) | Medium | 5.5 | Improper access control in Weaver prior to SMR Aug-2026 Release 1 allows local attackers to cause device inoperability. | Aug 10, 2026 |
| CVE-2026-21063(opens NVD record) | Medium | 6.1 | Improper export of android application components in AppLock prior to SMR Aug-2026 Release 1 allows physical attackers to bypass app lock function. | Aug 10, 2026 |
| CVE-2026-64940(opens NVD record) | High | 8.6 | Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression, which may allow an attacker who can access the affected product to log in to the management console. As a result, the attacker may perform any operations available from the management console. | Aug 10, 2026 |
| CVE-2026-57279(opens NVD record) | Medium | 6.8 | Cybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of a user logged in to the product. | Aug 10, 2026 |
| CVE-2026-21062(opens NVD record) | Low | 3.3 | Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local attackers to access clipboard data. | Aug 10, 2026 |
| CVE-2026-21061(opens NVD record) | Medium | 6.5 | Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access SIM related functions. User interaction is required for triggering this vulnerability. | Aug 10, 2026 |
| CVE-2026-21060(opens NVD record) | Medium | 4.6 | Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows physical attackers to access data across multiple user profiles. | Aug 10, 2026 |
| CVE-2026-21059(opens NVD record) | High | 7.1 | Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege. | Aug 10, 2026 |
| CVE-2026-21058(opens NVD record) | High | 7.1 | Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege. | Aug 10, 2026 |
| CVE-2026-19089(opens NVD record) | Critical | 9.8 | The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remote code execution on servers that do not honour the directory's access rules. | Aug 10, 2026 |
| CVE-2026-19077(opens NVD record) | Medium | 6.5 | The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site, including those belonging to other users. | Aug 10, 2026 |
| CVE-2026-19075(opens NVD record) | Medium | 5.0 | All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by `?vdl=<post_id>` on any `aiovg_videos` post (`public/video.php`, `AIOVG_Public_Video::download_video()`), which reads the post's `mp4` meta value and streams that URL's response back to the requester. | Aug 10, 2026 |
| CVE-2026-19074(opens NVD record) | Medium | 5.3 | The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 (<= 3.4.2) is vulnerable to unauthenticated sensitive information exposure via the AJAX action `acadp_public_custom_fields_listings`. | Aug 10, 2026 |
| CVE-2026-19053(opens NVD record) | Critical | 9.1 | The ProSolution WP Client WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement reachable by unauthenticated visitors, leading to a blind SQL injection. | Aug 10, 2026 |
| CVE-2026-19049(opens NVD record) | High | 8.6 | The ProSolution WP Client WordPress plugin before 2.0.9 does not sanitise a cookie value before using it in SQL queries, and processes that cookie on every request without any authentication or capability check, allowing unauthenticated users to read arbitrary data from the database and to delete the records the ProSolution WP Client WordPress plugin before 2.0.9 stores. | Aug 10, 2026 |
| CVE-2026-18960(opens NVD record) | Medium | 5.4 | The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API. | Aug 10, 2026 |
| CVE-2026-18946(opens NVD record) | High | 7.5 | The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing unauthenticated attackers to enumerate and download files submitted by other users. | Aug 10, 2026 |
| CVE-2026-18934(opens NVD record) | Medium | 5.5 | The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete the posts created by another user's import job, reset its deduplication and scheduling state, disable it, or clear its error log. One of the affected actions performs no object-type check either, so arbitrary posts and pages can also be unpublished regardless of who owns them. | Aug 10, 2026 |
| CVE-2026-18786(opens NVD record) | High | 8.8 | The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin before 2.3.2-specific string, making it possible for unauthenticated attackers to bypass the REST nonce check and perform any REST action available to a logged-in administrator, such as creating a new administrator account, via a crafted link an administrator is tricked into opening. | Aug 10, 2026 |
| CVE-2026-18666(opens NVD record) | Medium | 4.3 | The Library Management System WordPress plugin before 3.6.7 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing users with a role as low as Subscriber to perform SQL injection and extract arbitrary data from the database, including user password hashes. | Aug 10, 2026 |
| CVE-2026-18470(opens NVD record) | High | 7.5 | The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response, allowing unauthenticated users to obtain registered users' email addresses, including administrators'. | Aug 10, 2026 |
| CVE-2026-18469(opens NVD record) | High | 8.1 | The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against a server-derived value, keying both the verification code and the per-source attempt counter on client-controlled data, allowing unauthenticated attackers to reset the limit at will and brute-force the code to take over any account, including administrators, when the verification-code reset mode is enabled. | Aug 10, 2026 |
| CVE-2026-18468(opens NVD record) | High | 8.1 | The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls, allowing unauthenticated attackers to take over the account of any user who recently completed a reset verification, including an administrator. | Aug 10, 2026 |
| CVE-2026-18200(opens NVD record) | Medium | 4.3 | The FoodBoxBooker WordPress plugin before 1.0.8 does not verify that the user account being updated belongs to the user making the request, allowing authenticated users, with Subscriber-level access and above, to modify the profile details of arbitrary users, including administrators. | Aug 10, 2026 |
| CVE-2026-18030(opens NVD record) | High | 8.1 | The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password for any user, including administrators, and take over their account. Exploitation requires the site to have a form using the BricksForge WordPress plugin before 3.1.8.8's password reset action in its update mode. The server-side current-password verification option for that action is disabled by default, so the vulnerable state is the default one once the action is used. | Aug 10, 2026 |
| CVE-2026-17542(opens NVD record) | High | 7.5 | The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files of certain types from it, including archives and documents which may contain sensitive data. | Aug 10, 2026 |
| CVE-2026-17541(opens NVD record) | High | 7.5 | The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them. | Aug 10, 2026 |
| CVE-2026-17540(opens NVD record) | High | 8.8 | The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's configuration secrets and to denial of service. | Aug 10, 2026 |
| CVE-2026-17023(opens NVD record) | Medium | 4.8 | The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Google Calendar connection tokens with attacker-controlled ones and hijack the integration. Exploitation requires the site to have configured its own Google OAuth client for the calendar feature. | Aug 10, 2026 |
| CVE-2026-17022(opens NVD record) | High | 7.5 | The Salon Booking System WordPress plugin before 10.30.34 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, including personal information, by supplying a sequential booking identifier. | Aug 10, 2026 |