Export limit exceeded: 374568 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (374568 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-65948 | 2026-08-10 | N/A | ||
| UnixAuth lacks brute-force protection in Apache Ranger versions <= 2.8.0. Note: UnixAuth is NOT a recommended option for production deployments. Users are recommended to upgrade to version 2.9.0, which fixes this issue. | ||||
| CVE-2026-21082 | 1 Samsung Mobile | 1 Samsung Health | 2026-08-10 | N/A |
| Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information. | ||||
| CVE-2026-66642 | 2026-08-10 | 5.4 Medium | ||
| Cross-Site Request Forgery (CSRF) vulnerability in WP Umbrella allows Cross Site Request Forgery. This issue affects WP Umbrella: from n/a through 2.26.2. | ||||
| CVE-2026-21065 | 1 Samsung | 1 Mobile Devices | 2026-08-10 | N/A |
| Out-of-bounds write in libcodec2secqcelpdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. | ||||
| CVE-2026-21068 | 1 Samsung Mobile | 1 Samsung Mobile Devices | 2026-08-10 | N/A |
| Stack-based buffer overflow in libril_sem.so prior to SMR Aug-2026 Release 1 allows privileged local attackers to execute arbitrary code. | ||||
| CVE-2026-21072 | 2026-08-10 | N/A | ||
| Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. | ||||
| CVE-2026-21073 | 1 Samsung Mobile | 1 Samsung Mobile Devices | 2026-08-10 | N/A |
| Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrary activity. | ||||
| CVE-2026-21078 | 2026-08-10 | N/A | ||
| Insufficient verification of data authenticity in Smart Switch trouble scanning mode prior to version 3.7.72.6 allows adjacent attackers to spoof device identity. | ||||
| CVE-2026-21079 | 2026-08-10 | N/A | ||
| Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data. | ||||
| CVE-2026-21083 | 2026-08-10 | N/A | ||
| Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data. | ||||
| CVE-2026-21084 | 2026-08-10 | N/A | ||
| Improper access control in SmartThings prior to version 1.8.47.24 allows local attackers to access sensitive information. | ||||
| CVE-2026-66407 | 2026-08-10 | 8.1 High | ||
| DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. The WebSocket private key may be retrieved through analyzing the traffic data via a man-in-the-middle attack, and communication contents may be altered. | ||||
| CVE-2026-66409 | 2026-08-10 | 5.3 Medium | ||
| DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password may be analyzed and obtained to connect to the access point of an affected robot. | ||||
| CVE-2026-21064 | 1 Samsung Mobile | 1 Samsung Mobile Devices | 2026-08-10 | N/A |
| Improper access control in Weaver prior to SMR Aug-2026 Release 1 allows local attackers to cause device inoperability. | ||||
| CVE-2026-21066 | 1 Samsung Mobile | 1 Samsung Mobile Devices | 2026-08-10 | N/A |
| Improper input validation in libcodec2_sec_flacdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. | ||||
| CVE-2026-21069 | 1 Samsung | 1 Mobile Devices | 2026-08-10 | N/A |
| Incorrect conversion between numeric types in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. | ||||
| CVE-2026-66915 | 2026-08-10 | N/A | ||
| Joomla Extension - fabrikar.com - Remote code execution in Fabrik < 4.6.7 - An unauthenticated attacker could execute arbitrary code by using the ajax_calc feature of the calc plugin. | ||||
| CVE-2026-19363 | 1 Lmammino | 1 Oidc-authorizer | 2026-08-10 | 5.3 Medium |
| A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is an unknown function of the file src/handler.rs of the component Lambda Authorizer. The manipulation results in sensitive information in log files. The attack can be executed remotely. `src/handler.rs` logs raw Authorization header values and complete bearer tokens/JWTs on authentication failure paths, potentially exposing credentials through CloudWatch Logs. `src/models.rs` serializes the complete validated JWT claims set with `serde_json::to_string(token_claims).unwrap()` and propagates it through `context["jwtClaims"]` to downstream integrations. This code performs serialization, not deserialization, and does not process attacker-controlled `jwtClaims` input. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-14164 | 3 Libarchive, Red Hat, Redhat | 7 Libarchive, Enterprise Linux, Enterprise Linux and 4 more | 2026-08-10 | 7.5 High |
| A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service. | ||||
| CVE-2026-21059 | 1 Samsung Mobile | 1 Samsung Mobile Devices | 2026-08-10 | N/A |
| Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege. | ||||