CVE-2026-21081

CVE-2026-21081 describes an issue in SamsungPassAutofill (Android) where improper export of components allows a local attacker to access sensitive information. The vulnerability requires user interaction to trigger and affects versions prior to 5.2.10.x. According to the provided metrics, the CVS...

CVE-2026-21080

Cleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data...

CVE-2026-21077

Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...

CVE-2026-21072

Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory...

CVE-2026-21071

Improper input validation in MPEG4 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory...

CVE-2026-21069

Incorrect conversion between numeric types in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory...

CVE-2026-21067

Improper input validation in libsmsd.so (Samsung Mobile), present before the August 2026 Security Maintenance Release, allows local attackers to write out-of-bounds memory, potentially achieving full system compromise. No public exploitation details are provided. Upgrade to SMR Aug-2026 Release 1...

CVE-2026-21066

Improper input validation in libcodec2_sec_flacdec.so (Samsung's FLAC decoder) on Samsung devices prior to the SMR Aug-2026 Release 1 patch allows local attackers to write out-of-bounds memory, potentially enabling privilege escalation. No in-the-wild exploitation is reported. Patch: SMR Aug-2026...

EUVD-2026-55091

Improper input validation in libcodec2secflacdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory...

CVE-2026-21066

Improper input validation in libcodec2secflacdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory...

CVE-2026-21065

Out-of-bounds write in libcodec2secqcelpdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory...

CVE-2026-21062

Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local attackers to access clipboard data...

CVE-2026-21058

Improper input validation in Samsung Contacts (pre-SMR Aug-2026 Release 1) lets local attackers delete files using the app's privileges. NVD rates it HIGH (CVSS 7.1, local/low-complexity), while Samsung rates it MEDIUM (6.9). No in-the-wild exploitation is reported. Apply the SMR Aug-2026 Release...

Astra Linux – Vulnerability in grub2

A vulnerability has been identified in the GRUB Grand Unified Bootloader component. This flaw occurs because the bootloader improperly handles string conversions when reading information from a USB device, allowing an attacker to exploit inconsistencies in the length values. A local attacker can...

Astra Linux – Vulnerability in libssh

A flaw was discovered in libssh, where it may attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a malicious configuration file or when the system is misconfigured. This vulnerability could lead to a Denial of Service DoS attack, as the...

Astra Linux – Vulnerability in glib2.0

A flaw was discovered in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability enables a local attacker to...

kernel: selinux: fix overlayfs mmap() and mprotect() access checks

A flaw was found in the Linux kernel's SELinux security module when handling overlayfs. The existing security model for overlayfs does not properly enforce access controls for mmap and mprotect operations. This oversight could allow a local attacker to bypass intended security policies, potential...

CVE-2026-19368 PV-Bhat gemsuite-mcp gemini_search unified-gemini.ts path traversal

A vulnerability was found in PV-Bhat gemsuite-mcp 1.0.0. Affected by this issue is some unknown functionality of the file src/handlers/unified-gemini.ts of the component geminisearch/geminireason/geminiprocess/geminianalyze. The manipulation of the argument filepath/filepaths results in path...

CVE-2026-19368

PV-Bhat gemsuite-mcp 1.0.0 contains a path traversal vulnerability in src/handlers/unified-gemini.ts (component chain gemini_search/gemini_reason/gemini_process/gemini_analyze). The issue arises from manipulation of the argument file_path/file_paths, which can be exploited from a local position. ...

CVE-2026-19326 Jevon-Zhong Ai-doctor filemanagement.service.ts deleteImage path traversal

A vulnerability was detected in Jevon-Zhong Ai-doctor 0.0.1. This vulnerability affects the function deleteImage of the file ai-doctor-server/src/filemanagement/filemanagement.service.ts. Performing a manipulation of the argument imagePath results in path traversal. The attack must be initiated...