EUVD-2026-97197

Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data...

EUVD-2026-97191

Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive data...

CVE-2026-21127

The Samsung Account application, on versions prior to 15.7.01.1 , is vulnerable to an improper export of android application components . This flaw allows local attackers to gain unauthorized access to sensitive data . No specific exploit information or mitigation steps are provided in the docume...

EUVD-2026-97187

Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to access data of the tied profile in before first unlock...

CVE-2026-21123

Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to access data of the tied profile in before first unlock...

CVE-2026-108796

A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/fingerdata/ of the component Biometric Data Endpoint. Executing a manipulation of the argument empcode can lead to authorization bypass. The attack can be launched remotely. Upgradi...

flatpak: flatpak: Arbitrary write access as root via extra-data extraction

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On system installs, the write happens as root. Two issues combine: files/extra is resolved via path operations that follow symlinks, and blob nam...

CVE-2026-108104

A flaw was found in snappy-java. A remote attacker can cause information disclosure or data corruption by supplying framed data with an excessively large chunk length. This input triggers an out-of-memory condition during buffer reallocation in SnappyFramedInputStream, causing pooled memory buffe...

CVE-2026-108796

A vulnerability exists in ZKTeco BioTime 9.5.6 Build 20260130.3206 within the Biometric Data Endpoint component. Specifically, an unknown part of the /iclock/finger_data/ file allows for an authorization bypass when the emp_code argument is manipulated. This attack can be initiated remotely . No ...

CVE-2026-108796 ZKTeco BioTime Biometric Data Endpoint finger_data authorization

A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/fingerdata/ of the component Biometric Data Endpoint. Executing a manipulation of the argument empcode can lead to authorization bypass. The attack can be launched remotely. Upgradi...

EUVD-2026-97167

A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/fingerdata/ of the component Biometric Data Endpoint. Executing a manipulation of the argument empcode can lead to authorization bypass. The attack can be launched remotely. The...

CVE-2026-108796 ZKTeco BioTime Biometric Data Endpoint finger_data authorization

A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/fingerdata/ of the component Biometric Data Endpoint. Executing a manipulation of the argument empcode can lead to authorization bypass. The attack can be launched remotely. The...

flatpak: flatpak: Arbitrary write access as root via extra-data extraction

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On system installs, the write happens as root. Two issues combine: files/extra is resolved via path operations that follow symlinks, and blob nam...

CVE-2026-108982

VeraCrypt 1.26.29 FUSE-T build on macOS sometimes allows unintended access to decrypted data. It does not terminate the FUSE-T auxiliary service go-nfsv4 and its associated VeraCrypt core-service helper processes when a volume is dismounted. After VeraCrypt reports the volume as dismounted, the...

Confluence Server - Remote Code Execution

Confluence Server and Data Center contain an OGNL injection vulnerability that could allow an authenticated user, and in some instances an unauthenticated user, to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version...

PT-2026-110938

Name of the Vulnerable Software and Affected Versions SnapOtter versions 1.15.10 through 2.2.0 Description A missing authorization issue allows any authenticated principal to access the '/api/v1/upload', '/api/v1/preview', and '/api/v1/preview/generate' endpoints without proper permission checks...

PT-2026-111101

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A path traversal issue allows a remote authenticated attacker to cause a denial of service. Path traversal is a flaw that allows an attacker to access files and directories that a...

CVE-2026-21123: Undefined Security Weakness

Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to access data of the tied profile in before first unlock...

CVE-2026-109247: Improper Limitation of a Pathname to a Restricted Directory

FreeRDP before 3.32.0 contains a path traversal vulnerability in convertfiledescriptorstofilelist in winpr/libwinpr/clipboard/syntheticfile.c, which concatenates server-supplied cFileName values from FileGroupDescriptorW clipboard data into the published local file:// URI without rejecting '/' or...

CVE-2026-109354: Improper Limitation of a Pathname to a Restricted Directory

LibreNMS before 26.9.0 contains a path traversal vulnerability in nfsenchannelcommon.inc.php that allows authenticated users to read unauthorized RRD data by injecting ../ sequences into the channel parameter. Attackers with access to one NFSen-enabled device can request graph.php with a traverse...