10659 matches found
CVE-2026-88912 rtMedia for WordPress, BuddyPress and bbPress < 4.7.12 - Subscriber+ Arbitrary Activity Privacy Modification via IDOR
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to...
EUVD-2026-76957
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to...
CVE-2026-88912
The rtMedia for WordPress, BuddyPress and bbPress plugin (versions before 4.7.12 ) is vulnerable to an IDOR (Insecure Direct Object Reference) issue. The software fails to verify ownership when changing the privacy level of an activity and its associated media, relying instead on a nonce shared w...
PT-2026-90796
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to...
EUVD-2026-76902
Freeciv versions 3.1.0 through 3.2.5 contain an out-of-bounds read vulnerability in sgloadplayerunit when processing savegame files with invalid unit activity indices. An attacker can craft a malicious savegame file with an out-of-range activity index that bypasses bounds checking and causes a...
PT-2026-90717
Name of the Vulnerable Software and Affected Versions Freeciv versions 3.1.0 through 3.2.5 Description An out-of-bounds read occurs in the sg load player unit function when processing savegame files containing invalid unit activity indices. A malicious savegame file with an out-of-range activity...
CVE-2026-21112
Improper input validation in Samsung Tips prior to Android 17 allows local attackers to launch arbitrary activity with Samsung Tips privilege. User interaction is required for triggering this vulnerability...
CVE-2026-21100
Improper access control in SystemUI prior to SMR Sep-2026 Release 1 allows local attackers to launch arbitrary activity...
CVE-2026-21097
Improper authentication in ActivityTaskManagerService prior to SMR Sep-2026 Release 1 allows local privileged attackers to launch arbitrary activity...
CVE-2026-21112
CVE-2026-21112 is an improper input validation flaw in Samsung Tips prior to Android 17 . A local attacker with low privileges can launch an arbitrary activity with Samsung Tips privilege , resulting in high confidentiality impact on the vulnerable system. User interaction is required to trigger ...
CVE-2026-21112
Improper input validation in Samsung Tips prior to Android 17 allows local attackers to launch arbitrary activity with Samsung Tips privilege. User interaction is required for triggering this vulnerability...
CVE-2026-21112
Improper input validation in Samsung Tips prior to Android 17 allows local attackers to launch arbitrary activity with Samsung Tips privilege. User interaction is required for triggering this vulnerability...
EUVD-2026-74653
Improper input validation in Samsung Tips prior to Android 17 allows local attackers to launch arbitrary activity with Samsung Tips privilege. User interaction is required for triggering this vulnerability...
EUVD-2026-74641
Improper access control in SystemUI prior to SMR Sep-2026 Release 1 allows local attackers to launch arbitrary activity...
CVE-2026-21100
Improper access control in SystemUI prior to SMR Sep-2026 Release 1 allows local attackers to launch arbitrary activity...
CVE-2026-21100
Improper access control in SystemUI prior to SMR Sep-2026 Release 1 allows local attackers to launch arbitrary activity...
CVE-2026-21100
CVE-2026-21100 is an improper access control vulnerability in Samsung's SystemUI component. A local attacker with low privileges can exploit this flaw to launch arbitrary activity on the device, potentially gaining high confidentiality and integrity impact without affecting availability (NVD CVSS...
CVE-2026-21097
Improper authentication in ActivityTaskManagerService prior to SMR Sep-2026 Release 1 allows local privileged attackers to launch arbitrary activity...