8348 matches found
CVE-2026-20435
In preloader, there is a possible read of device unique identifiers due to a logic error. This could lead to local information disclosure, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID:...
CVE-2026-20435
A logic error in the preloader of MediaTek chipsets (affecting approximately 875 million Android devices) allows for the reading of device unique identifiers. An attacker with physical access can exploit this via USB in under 45 seconds, even when the device is powered off, to bypass lock screens...
CVE-2026-20435
In preloader, there is a possible read of device unique identifiers due to a logic error. This could lead to local information disclosure, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID:...
PT-2026-26419
Summary In [email protected], sandbox network hardening blocks network=host but still allows network=container:. This can let a sandbox join another container's network namespace and reach services available in that namespace. Preconditions and Trust Model Context This issue requires a...
PT-2026-22560
Name of the Vulnerable Software and Affected Versions Samsung Preloader affected versions not specified MediaTek chipsets affected versions not specified Description A logic error in the preloader allows the reading of device unique identifiers, leading to local information disclosure. This flaw...
Linux Distros Unpatched Vulnerability : CVE-2025-40932
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache::SessionX versions through 2.01 for Perl create insecure session id. Apache::SessionX generates session ids insecurely. The default session id generator ...
CVE-2026-28562
wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::gettopics where the ORDER BY clause relies on ineffective escsql sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE WHEN payloads to perform blind boolean extraction of credentials...
CVE-2026-25774
Charging station authentication identifiers are publicly accessible via web-based mapping platforms...
CVE-2026-27773
Charging station authentication identifiers are publicly accessible via web-based mapping platforms...
CVE-2026-20791
Charging station authentication identifiers are publicly accessible via web-based mapping platforms...
CVE-2026-20733
Charging station authentication identifiers are publicly accessible via web-based mapping platforms...
CVE-2026-22890
Charging station authentication identifiers are publicly accessible via web-based mapping platforms...
CVE-2026-22878
Charging station authentication identifiers are publicly accessible via web-based mapping platforms...
CVE-2026-25778
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent...
CVE-2026-25711
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent...
CVE-2026-27647
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent...
CVE-2026-27652
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent...
CVE-2026-20895
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent...
CVE-2026-26290
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent...
GHSA-7JX5-9FJG-HP4M OpenClaw ACP client has permission auto-approval bypass via untrusted tool metadata
Vulnerability Summary The OpenClaw ACP client could auto-approve tool calls based on untrusted metadata and permissive name heuristics. A malicious or compromised ACP tool invocation could bypass expected interactive approval prompts for read-class operations. Affected Packages / Versions -...