180512 matches found
CVE-2026-72571
A path traversal vulnerability in mustafaakin/cast-localvideo all versions allows an unauthenticated remote attacker to read arbitrary files from the server. The app.js handler at lines 151-153 passes the user-supplied req.body.dir parameter directly to res.sendFile without sanitization, enabling...
CVE-2026-72572
A path traversal vulnerability in o1lab/xmysql all versions allows an unauthenticated remote attacker to read and download arbitrary files from the server. The lib/xapi.js file at lines 338 and 424 uses the user-controlled req.query.name parameter in path.joincwd, name without sanitization before...
CVE-2026-72580 duhow xiaoai-patch - OS Command Injection in /mute and /unmute Endpoints
An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directl...
CVE-2026-72580
The CVE-2026-72580 entry details an OS command injection in the duhow/xiaoai-patch for Xiaomi smart speakers running the patch. The vulnerability arises because the /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directly to os.system() without san...
CVE-2026-60074
A flaw was found in Date::Manip. This vulnerability allows an attacker to provide specially crafted input containing non-ASCII decimal digits to the Date::Manip library for Perl. The library's parsing logic incorrectly processes these digits, truncating the input and resulting in an inaccurate da...
CVE-2026-21083
Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data...
CVE-2026-21083
CVE-2026-21083 affects Samsung Smart Switch software with improper input validation in versions before 3.7.72.6, enabling adjacent attackers to access sensitive data (confidentiality impact high). The description indicates the vulnerability is fixed in 3.7.72.6 or later; update to that version or...
EUVD-2026-55108
Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data...
CVE-2026-21073
CVE-2026-21073 affects Galaxy Themes prior to the SMR Aug-2026 Release 1. Description: improper input validation could allow a physical attacker to launch arbitrary activity. CVSS v4.0 score is 5.2 (Medium) with Attack Vector: Physical, Attack Complexity: Low, Privileges Required: None, User Inte...
CVE-2026-21073
Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrary activity...
EUVD-2026-55098
Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrary activity...
EUVD-2026-55097
Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory...
CVE-2026-21072
Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory...
CVE-2026-21072
The CVE-2026-21072 entry concerns the VC1 codec in libsavsvc.so, where improper input validation enables a local attacker to cause out-of-bounds memory writes. This indicates a local-privilege impact, with CVSSv4.0 vector reflecting Local Access, Low Attack Complexity, and no user interaction req...
CVE-2026-21071
The CVE-2026-21071 issue affects the MPEG4 codec component inlibsavsvc.so and is caused by improper input validation, enabling a local attacker to write out-of-bounds memory. Impact per provided metrics is low across confidentiality, integrity, and availability (local access, no user interaction,...
CVE-2026-21070
Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access sensitive information...
CVE-2026-21070
Technical details about CVE-2026-21070 are not publicly available in the provided documents. Monitor for updates and new disclosures.
EUVD-2026-55095
Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access sensitive information...