CVE-2026-21107: Out-of-bounds Write

Out-of-bounds write in Samsung Notes prior to version 4.4.45.5 allows local attackers to write out-of-bounds memory...

PT-2026-88843

Improper access control in Watch Plugin prior to Android Watch 17 allows local attackers to access sensitive information...

PT-2026-88841

Name of the Vulnerable Software and Affected Versions Samsung Notes versions prior to 4.4.45.5 Description An out-of-bounds write exists that allows local attackers to write to memory outside the allocated buffer. An out-of-bounds write is a memory corruption error that occurs when a program writ...

PT-2026-88586

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 153.0.8010.36 Description A clickjacking issue exists in TrustedWebActivities, which allows a local attacker to spoof the address bar using a co-installed application. Clickjacking is a technique wher...

Linux Distros Unpatched Vulnerability : CVE-2026-87633

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Views in Google Chrome prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via UI Interaction...

PT-2026-88820

Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration...

CVE-2026-87509: Incorrect Authorization

Incorrect authorization in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. Chromium security severity: Low...

CVE-2026-87486: Improper Restriction of Rendered UI Layers or Frames

Clickjacking in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to spoof address bar via a co-installed app. Chromium security severity: Medium...

Backblaze Personal Computer Backup bzbackup Link Following Denial-of-Service Vulnerability

This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Backblaze Personal Computer Backup. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific fla...

CVE-2026-86424

A flaw was found in ImageMagick. This time-of-check-time-of-use TOCTOU vulnerability, involving a symlink race in the video decoder, allows a local attacker with low privileges to bypass path policy write restrictions. By replacing a symbolic link between the security check and the actual file...

CVE-2026-86141

A NULL pointer dereference in libxml2's xmlRegNewParserCtxt function allows a local attacker to cause a denial of service DoS. The flaw occurs when strlen is called on an unverified pointer following a failed xmlStrdup memory allocation, resulting in a process crash...

CVE-2026-52486

An issue in OpenDDS 3.33.x allows a local attacker to cause a denial of service via the verify function in the SIgnedDocument module...

CVE-2026-73000

Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally...

CVE-2026-73003

Use after free in Windows Modern Device Management MDM allows an authorized attacker to elevate privileges locally...

CVE-2026-69421

Integer underflow wrap or wraparound in Windows Kernel Mode Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-68824

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally...

libvirt: swtpm privilege escalation via symlink following

A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvir...

CVE-2026-81391

CVE-2026-81391 is an information disclosure vulnerability in Microsoft Office Excel caused by a use of uninitialized resource . An unauthorized local attacker with user interaction can disclose information, rated CVSS 5.5 (Medium) with high confidentiality impact but no integrity or availability ...

EUVD-2026-73858

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally...

libexpat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service

A flaw was found in libexpat. The library's handling of custom encoding callbacks lacks proper tracking of handler call depth, which can lead to a use-after-free vulnerability. This memory corruption flaw could allow a local attacker to cause a denial of service or potentially execute arbitrary...