91856 matches found
CVE-2026-28623
In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the Bluetooth MAC address due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-28611
In multiple functions of NfcService.java, there is a possible silent payment session hijacking enablement due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-28582
In onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unauthorized access to and modification of device credentials due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed...
CVE-2026-0054
In isCallerAllowed of WalletContextualLocationsService.kt, there is a possible way to get wallet information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
EUVD-2026-74050
In checkReadPermission of PermissionsManager.java, there is a possible way to monitor sensitive device state data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-49883
CVE-2026-49883 affects Android Wear (per the 2026-09-01 security bulletin) and involves a missing permission check in the checkReadPermission method of PermissionsManager.java. This allows an attacker to monitor sensitive device state data without requiring additional execution privileges or user...
CVE-2026-49883
In checkReadPermission of PermissionsManager.java, there is a possible way to monitor sensitive device state data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-49883
In checkReadPermission of PermissionsManager.java, there is a possible way to monitor sensitive device state data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
Security Bulletin: Langflow is affected by improper authentication due to missing password verification in the password reset endpoint
Summary Langflow provides a password reset capability through its user management API. The password reset endpoint accepts a current password field in the request body but does not verify it against the stored credential before applying the password change, and enforces no password complexity...
WordPress Checkout Custom Fields Builder for WooCommerce plugin <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation vulnerability
Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation vulnerability discovered by Nabil Irawan in WordPress Plugin Checkout Custom Fields Builder for WooCommerce versions = 1.1.5...
CVE-2026-83991
Missing authentication for critical function in Windows Cloud Files Mini Filter Driver allows an authorized attacker to perform tampering locally...
CVE-2026-83942
Missing authorization in Windows Kernel allows an authorized attacker to elevate privileges locally...
CVE-2026-83941
Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network...
CVE-2026-81376
Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-73014
Missing authorization in Data Sharing Service Client allows an authorized attacker to elevate privileges locally...
CVE-2026-73004
Missing authentication for critical function in Windows Autopilot allows an authorized attacker to perform tampering locally...
CVE-2026-72964
Missing authentication for critical function in Windows Internet Connection Sharing ICS allows an authorized attacker to perform tampering locally...
CVE-2026-72966
Missing authorization in Windows Remote Access Connection Manager allows an authorized attacker to perform tampering locally...