18915 matches found
CVE-2026-21082
Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...
EUVD-2026-55107
Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...
CVE-2026-21082
Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...
CVE-2026-21082
The CVE-2026-21082 entry identifies a relative path traversal vulnerability in Samsung Health prior to version 7.0.0, allowing local attackers to access sensitive information. Affected software: Samsung Health (pre-7.0.0). Root cause: relative path traversal. Impact: confidentiality of data may b...
CVE-2026-21077
Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...
CVE-2026-21077
Samsung Health is affected by CVE-2026-21077 due to incorrect authorization prior to version 7.0.0, allowing local attackers to access sensitive information. Affected software: Samsung Health (versions
CVE-2026-21076
Samsung Health prior to version 7.0.0 has an incorrect authorization flaw that could allow local attackers to access sensitive information. Affected product: Samsung Health (pre-7.0.0). Root cause: improper access control enabling local access to data. Reported CVSS v4.0 base score 6.9 (MEDIUM) w...
CVE-2026-21076
Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...
CVE-2026-21076
Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...
CVE-2026-14211
The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee provider is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any...
[SECURITY] Fedora 43 Update: kernel-7.1.7-100.fc43
The kernel meta package...
CVE-2026-52878
CVE-2026-52878 affects Klever-Go (versions 1.7.14–1.7.17). A nil RawData sub-message in protobuf Transaction triggers a nil-pointer panic when txVersionChecker.CheckTxVersion dereferences tx.RawData.Version without a nil check, causing a crash in the libp2p pubsub/the node process. The crash prop...
CVE-2026-15970 L7 intention authorization bypass via custom public listener
Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This...
CVE-2026-15970 L7 intention authorization bypass via custom public listener
Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This...
CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions
Impact A SQL injection vulnerability exists in the Query Builder's deleteBatch method. When deleteBatch is used together with where conditions, the bound values from the WHERE clause are substituted directly into the generated SQL with their escape flag ignored, so they are never escaped or quote...
EUVD-2026-51396
CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure...
MAL-2026-13618 Malicious code in w-screenctl (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b2f241eacc2eaaaac28d2b9d76aeb67042a109869b28e45a88648bf937f856f When WScreenctl is invoked via the bundled g.mjs entry or the documented systemd/Task Scheduler service units, the package starts a Hapi HTTP server...
K000162842: wolfSSL vulnerability CVE-2026-55961
Security Advisory Description wolfSSLPKCS7verify returning success for a degenerate certs-only PKCS7 object that contains no signer. Such an object has empty signerInfos, so the underlying signed-data verification succeeds without authenticating any content. The compatibility-layer verify path no...
CVE-2026-62992
Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. Prior to 5.8.2 and 4.5.7 on the 4.x line, Security::checkDir does not fully resolve symbolic links before validating that a requested path lies within a configured secure directory. A...
