CVE-2026-21112

Improper input validation in Samsung Tips prior to Android 17 allows local attackers to launch arbitrary activity with Samsung Tips privilege. User interaction is required for triggering this vulnerability...

CVE-2026-21112

CVE-2026-21112 is an improper input validation flaw in Samsung Tips prior to Android 17 . A local attacker with low privileges can launch an arbitrary activity with Samsung Tips privilege , resulting in high confidentiality impact on the vulnerable system. User interaction is required to trigger ...

EUVD-2026-74653

Improper input validation in Samsung Tips prior to Android 17 allows local attackers to launch arbitrary activity with Samsung Tips privilege. User interaction is required for triggering this vulnerability...

CVE-2026-21098

Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allows local attackers to establish a connection with the PC without proper user interaction...

CVE-2026-21098

Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allows local attackers to establish a connection with the PC without proper user interaction...

CVE-2026-21098

CVE-2026-21098 is an improper access control vulnerability in Samsung's Link to Windows feature, affecting versions prior to SMR Sep-2026 Release 1 . A local attacker can establish a connection with the PC without proper user interaction , resulting in high impact on availability as scored by the...

EUVD-2026-74639

Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allows local attackers to establish a connection with the PC without proper user interaction...

CVE-2026-19797

The User Access Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tabgroupsection' parameter in all versions up to, and including, 2.3.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-19797

User Access Manager is a WordPress plugin vulnerable to Reflected Cross-Site Scripting (XSS) via the tab_group_section parameter in all versions up to and including 2.3.18 . The root cause is insufficient input sanitization and output escaping . An unauthenticated attacker who can trick a victim ...

CVE-2026-19797 User Access Manager <= 2.3.18 - Reflected Cross-Site Scripting via 'tab_group_section' Parameter

The User Access Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tabgroupsection' parameter in all versions up to, and including, 2.3.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

EUVD-2026-74605

The User Access Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tabgroupsection' parameter in all versions up to, and including, 2.3.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-19797 User Access Manager <= 2.3.18 - Reflected Cross-Site Scripting via 'tab_group_section' Parameter

The User Access Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tabgroupsection' parameter in all versions up to, and including, 2.3.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-87635

An ui misrepresentation flaw was found in the Payments component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=522304737...

CVE-2026-87649

A flaw was found in chromium-browser. A remote attacker, leveraging social engineering tactics, could exploit a user interface UI misrepresentation in the Downloads section by tricking a user into interacting with a specially crafted HTML page. This could allow the attacker to bypass system acces...

CVE-2026-87450

A flaw was found in Google Chrome. This incorrect authorization vulnerability in Permissions allows a remote attacker, by leveraging social engineering and a crafted Chrome extension, to obtain sensitive information. This could lead to the unauthorized disclosure of user data...

kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()

A flaw was found in the Linux kernel's RDMA/mana component. A local user could trigger a kernel corruption by providing specific configurations through the user Application Programming Interface uAPI that cause an internal error. This issue arises when Work Queues WQs are specified to share the...

kernel: RDMA/mana: Validate rx_hash_key_len

A flaw was found in the Linux kernel's RDMA/mana component. A local user could exploit this vulnerability by providing an invalid rxhashkeylen value through a user-space API uAPI structure. This invalid value is then used in a memcpy operation without proper bounds checking, allowing the user to...

CVE-2026-87462

UI misrepresentation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87559

UI misrepresentation in UI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges

A flaw was found in the Linux kernel in net/can/bcm.c in can: bcm, where an unprivileged local user can exploit this vulnerability to execute arbitrary code within the kernel, which leads to a local privilege escalation LPE. This allows the attacker to gain root privileges and take full control o...