310983 matches found
CVE-2026-108907: Improper Authentication
A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function userok of the component CGI Execution. This manipulation causes improper authentication. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted...
CVE-2026-109566: Use of Hard-coded Credentials
Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-create...
CVE-2026-108820: Execution with Unnecessary Privileges
A weakness has been identified in agno-agi agno up to 3.0.6/3.1.1. This issue affects the function memberagent.run in the library libs/agno/agno/team/defaulttools.py of the component Delegation Feature. Executing a manipulation can lead to execution with unnecessary privileges. The attack can be...
CVE-2026-108821: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in Tencent WeKnora up to 0.8.1. Impacted is the function validateSubquery of the file internal/utils/inject.go of the component SQL Validator. The manipulation leads to sql injection. The attack is possible to be carried out remotely. The exploit has bee...
CVE-2026-108815: Improper Neutralization of Input During Web Page Generation
A vulnerability has been found in idcCMS 1.70. Affected is an unknown function of the file admin/memberdeal.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used...
CVE-2026-108814: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in SEMCMS up to 5.0. This impacts an unknown function of the file SEMCMSBanner.php. Executing a manipulation can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this...
CVE-2026-108813: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in SEMCMS up to 5.0. This affects an unknown function of the file SEMCMSDownload.php. Performing a manipulation results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about th...
CVE-2026-108808: Use of GET Request Method With Sensitive Query Strings
A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. This vulnerability affects unknown code of the file /auth/realms/default/protocol/openid-connect/logout of the component JWT Token Handler. Executing a manipulation of the argument idtokenhint can lead to use of get...
CVE-2026-108784: Undefined Security Weakness
A vulnerability was detected in macrozheng mall up to 1.0.3. This vulnerability affects the function AlipayServiceImpl.pay of the file com/macro/mall/portal/service/impl/AlipayServiceImpl.java of the component Payment Endpoint. The manipulation of the argument totalamount results in business logi...
CVE-2026-108782: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this issue is the function CommonServiceImpl.getAutoList of the file src/main/java/org/jeecgframework/core/common/service/impl/CommonServiceImpl.java of the component Autocomplete Handler. Executing a manipulati...
CVE-2026-108785: Insufficient Session Expiration
A flaw has been found in macrozheng mall up to 1.0.3. This issue affects the function JwtTokenUtil.refreshHeadToken of the file /admin/refreshToken of the component JwtAuthenticationTokenFilter. This manipulation of the argument token causes session expiration. The attack may be initiated remotel...
CVE-2026-108777: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in erzhongxmu JEEWMS up to 2026.09.27-W39. This affects the function WvGiController.list of the file src/main/java/com/zzjee/wmapi/controller/WvGiController.java. The manipulation of the argument searchstr results in sql injection. The attack can be executed remotely. Th...
CVE-2026-21137: Improper Limitation of a Pathname to a Restricted Directory
Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege...
CVE-2026-21134: Improper Authentication
Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sensitive information...
CVE-2026-21130: Improper Input Validation
Improper input validation in CreditCardRetrieveActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges...
CVE-2026-21126: Undefined Security Weakness
Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory...
CVE-2026-21122: Out-of-bounds Write
Out-of-bounds write in libsamsungtts.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code...
CVE-2026-21121: Improper Handling of Insufficient Permissions or Privileges
Improper handling of insufficient permission in CmcCore prior to SMR Oct-2026 Release 1 allows local attackers to use the privileged APIs...
CVE-2026-21120: Use After Free
Use after free in WSM service prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code with system privilege...