CVE-2026-21114: Out-of-bounds Write

Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code...

CVE-2026-21128: Improper Input Validation

Improper input validation in CreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch arbitrary activity with Samsung Checkout privileges...

CVE-2026-21117: Undefined Security Weakness

Improper access control in CocktailBarService prior to SMR Oct-2026 Release 1 allows local attackers to access sensitive information...

CVE-2026-21118: Undefined Security Weakness

Improper access control in DownloadProvider prior to SMR Oct-2026 Release 1 allows local attackers to access files in scoped storage...

CVE-2026-21116: Undefined Security Weakness

Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory...

CVE-2026-21115: Undefined Security Weakness

Out-of-bounds write in libcodec2-sec-flacdec.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory...

CVE-2026-21136: Undefined Security Weakness

Improper authorization in Smart Switch prior to version 3.7.73 allows physical attackers to invoke application restore process...

CVE-2026-21135: Undefined Security Weakness

Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information...

CVE-2026-21134: Undefined Security Weakness

Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sensitive information...

CVE-2026-21121: Undefined Security Weakness

Improper handling of insufficient permission in CmcCore prior to SMR Oct-2026 Release 1 allows local attackers to use the privileged APIs...

CVE-2026-21120: Use After Free

Use after free in WSM service prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code with system privilege...

CVE-2026-21122: Out-of-bounds Write

Out-of-bounds write in libsamsungtts.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code...

CVE-2026-21123: Undefined Security Weakness

Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to access data of the tied profile in before first unlock...

CVE-2026-21126: Undefined Security Weakness

Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory...

CVE-2026-108777: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in erzhongxmu JEEWMS up to 2026.09.27-W39. This affects the function WvGiController.list of the file src/main/java/com/zzjee/wmapi/controller/WvGiController.java. The manipulation of the argument searchstr results in sql injection. The attack can be executed remotely. Th...

CVE-2026-108896: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the argument 6rdprefix/6rdprefixlen results in os command injection. The attack can be launched remotely. The exploit has been made public and...

CVE-2026-108889: Exposed IOCTL with Insufficient Access Control

A flaw has been found in Yungengxin Cloud Billing 2024.11.28.11. Affected by this vulnerability is the function sub14000443C in the library LWBilling64.sys of the component IOCTL Process Termination. Executing a manipulation of the argument Pid can lead to exposed ioctl with insufficient access...

CVE-2026-108929: Improper Neutralization of Argument Delimiters in a Command

A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the component DDNS. Executing a manipulation of the argument Hostname can lead to argument injection. The attack can be launched remotely...

CVE-2026-108981: UNIX Symbolic Link (Symlink) Following

ngxcachepurge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application e.g., WordPress run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symli...

CVE-2026-108906: Out-of-bounds Read

A vulnerability has been found in Netcore NR268 1.7.121109. This affects the function filterarpputfilecgi of the file /router/filterarpputfile.cgi. The manipulation of the argument putfile leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed ...