214390 matches found
kernel: selinux: fix overlayfs mmap() and mprotect() access checks
A flaw was found in the Linux kernel's SELinux security module when handling overlayfs. The existing security model for overlayfs does not properly enforce access controls for mmap and mprotect operations. This oversight could allow a local attacker to bypass intended security policies, potential...
CVE-2026-72564 fosrl Pangolin - Access Token Scope Bypass Allows Cross-Resource Authentication
An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource...
CVE-2026-71439
A flaw was found in Mermaid. Mermaid Radar Diagrams are susceptible to a denial of service vulnerability. A remote attacker could exploit this by providing excessively large values for the 'ticks' parameter. This can lead to high CPU usage, causing the rendering webpage or JavaScript process to...
CVE-2026-44630 Apache IoTDB: RPC service denial of service via unchecked Thrift string length
Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to allocate an excessive amount of memory and crash with an OutOfMemoryError. Thi...
EUVD-2026-55157
Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to allocate an excessive amount of memory and crash with an OutOfMemoryError. Thi...
CVE-2026-44630
CVE-2026-44630 concerns Apache IoTDB: improper validation of length fields in the RPC service can allow a remote unauthenticated attacker to cause a denial of service by sending a crafted malformed Thrift frame. This can cause IoTDB to allocate excessive memory and crash with an OutOfMemoryError....
CVE-2026-64564
A flaw was found in the Stream Control Transmission Protocol SCTP implementation within the Linux kernel. A remote attacker could send a specially crafted sequence of ASCONF Add IP Address Configuration chunks, including DEL-IP Delete IP Address parameters, to trigger a use-after-free condition...
CVE-2026-21075
Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information...
CVE-2026-21080
Cleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data...
CVE-2026-21082
Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...
CVE-2026-21070
Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access sensitive information...
CVE-2026-21069
Incorrect conversion between numeric types in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory...
CVE-2026-21074
Incorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute arbitrary commands with Bixby privilege...
CVE-2026-21063
Improper export of android application components in AppLock prior to SMR Aug-2026 Release 1 allows physical attackers to bypass app lock function...
CVE-2026-50045
A vulnerability in Unbound allows a remote attacker to bypass upstream amplification limits by querying a deeply nested name under a DNSSEC-signed parent. This triggers excessive outbound traffic per query, potentially causing a denial of service DoS. Mitigation Restrict recursive DNS access...
CVE-2026-21058
Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege...
CVE-2026-21083
Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data...
CVE-2026-21081
CVE-2026-21081 describes an issue in SamsungPassAutofill (Android) where improper export of components allows a local attacker to access sensitive information. The vulnerability requires user interaction to trigger and affects versions prior to 5.2.10.x. According to the provided metrics, the CVS...
