CVE-2026-21069

Incorrect conversion between numeric types in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory...

CVE-2026-21067

Improper input validation in libsmsd.so (Samsung Mobile), present before the August 2026 Security Maintenance Release, allows local attackers to write out-of-bounds memory, potentially achieving full system compromise. No public exploitation details are provided. Upgrade to SMR Aug-2026 Release 1...

CVE-2026-21066

Improper input validation in libcodec2_sec_flacdec.so (Samsung's FLAC decoder) on Samsung devices prior to the SMR Aug-2026 Release 1 patch allows local attackers to write out-of-bounds memory, potentially enabling privilege escalation. No in-the-wild exploitation is reported. Patch: SMR Aug-2026...

CVE-2026-21066

Improper input validation in libcodec2secflacdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory...

EUVD-2026-55091

Improper input validation in libcodec2secflacdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory...

CVE-2026-21065

Out-of-bounds write in libcodec2secqcelpdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory...

CVE-2026-21063

Improper export of android application components in AppLock prior to SMR Aug-2026 Release 1 allows physical attackers to bypass app lock function...

CVE-2026-21062

Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local attackers to access clipboard data...

CVE-2026-21058

Improper input validation in Samsung Contacts (pre-SMR Aug-2026 Release 1) lets local attackers delete files using the app's privileges. NVD rates it HIGH (CVSS 7.1, local/low-complexity), while Samsung rates it MEDIUM (6.9). No in-the-wild exploitation is reported. Apply the SMR Aug-2026 Release...

EUVD-2026-55081

Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression, which may allow an attacker who can access the affected product to log in to the management console. As a result, the attacker may perform any operations available from...

CVE-2026-67864

A flaw was found in open62541. A remote attacker can exploit a vulnerability in the NodeManagement type-instantiation logic component, leading to a denial of service DoS. This can make the affected system unavailable to legitimate users...

kernel: selinux: fix overlayfs mmap() and mprotect() access checks

A flaw was found in the Linux kernel's SELinux security module when handling overlayfs. The existing security model for overlayfs does not properly enforce access controls for mmap and mprotect operations. This oversight could allow a local attacker to bypass intended security policies, potential...

python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files

A flaw was found in Pillow, a Python imaging library. When processing a specially crafted font file, the library's font compilation function does not adequately check for excessive memory allocation. This oversight allows a remote attacker to trigger an unreasonable consumption of system memory,...

tar: Node-tar: Denial of Service via malformed tar archive header

A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop,...

X.org: xorg-x11-server: GLX contextTags Use-After-Free in CommonMakeCurrent()

A flaw was found in the X.org X11 server, specifically within the GLX OpenGL Extension to the X Window System dispatch layer. A remote attacker can exploit this vulnerability by sending a series of crafted X11 requests. This can lead to a use-after-free condition, where the server attempts to wri...

PT-2026-69995

Name of the Vulnerable Software and Affected Versions TP-Link Aginet affected versions not specified Description Certain web interface components fail to properly validate and sanitize user-supplied input before passing it to system-level command execution functions. This allows an authenticated...

The vulnerability of the smp_cmdPairingReq() function in the net/bluetooth/smp.c module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the smpcmdPairingReq function in the net/bluetooth/smp.c module of the Linux operating system is related to insufficient security checks for protected connections. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and...

Linux Distros Unpatched Vulnerability : CVE-2026-59091

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in GIMP's file format plugins, including those for PSD and PAA files. A remote attacker could exploit these vulnerabilities by tricking a user...

The vulnerability in the Firefox web browser, related to writing beyond the buffer limit, allows a hacker to trigger a service failure.

The vulnerability in the Firefox web browser is related to writing beyond the buffer limit. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

Linux Distros Unpatched Vulnerability : CVE-2026-66738

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user inpu...