CVE-2026-40436

CVE-2026-40436 affects the ZTE ZXEDM iEMS product. The vulnerability is a password reset flaw that, due to improper access control on the cloud EMS portalʼs user-list interface, allows reading all user information and resetting passwords for obtained accounts. This could enable unauthorized opera...

EUVD-2026-21862

Improper check for exceptional conditions in Recents prior to SMR Apr-2026 Release 1 allows physical attacker to bypass App Pinning...

EUVD-2026-21816

Improper input validation in data related to network restrictions prior to SMR Apr-2026 Release 1 allows physical attackers to bypass the restrictions...

EUVD-2026-21791

Vulnerability of improper permission control in the theme setting module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2026-21014

Improper access control in Samsung Camera prior to version 16.5.00.28 allows local attacker to access location data. User interaction is required for triggering this vulnerability...

CVE-2026-21006

Improper access control in Samsung DeX prior to SMR Apr-2026 Release 1 allows physical attackers to access to hidden notification contents...

CVE-2025-15441

The CVE concerns the WordPress plugin Form Maker by 10Web. Versions prior to 1.15.38 expose a SQL Injection risk due to improper preparation of SQL queries when the MySQL Mapping feature is used. Affected product: Form Maker by 10Web (WordPress plugin); vulnerable component: SQL query handling wi...

BIT-ELK-2026-33461 Incorrect Authorization in Kibana Fleet Leading to Information Disclosure

Incorrect Authorization CWE-863 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. A user with limited Fleet privileges can exploit an internal API endpoint to retrieve sensitive configuration data, including private keys and authentication tokens, that should only be...

CVE-2026-21014

The CVE affects Samsung Camera prior to version 16.5.00.28, where improper access control allows a local attacker to access the device geolocation data. Exploitation requires user interaction, and the impact is confined to confidentiality of location data. Remediation is to update Samsung Camera ...

CVE-2026-21014

Improper access control in Samsung Camera prior to version 16.5.00.28 allows local attacker to access location data. User interaction is required for triggering this vulnerability...

EUVD-2026-21872

Improper access control in Samsung Camera prior to version 16.5.00.28 allows local attacker to access location data. User interaction is required for triggering this vulnerability...

CVE-2026-21009

Improper check for exceptional conditions in Recents prior to SMR Apr-2026 Release 1 allows physical attacker to bypass App Pinning...

CVE-2026-21009

Summary: CVE-2026-21009 is a vulnerability in Samsung Recents before SMR Apr-2026 Release 1 that allows a physical attacker to bypass App Pinning. The issue arises from an improper check for exceptional conditions in Recents. The NVD entry confirms the description and references Samsung’s securit...

CVE-2026-21007

Improper check for exceptional conditions in Device Care prior to SMR Apr-2026 Release 1 allows physical attackers to bypass Knox Guard...

CVE-2026-21007

Improper check for exceptional conditions in Device Care prior to SMR Apr-2026 Release 1 allows physical attackers to bypass Knox Guard...

CVE-2026-21007

CVE-2026-21007 concerns Samsung devices with Device Care prior to SMR Apr-2026 Release 1. The issue is an improper check for exceptional conditions in Device Care, enabling physical attackers to bypass Knox Guard. Affected component: Device Care (on Samsung devices). Root cause: improper handling...

CVE-2026-21006

Improper access control in Samsung DeX prior to SMR Apr-2026 Release 1 allows physical attackers to access to hidden notification contents...

CVE-2026-21006

Improper access control in Samsung DeX prior to SMR Apr-2026 Release 1 allows physical attackers to access to hidden notification contents...

CVE-2026-21006

CVE-2026-21006 describes an improper access control in Samsung DeX (before SMR Apr-2026 Release 1) that lets a physical attacker access hidden notification contents. The entry specifies affected platform as Samsung DeX, with a minimal base impact on confidentiality (VULNERABLE: LOW; SUBSEQUENT: H...

CVE-2026-21003

CVE-2026-21003 describes improper input validation of data related to network restrictions before SMR Apr-2026 Release 1, enabling physical attackers to bypass those restrictions. The impact in the provided metrics shows no confidentiality impact, high integrity and availability impact, with phys...