CVE-2026-15366

A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly within the page...

CVE-2026-15365

A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification and use Quick Apps outside the app...

CVE-2026-58108

The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them. SQLAlchemy resolves that as an implicit cross join, so the filter does not constrain the delete to the calling user's own token in the way the code reads as...

CVE-2026-58108

Ericsson CodeChecker 's personal access token deletion query selects from PersonalAccessTokenDB but filters on Session columns without a join. SQLAlchemy resolves this as an implicit cross join, meaning the filter fails to constrain the delete to the calling user's own token. As a result, a suffi...

CVE-2026-15366

A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly within the page...

CVE-2026-15366

A control logic defect in a specific built-in webpage of Kids Mode on vivo devices allows users to view local gallery photos directly within that page. The vulnerability is scored CVSS 4.0 base 2.4 (LOW) with a physical attack vector , indicating proximity access is required and no privileges or ...

CVE-2026-15365

A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification and use Quick Apps outside the app...

EUVD-2026-66295

A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification and use Quick Apps outside the app...

CVE-2026-15365

CVE-2026-15365 affects vivo Kids Mode , where a pop-up logic flaw in a certain feature allows users to bypass password verification and access Quick Apps outside the app. The vulnerability requires a physical attack vector and is scored CVSS 4.0 Base 2.4 (LOW) , with low impact on confidentiality...

CVE-2026-80195

Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint PATCH /api/teams/id, which removes all existing team members before validating the submitted replacement member list. An authenticated teamlead or other user with permission to edi...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098744)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098744 advisory. In the Linux kernel, the following vulnerability has been resolved: nfsd: nfsd4spomustallow must check this is a v4 compound request If the request being processed i...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098768)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098768 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Don't recheck L1 intercepts when completing userspace I/O When completing emulation of...

PT-2026-82179

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the sloppy-logic-analyzer component of the Linux kernel. The trigger write function dereferences the gpio la poll priv object without taking a debugfs...

Linux Distros Unpatched Vulnerability : CVE-2026-80563

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind The trigger debugfs file has a hand-rolled -write handler triggerwrite that...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098969)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098969 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf: fix end-of-list detection in cgroupstoragegetnextkey listnextentry never returns NULL -- whe...

CVE-2026-80195 Kimai before 2.63.0 Team Membership Removal via API

Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint PATCH /api/teams/id, which removes all existing team members before validating the submitted replacement member list. An authenticated teamlead or other user with permission to edi...

CVE-2026-80195

Kimai before 2.63.0 has a business logic / improper authorization flaw in the team update API endpoint (PATCH /api/teams/{id} ). The endpoint deletes all existing team membership rows before validating the submitted replacement member list. An authenticated user with team-edit permission can ther...

CVE-2026-80195 Kimai before 2.63.0 Team Membership Removal via API

Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint PATCH /api/teams/id, which removes all existing team members before validating the submitted replacement member list. An authenticated teamlead or other user with permission to edi...

DEBIAN-CVE-2026-78949

Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-installed app. Chromium security severity: Medium...

CVE-2026-79406

A security vulnerability has been detected in macrozheng mall up to 1.0.3. Affected is the function OmsCartItemServiceImpl.updateQuantity of the file /cart/update/quantity. The manipulation of the argument quantity leads to business logic errors. The attack may be initiated remotely. The vendor...