CVE-2026-20442: Use After Free

In display, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10436998; Issue ID: MSV-5723...

CVE-2025-59603: Out-of-bounds Write

Memory Corruption when processing invalid user address with nonstandard buffer address...

CVE-2026-26706: Improper Neutralization of Special Elements used in an SQL Command

sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/viewreceipt.php...

CVE-2026-0012: Improper Access Control

In setHideSensitive of ExpandableNotificationRow.java, there is a possible contact name leak due due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0032: Out-of-bounds Write

In multiple functions of memprotect.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-30062: Improper Neutralization of Special Elements used in an SQL Command

In the "CheckUnitCodeAndKey.pl" service, the "validateOrgUnit" function is vulnerable to SQL injection...

CVE-2025-47381: Use After Free

Memory Corruption while processing IOCTL calls when concurrent access to shared buffer occurs...

CVE-2025-48585: Improper Input Validation

In multiple functions of ProfilingService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-47385: Improper Access Control for Register Interface

Memory Corruption when accessing trusted execution environment without proper privilege check...

CVE-2026-0008: Unintended Proxy or Intermediary

In multiple functions of FaceEnroll.kt, there is a possible privilege escalation due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48587: Improper Input Validation

In multiple functions of ProfilingService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0037: Out-of-bounds Write

In multiple functions of ffa.c, there is a possible memory corruption due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-20426: Out-of-bounds Write

In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10320471; Issue ID: MSV-5538...

CVE-2026-20429: Out-of-bounds Read

In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10320471; Issue ID: MSV-5535...

CVE-2025-48650: Improper Neutralization of Special Elements used in an SQL Command

In multiple locations, there is a possible information disclosure due to SQL injection. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-47376: Use After Free

Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls...

CVE-2025-47371: Reachable Assertion

Transient DOS when an LTE RLC packet with invalid TB is received by UE...

CVE-2026-26699: Improper Control of Generation of Code

sourcecodester Personnel Property Equipment System v1.0 is vulnerable to arbitrary code execution in ip/ppes/admin/adminchangepicture.php...

CVE-2025-59600: Buffer Over-read

Memory Corruption when adding user-supplied data without checking available buffer space...

CVE-2026-0017: Improper Authorization

In onChange of BiometricService.java, there is a possible way to enable fingerprint unlock due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...