CVE-2026-20426: Out-of-bounds Write

In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10320471; Issue ID: MSV-5538...

CVE-2026-26699: Improper Control of Generation of Code

sourcecodester Personnel Property Equipment System v1.0 is vulnerable to arbitrary code execution in ip/ppes/admin/adminchangepicture.php...

CVE-2026-20435: Insufficiently Protected Credentials

In preloader, there is a possible read of device unique identifiers due to a logic error. This could lead to local information disclosure, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID:...

CVE-2026-0017: Improper Authorization

In onChange of BiometricService.java, there is a possible way to enable fingerprint unlock due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0031: Integer Overflow or Wraparound

In multiple functions of memprotect.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0030: Out-of-bounds Write

In hostcheckpagestaterange of memprotect.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-20427: Out-of-bounds Write

In display, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10320471; Issue ID: MSV-5537...

CVE-2025-48645: Improper Privilege Management

In loadDescription of DeviceAdminInfo.java, there is a possible persistent package due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-26704: Improper Neutralization of Special Elements used in an SQL Command

sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/viewcategory.php...

CVE-2025-59600: Buffer Over-read

Memory Corruption when adding user-supplied data without checking available buffer space...

CVE-2026-20439: Use After Free

In imgsys, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10431955; Issue ID: MSV-5826...

CVE-2025-32313: Out-of-bounds Write

In UsageEvents of UsageEvents.java, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-47376: Use After Free

Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls...

CVE-2025-47371: Reachable Assertion

Transient DOS when an LTE RLC packet with invalid TB is received by UE...

CVE-2025-47384: Reachable Assertion

Transient DOS when MAC configures config id greater than supported maximum value...

CVE-2025-47383: Missing Cryptographic Step

Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE...

CVE-2026-20425: Out-of-bounds Write

In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10320471; Issue ID: MSV-5539...

CVE-2025-48650: Improper Neutralization of Special Elements used in an SQL Command

In multiple locations, there is a possible information disclosure due to SQL injection. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48582: Improper Link Resolution Before File Access

In multiple locations, there is a possible way to delete media without the MANAGEEXTERNALSTORAGE permission due to an intent redirect. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48644: Improper Input Validation

In multiple locations, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...