CVE-2026-21076

Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...

CVE-2026-21075

Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information...

CVE-2026-21070

Technical details about CVE-2026-21070 are not publicly available in the provided documents. Monitor for updates and new disclosures.

PT-2026-69410

Name of the Vulnerable Software and Affected Versions Samsung Health versions prior to 7.0.0 Description A relative path traversal issue exists that allows local attackers to access sensitive information. Path traversal is a flaw that allows an attacker to access files and directories that are...

PT-2026-69409

Name of the Vulnerable Software and Affected Versions SamsungPassAutofill versions prior to 5.2.10.x Description Improper export of Android application components allows local attackers to access sensitive information. This issue requires user interaction to be triggered. Recommendations Update...

CVE-2026-72908: Improper Neutralization of Special Elements used in an SQL Command

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the gettaxtemplate function in erpnext/accounts/doctype/taxrule/taxrule.py constructs an SQL WHERE clause from request-influenced postingdate and args values, allowing an authenticated low-privileg...

CVE-2026-72873: Exposure of Sensitive Information to an Unauthorized Actor

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, application.one in apps/dokploy/server/api/routers/application.ts returns provider relations loaded by findApplicationById in packages/server/src/services/application.ts without redacting githubClientSecret,...

CVE-2026-21084: Improper Access Control

Improper access control in SmartThings prior to version 1.8.47.24 allows local attackers to access sensitive information...

CVE-2026-21082: Relative Path Traversal

Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...

CVE-2026-21077: Incorrect Authorization

Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...

CVE-2026-21070: Improper Input Validation

Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access sensitive information...

CVE-2026-19074: Exposure of Sensitive Information to an Unauthorized Actor

The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 = 3.4.2 is vulnerable to unauthenticated sensitive information exposure via the AJAX action acadppubliccustomfieldslistings...

CVE-2026-21081: Improper Export of Android Application Components

Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitive information. User interaction is required for triggering this vulnerability...

CVE-2026-21076: Incorrect Authorization

Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...

CVE-2026-21075: Improper Authorization in Handler for Custom URL Scheme

Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information...

PT-2026-69404

Name of the Vulnerable Software and Affected Versions Samsung Health versions prior to 7.0.0 Description Incorrect authorization allows local attackers to access sensitive information. Recommendations Update to version 7.0.0 or later...

CVE-2026-19363 lmammino oidc-authorizer Lambda Authorizer handler.rs log file

A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is an unknown function of the file src/handler.rs of the component Lambda Authorizer. The manipulation results in sensitive information in log files. The attack can be executed remotely. src/handler.rs logs raw...

CVE-2026-19363: Insertion of Sensitive Information into Log File

A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is an unknown function of the file src/handler.rs of the component Lambda Authorizer. The manipulation results in sensitive information in log files. The attack can be executed remotely. src/handler.rs logs raw...

CVE-2026-18357: Exposure of Sensitive Information to an Unauthorized Actor

The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or nonce checks in one of its reporting features, allowing unauthenticated attackers to retrieve sensitive order data belonging to any customer of the store, such as billing names, order IDs and statuse...

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere via the REST API error handler returning unsanitized PHP error messages that include the full filesystem path. An attacker can obtain sensitive system path...