Pharmacy Sales and Inventory System: Improper Access Control Vulnerability (CNVD-2026-37990)

The Pharmacy Sales and Inventory System is a pharmacy sales and inventory management system developed by SourceCodester Corporation. The Pharmacy Sales and Inventory System has a vulnerability related to improper access control. This vulnerability stems from the SellStatement function in the file...

PT-2026-46915

Incorrect privilege assignment in Telephony prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information...

CVE-2026-21028: Undefined Security Weakness

Improper access control in AuditLogService prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information...

RIELLO UPS NetMan 访问控制错误漏洞

RIELLO UPS NetMan is a network adapter developed by the Italian company RIELLO UPS. The RIELLO UPS NetMan 204 has a vulnerability related to access control. This vulnerability arises from the lack of authentication for management pages and command endpoints. Unauthenticated remote attackers can...

PT-2026-46916

Improper export of android application components in SpriteWallpaper prior to SMR Jun-2026 Release 1 allows local attackers to access to sensitive information...

PT-2026-46918

Improper access control in AuditLogService prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information...

ROS-20260605-73-0054

The vulnerabilities of Mozilla Firefox, Firefox ESR, and the email client Thunderbird are related to the use of memory after it is freed. Exploiting these vulnerabilities can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information...

CVE-2026-21036: Undefined Security Weakness

Improper authorization in Samsung Internet prior to version 30.0.0.39 allows local attackers to access sensitive information...

CVE-2026-21026: Undefined Security Weakness

Improper export of android application components in SpriteWallpaper prior to SMR Jun-2026 Release 1 allows local attackers to access to sensitive information...

CVE-2026-47655

Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose information over a network...

CVE-2026-10993

Heap buffer overflow in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-11238

Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension. Chromium security severity: Low...

CVE-2026-11196

Type Confusion in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted XML file. Chromium security severity: Medium...

CVE-2026-11140

Google Chrome and Microsoft Edge (Chromium-based) are vulnerable to an out-of-bounds read in Chromecast due to insufficient validation of input data. A remote attacker who has already compromised the renderer process can use a crafted HTML page to extract potentially sensitive information from th...

CVE-2026-11096

Google Chrome and Microsoft Edge (Chromium-based) are vulnerable to an out-of-bounds read in the WebRTC component. This flaw allows a remote attacker to obtain potentially sensitive information from process memory by visiting a crafted HTML page . Affected versions include all Chrome releases pri...

CVE-2026-11067

The Dawn component in Google Chrome and Microsoft Edge is vulnerable to an uninitialized use issue in versions prior to 149.0.7827.53 . This flaw occurs due to errors during the initialization of variables, which could allow a remote attacker to obtain sensitive information from process memory by...

CVE-2026-42539

IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 return sensitive data to the user which are not required for the client’s operation. Version 2.4.28 contains a patch...

CVE-2026-11322

Hermes WebUI prior to v0.51.221 contains a path traversal vulnerability that allows attackers to escape the workspace boundary by supplying symlinks that resolve to files or directories outside the designated workspace root. Attackers can exploit the workspace file and listing APIs, which resolve...

CVE-2026-47655

Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose information over a network...

CVE-2026-11322 Hermes WebUI before 0.51.221 Path Traversal via Symlink Workspace Bypass

Hermes WebUI prior to v0.51.221 contains a path traversal vulnerability that allows attackers to escape the workspace boundary by supplying symlinks that resolve to files or directories outside the designated workspace root. Attackers can exploit the workspace file and listing APIs, which resolve...