CVE-2026-21081: Improper Export of Android Application Components

Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitive information. User interaction is required for triggering this vulnerability...

CVE-2026-21084: Improper Access Control

Improper access control in SmartThings prior to version 1.8.47.24 allows local attackers to access sensitive information...

PT-2026-69404

Name of the Vulnerable Software and Affected Versions Samsung Health versions prior to 7.0.0 Description Incorrect authorization allows local attackers to access sensitive information. Recommendations Update to version 7.0.0 or later...

PT-2026-69411

Name of the Vulnerable Software and Affected Versions Smart Switch versions prior to 3.7.72.6 Description Improper input validation allows adjacent attackers to access sensitive data. Recommendations Update to version 3.7.72.6 or later...

CVE-2026-21083: Improper Input Validation

Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data...

CVE-2026-21082: Relative Path Traversal

Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...

CVE-2026-21075: Improper Authorization in Handler for Custom URL Scheme

Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information...

PT-2026-69861

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6 Discourse versions prior to 2026.5.2 Discourse versions prior to 2026.6.1 Discourse versions prior to 2026.7.0 Description Onebox::DomainChecker.is blocked? performs a case-sensitive comparison between...

CVE-2026-21070: Improper Input Validation

Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access sensitive information...

CVE-2026-72908: Improper Neutralization of Special Elements used in an SQL Command

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the gettaxtemplate function in erpnext/accounts/doctype/taxrule/taxrule.py constructs an SQL WHERE clause from request-influenced postingdate and args values, allowing an authenticated low-privileg...

CVE-2026-19074: Exposure of Sensitive Information to an Unauthorized Actor

The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 = 3.4.2 is vulnerable to unauthenticated sensitive information exposure via the AJAX action acadppubliccustomfieldslistings...

PT-2026-69409

Name of the Vulnerable Software and Affected Versions SamsungPassAutofill versions prior to 5.2.10.x Description Improper export of Android application components allows local attackers to access sensitive information. This issue requires user interaction to be triggered. Recommendations Update...

CVE-2026-6374: Use of Hard-coded Credentials

Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constants Within an Executable. This issue affects WAH7601: through 20.07.2026...

CVE-2026-72721: Improper Handling of Case Sensitivity

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Onebox::DomainChecker.isblocked? compares hostnames and SiteSetting.blockedoneboxdomains entries case-sensitively, allowing an attacker to bypass configured Onebox domain restrictions by changing...

CVE-2026-19363 lmammino oidc-authorizer Lambda Authorizer handler.rs log file

A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is an unknown function of the file src/handler.rs of the component Lambda Authorizer. The manipulation results in sensitive information in log files. The attack can be executed remotely. src/handler.rs logs raw...

CVE-2026-18357

The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or nonce checks in one of its reporting features, allowing unauthenticated attackers to retrieve sensitive order data belonging to any customer of the store, such as billing names, order IDs and statuse...

CVE-2026-18357

The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or nonce checks in one of its reporting features, allowing unauthenticated attackers to retrieve sensitive order data belonging to any customer of the store, such as billing names, order IDs and statuse...

CVE-2026-18032 WP Data Access < 5.5.79 - Unauthenticated Sensitive Data Disclosure via Autocomplete Column Authorization Bypass

The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unauthenticated AJAX actions, and the nonce guarding that action does not cover them, allowing unauthenticated attackers to read arbitrary columns of the database table the affected...

CVE-2026-19363: Insertion of Sensitive Information into Log File

A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is an unknown function of the file src/handler.rs of the component Lambda Authorizer. The manipulation results in sensitive information in log files. The attack can be executed remotely. src/handler.rs logs raw...

CVE-2026-18357: Exposure of Sensitive Information to an Unauthorized Actor

The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or nonce checks in one of its reporting features, allowing unauthenticated attackers to retrieve sensitive order data belonging to any customer of the store, such as billing names, order IDs and statuse...