android712-blueborne

android712-blueborne Android Blueborne RCE CVE-2017-0781 2017年11月，一家名为Armis的公司发布了一个概念验证（PoC），展示了通过蓝牙在Android上实现远程代码执行的漏洞（CVE-2017-0781），称为BlueBorne。尽管BlueBorne指的是一组8个漏洞，但本文中的PoC仅使用了其中的2个来实现目标。 BlueBorne仅要求设备的蓝牙连接处于活动状态。不需要用户操作，甚至不需要设备配对。黑客只需要在设备的蓝牙范围内即可接管设备。...

EUVD-2026-72867

Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser the users/activate-user action. While the action requires the administrateUsers permission, it does not call requireAdmin when the targeted user is an administrator, unlike the...

CVE-2026-86731

Craft CMS versions 5.0.0-RC1 through 5.10.11 contain a permission escalation flaw in UsersController::actionActivateUser (the users/activate-user action). The action requires the administrateUsers permission but fails to call requireAdmin() when the targeted user is an administrator, unlike the s...

CVE-2026-86731 Craft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersController

Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser the users/activate-user action. While the action requires the administrateUsers permission, it does not call requireAdmin when the targeted user is an administrator, unlike the...

Astra Linux – Vulnerability in unrar-nonfree

RARLAB WinRAR Recovery Volume: Improper validation of array index leads to remote code execution vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability, as the targe...

CVE-2026-21061

Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access SIM related functions. User interaction is required for triggering this vulnerability...

EUVD-2026-52514

Adobe Campaign Classic ACC is affected by a Violation of Secure Design Principles vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require...

CVE-2026-20486

In imgsensor, there is a possible application crash due to incorrect error handling. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11012302; Issue ID: MSV-7833...

CVE-2026-20464

In hevc decoder, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11104718; Issue ID: MSV-8297...

CVE-2026-48353

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user...

CVE-2026-48308 Premiere Pro | Improper Input Validation (CWE-20)

Premiere Pro is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploit depends on conditions beyond the attacker's control...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the inline parameter in the file download process. An attacker can execute arbitrary scripts in the context of the application's web origin by uploading a crafted HTML file and convincing a victim to open a...

EUVD-2026-40873

In Modem, there is a possible information disclosure due to improper input validation. This could lead to remote information disclosure, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for...

PT-2026-54452

Name of the Vulnerable Software and Affected Versions Modem affected versions not specified Description Improper input validation in the modem can cause a system crash, leading to a remote denial of service. This occurs if a User Equipment UE connects to a rogue base station controlled by an...

PT-2026-54454

Name of the Vulnerable Software and Affected Versions Modem affected versions not specified Description Improper input validation in the Modem can cause a system crash. This allows a remote denial of service if a User Equipment UE connects to a rogue base station controlled by an attacker. The...

CVE-2026-2050 GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page o...

PT-2026-49821

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Several functions within the RTCP packet decoder lack proper bounds checks, leading to a possible out-of-bounds read. This condition allows for remote informatio...

CVE-2026-2049 GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page o...

Exploit for Integer Overflow or Wraparound in Google Android

CVE-2025-48595 - Android Framework Integer Overflow Vulnerabil...

CVE-2026-48280

Adobe Experience Manager (AEM) is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability in versions 6.5.24, LTS SP1, 2026.04 and earlier. The issue allows an attacker to cause malicious JavaScript to run in a victim’s browser by manipulating the DOM; exploitation requires user interact...