EUVD-2026-55102

Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...

CVE-2026-21077

Samsung Health is affected by CVE-2026-21077 due to incorrect authorization prior to version 7.0.0, allowing local attackers to access sensitive information. Affected software: Samsung Health (versions

CVE-2026-21077

Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...

CVE-2026-21076

Samsung Health prior to version 7.0.0 has an incorrect authorization flaw that could allow local attackers to access sensitive information. Affected product: Samsung Health (pre-7.0.0). Root cause: improper access control enabling local access to data. Reported CVSS v4.0 base score 6.9 (MEDIUM) w...

CVE-2026-21076

Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...

EUVD-2026-55101

Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...

CVE-2026-21076

Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...

CVE-2026-21075

Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information...

CVE-2026-21075

Technical details about CVE-2026-21075 are not publicly available in the provided documents; no affected product versions, root cause, or fixes are disclosed. Monitor for updates.

CVE-2026-21074

Affected software: Samsung Bixby prior to 4.0.86.0. The issue stems from incorrect default permissions, enabling local attackers to execute arbitrary commands with Bixby privilege. Impact is local privilege escalation; attack requires local access with low privileges and no user interaction. The ...

CVE-2026-18030

The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password for any user, including administrators, and take over their...

CVE-2026-17019

The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing malicious JavaScript that executes in the browser of any user w...

CVE-2026-17010

The Saitama Addon Pack WordPress plugin through 1.0.8 does not sanitise and escape certain post metadata values before outputting them, allowing users with contributor-level access and above to inject stored Cross-Site Scripting payloads that execute in the browser of a higher-privileged user who...

CVE-2026-14238

The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing users with administrator-level access to perform SQL injection...

CVE-2026-14293

The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does not escape that value when it is later output on the checkout page, allowing unauthenticated attackers to store JavaScript that executes in the...

Astra Linux – Vulnerability in libheif

libheif is a decoder and encoder for HEIF and AVIF file formats. In versions 1.21.2 and earlier, a crafted 800-byte HEIF sequence file could cause an infinite loop in the Boxstts::getsampleduration function. This loop consumed 100% of the CPU resources indefinitely, with no progress being made,...

Astra Linux – Vulnerability in pyasn1

pyasn1 is a generic ASN.1 library for Python. Prior to version 0.6.2, a Denial-of-Service issue was identified that could lead to memory exhaustion due to malformed RELATIVE-OID values with excessive continuation octets. This vulnerability has been fixed in version 0.6.2...

Astra Linux – Vulnerability in Chromium

In Google Chrome, before version 147.0.7727.55, Race in WebCodecs allowed a remote attacker to obtain potentially sensitive information from process memory through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, there was a heap buffer over-read vulnerability in multiple raw image format handles. This vulnerability occurred when processing images with -extract dimension...