CVE-2026-28648

A permission bypass vulnerability exists in Settings due to a confused deputy flaw. This issue allows for local escalation of privilege without requiring additional execution privileges or user interaction. No specific software version, exploit links, or remediation steps are provided in the docu...

CVE-2026-28647

A logic error in the updateState function of DeviceAdminAppsPreferenceController.java allows for a permission bypass . This vulnerability can lead to a local escalation of privilege without requiring additional execution privileges or user interaction. No specific exploit information or remediati...

CVE-2026-28641

A logic error in the shouldDisableUninstallButton method of ApplicationActionButtonsPreferenceController.java allows for a possible permission bypass . This vulnerability could result in a local escalation of privilege without requiring additional execution privileges or user interaction. No spec...

CVE-2026-28640

A permission bypass vulnerability exists in the CredentialStorageActivity.java file, specifically within the checkCallerIsCertInstallerOrSelfInProfile function. The root cause is improper input validation , which could allow for a local escalation of privilege without requiring additional executi...

CVE-2026-28625

A logic error in the code across multiple locations allows for a permission bypass . This vulnerability can lead to a local escalation of privilege without requiring additional execution privileges or user interaction. Exploitation details and specific remediation steps are not provided in the do...

CVE-2026-104714

A race condition vulnerability in Apache Struts allows for improper synchronization when localized messages format date or time arguments. The application-wide text provider retains a formatter for these messages, which is then used by concurrent requests without isolation. This can result in a v...

CVE-2026-104713

The Apache Struts framework is vulnerable to an allocation of resources without limits or throttling (CWE-770) within the REST plugin . The root cause is that a request body is read into memory without any size bounds, allowing a single request to exhaust the Java heap and cause a denial of servi...

CVE-2026-104712

An asymmetric resource consumption (amplification) vulnerability exists in Apache Struts (versions 2.5.14 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0). The flaw occurs when a request parameter is bound to a java.math.BigDecimal property and subsequently rendered via the Struts t...

CVE-2026-104711

Apache Struts is vulnerable to Expression Language Injection (CWE-917) when configured to use the legacy RESTful action mapper . A remote attacker can submit a crafted request to inject an OGNL expression , potentially leading to remote code execution on the host server. This vulnerability affect...

CVE-2026-105642

The Ghost Node.js content management system is vulnerable to Remote Code Execution (RCE) in versions 6.56.0 through 6.67.0 . The root cause is a vulnerability in the SVG handling of an image processing library bundled with the software. A staff user, such as a Contributor , can trigger this by cr...

CVE-2026-105386

The onetwothreeneth HospitalManagementSystem is vulnerable to a remote SQL injection vulnerability in the get function of the print.php file. An attacker can manipulate the transaction_id argument to execute unauthorized SQL commands. The product utilizes a rolling release, so specific affected o...

CVE-2026-58880

A race condition exists in the handle_app_val_response function of btif_rc.cc , potentially allowing for code execution . This vulnerability can lead to a local escalation of privilege without requiring additional execution privileges or user interaction. While the technical root cause is identif...

CVE-2026-58865

A vulnerability exists in multiple functions of PduParser.java due to a missing bounds check . This flaw can lead to a persistent denial of service (DoS) or a remote denial of service without requiring additional execution privileges or user interaction. No specific exploitation details are provi...

CVE-2026-58859

A denial of service vulnerability exists in multiple places due to an uncaught exception (CWE-248). This flaw could potentially lead to a local escalation of privilege without requiring additional execution privileges. No user interaction is necessary for exploitation. Specific product details or...

CVE-2026-58856

A vulnerability exists in the returnOutputBufferLocked function of DeprecatedCamera3StreamSplitter.cpp . This flaw is caused by a missing bounds check , which allows for a possible out-of-bounds read . Such a vulnerability could result in local information disclosure without requiring additional ...

CVE-2026-58854

CVE-2026-58854 identifies a memory corruption vulnerability caused by type confusion in multiple locations. This flaw could enable local escalation of privilege without requiring additional execution privileges or user interaction. No specific software, versions, or remediation details are provid...

CVE-2026-58841

A logic error in multiple functions of VirtualAudioControllerTest.java results in a potential permission bypass . This vulnerability could enable a local escalation of privilege without requiring additional execution privileges or user interaction. No specific remediation or exploit details are p...

CVE-2026-58835

A heap buffer overflow in the cfg2prop function of btif_storage.cc allows for an out-of-bounds write . This vulnerability could lead to remote code execution without requiring additional execution privileges or user interaction. No specific details regarding affected software versions or remediat...

CVE-2026-58834

A vulnerability exists in the setPermissionGrantState method of DevicePolicyManagerService.java , where improper input validation can lead to a persistent local denial of service . This issue does not require additional execution privileges or user interaction for exploitation. No specific remedi...

CVE-2026-58815

The provided documents identify an out of bounds write vulnerability in multiple locations caused by an incorrect bounds check . This flaw could lead to local escalation of privilege without requiring additional execution privileges or user interaction. While the specific affected software or har...