CVE-2026-49305

Technical details about CVE-2026-49305 are not publicly available in the provided documents. Monitor Huawei consumer bulletin updates for further specifics.

CVE-2026-49308

CVE-2026-49308 describes a permission control vulnerability in the clipboard module. According to the records, exploitation is local with low attack complexity and requires user interaction, yielding a CVSS v3.1 base score of 5.5 (Medium) and a confidentiality impact (C) of High, with no impact o...

CVE-2026-49306

CVE-2026-49306 is described as a use-after-free (UAF) vulnerability in the time and time zone module, impacting availability. The available context references Huawei consumer device bulletins (laptops, vision, wearables), with a CVSS v3.1 base score of 3.3 (LOW) and an exploit vector limited to l...

CVE-2026-49304

CVE-2026-49304 describes a permission control vulnerability in the device key management module with an availability impact. The CVSS 3.1 base score is 6.2 (Medium) with LOCAL attack vector, LOW attack complexity, NO privileges required, and NO user interaction; impact is limited to Availability ...

CVE-2026-49302

A vulnerability (CVE-2026-49302) with a permission control issue in the notification service module could affect service confidentiality if exploited locally with low complexity and no user interaction (CVSS 3.1: AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N; base score 6.2). The description does not provi...

CVE-2026-58561

CVE-2026-58561 is a null pointer dereference in the image codec module that can impact availability. The CVSS 3.1 vector (LOCAL, LOW complexity, NO user interaction, NONE privileges, UNCHANGED scope) yields a MEDIUM base score (4.0) with availability impact set to LOW; exploitation appears to req...

CVE-2026-58560

Technical details about CVE-2026-58560 are not publicly available in the provided documents. Monitor for updates from Huawei and the CVE entry for further information.

CVE-2026-49307

CVE-2026-49307 describes a permission control vulnerability in the device’s multi-mode input module, affecting confidentiality. CVSS 3.1 base score 6.2 (MEDIUM); attack vector LOCAL, complexity LOW, privileges NONE, user interaction NONE, scope UNCHANGED, with confidentiality impact HIGH. There a...

CVE-2026-20000

The connected CVE details a SQL injection in itsourcecode Hospital Management System 1.0, impacting the /viewprescriptionrecord.php script via the delid parameter. The vulnerability arises from manipulating delid, allowing remote attacker input to affect database queries. Public exploitation is i...

CVE-2026-19999

Open Asset Import Library Assimp (3DGS MDL7 Bone Transformation Key Parser) is affected. The vulnerability resides in MDLLoader.cpp in Assimp::MDLImporter::ParseBoneTrafoKeys_3DGS_MDL7, where manipulating transmatrix_count/pcBoneTransforms can cause a buffer overflow. It permits remote-based acce...

CVE-2026-19998

The CVE-2026-19998 entry concerns code-projects Online Shopping System 1.0, specifically the offersmail.php file. The vulnerability stems from manipulating the email parameter, enabling cross-site scripting (XSS). The description notes the attack can be performed remotely and that the exploit is ...

CVE-2026-19997

The CVE covers Webkul Bagisto up to 2.4.4, where manipulation of requests to /admin/sales/rma/requests in the Backend Sales RMA Endpoint can bypass authorization. It is a remote issue, with public exploit availability noted. The vendor states issues were identified in internal security processes ...

CVE-2026-19996

CVE-2026-19996 affects Webkul Bagisto (up to 2.4.4). The vulnerability resides in the Backend Customer Behavior Data Endpoint, specifically the /admin/customers area, where manipulation of the ID argument leads to improper privilege management. It can be exploited remotely; a public exploit exist...

CVE-2026-19995

Webkul Bagisto (up to 2.4.4) is affected in the RMA Message Handler, specifically the /customer/account/rma/send-message path. The vulnerability stems from manipulating the Message argument, leading to cross-site scripting. Remote exploitation is possible, and exploits have been publicly disclose...

CVE-2026-15623

CVE-2026-15623 describes an authenticated blind SQL injection in Google Cloud Chronicle SOAR’s legacy dashboard widget API for versions prior to 6.3.85. An authenticated attacker can cause blind SQL queries via a crafted request parameter. The issue is mitigated by the patch in version 6.3.85; no...

CVE-2026-19994

Webkul Bagisto (up to 2.4.4) is affected by a vulnerability in the Configuration Management module. Specifically, manipulating the action parameter in the file /admin/configuration/cache-management/execute can bypass authorization, potentially allowing remote exploitation. Public exploit code exi...

CVE-2026-22072

CVE-2026-22072 involves arbitrary URL loading in WebView, where loading external URLs can permit malicious JavaScript to steal user tokens. The connected document confirms the issue arises from WebView behavior, enabling token leakage with a CVSS v4.0 base score of 8.3 (HIGH), attack vector Netwo...

CVE-2026-14832

The ShopSmart Loyalty for WooCommerce WordPress plugin (≤1.0.0) exposes the shopsmart_check_phone AJAX endpoint without authorization checks, allowing unauthenticated users to retrieve any customer's loyalty profile (name, email, account balance) by supplying a known phone number; CVSS 5.3 MEDIUM...

CVE-2026-13700

The WooMS WordPress plugin (versions through 9.14) fails to validate a user-supplied URL before issuing server-side requests and attaches stored third-party integration credentials to each request. When the data-sync feature is enabled, unauthenticated attackers can perform Server-Side Request Fo...

CVE-2026-19993

Webkul Bagisto (up to 2.4.4) contains a vulnerability in the RMA State Validation flow, specifically the /customer/account/rma/update-status endpoint. An attacker may remotely trigger manipulation of the behavioral workflow via this unknown functionality, with exploitation disclosed publicly. CVS...