🔹 CVE-2026-108787
A vulnerability was found in houtini-ai voice-analyser-mcp up to 2.1.1. The affected element is the function fetch of the file src/utils/crawler.ts of the component collect_corpus. Performing a manipulation of the argument sitemap_url results in server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made pu...
A vulnerability was found in houtini-ai voice-analyser-mcp up to 2.1.1. The affected element is the function fetch of the file src/utils/crawler.ts of the component collect_corpus. Performing a manipulation of the argument sitemap_url results in server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made pu...
🔹 CVE-2026-108786
A vulnerability has been found in houtini-ai seo-crawler-mcp up to 2.1.5. Impacted is the function run_seo_audit of the file src/core/CrawlOrchestrator.ts of the component Crawler. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was...
A vulnerability has been found in houtini-ai seo-crawler-mcp up to 2.1.5. Impacted is the function run_seo_audit of the file src/core/CrawlOrchestrator.ts of the component Crawler. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was...
🔹 CVE-2026-87690
The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22). The module interpolates file names taken from a Meterpreter directory listing — data fully controlled by a hostile or tampered iOS device — directly into the local destination path passed to client.fs.file.dow...
The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22). The module interpolates file names taken from a Meterpreter directory listing — data fully controlled by a hostile or tampered iOS device — directly into the local destination path passed to client.fs.file.dow...
🔹 CVE-2026-21139
Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the connected mobile device.
Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the connected mobile device.
🔹 CVE-2026-21138
Insufficient verification of data authenticity in Smart Switch prior to version 3.7.73 allows physical attackers to install arbitrary applications.
Insufficient verification of data authenticity in Smart Switch prior to version 3.7.73 allows physical attackers to install arbitrary applications.
🔹 CVE-2026-21137
Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege.
Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege.
🔹 CVE-2026-21136
Improper authorization in Smart Switch prior to version 3.7.73 allows physical attackers to invoke application restore process.
Improper authorization in Smart Switch prior to version 3.7.73 allows physical attackers to invoke application restore process.
🔹 CVE-2026-21135
Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information.
Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information.
🔹 CVE-2026-21134
Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sensitive information.
Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sensitive information.
🔹 CVE-2026-21133
Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data.
Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data.
🔹 CVE-2026-21132
Improper input validation in Samsung Internet prior to version 30.0.5.24 allows remote attackers to inject arbitrary script. User interaction is required for triggering this vulnerability.
Improper input validation in Samsung Internet prior to version 30.0.5.24 allows remote attackers to inject arbitrary script. User interaction is required for triggering this vulnerability.
🔹 CVE-2026-21131
Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung Flow privileges on the connected device.
Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung Flow privileges on the connected device.
🔹 CVE-2026-21130
Improper input validation in CreditCardRetrieveActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges.
Improper input validation in CreditCardRetrieveActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges.
🔹 CVE-2026-21129
Improper input validation in GuestCreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges.
Improper input validation in GuestCreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges.
🔹 CVE-2026-21128
Improper input validation in CreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch arbitrary activity with Samsung Checkout privileges.
Improper input validation in CreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch arbitrary activity with Samsung Checkout privileges.
🔹 CVE-2026-21127
Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive data.
Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive data.
🔹 CVE-2026-21126
Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.
Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.
🔹 CVE-2026-21125
Improper input validation in parsing sheifd in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code.
Improper input validation in parsing sheifd in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code.
🔹 CVE-2026-21124
Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code.
Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code.
🔹 CVE-2026-21123
Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to access data of the tied profile in before first unlock.
Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to access data of the tied profile in before first unlock.
🔹 CVE-2026-21122
Out-of-bounds write in libsamsungtts.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code.
Out-of-bounds write in libsamsungtts.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code.