🚨 CVE-2026-21072
Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.
🎖@cveNotify
Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.
🎖@cveNotify
🚨 CVE-2026-21073
Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrary activity.
🎖@cveNotify
Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrary activity.
🎖@cveNotify
🚨 CVE-2026-21074
Incorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute arbitrary commands with Bixby privilege.
🎖@cveNotify
Incorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute arbitrary commands with Bixby privilege.
🎖@cveNotify
🚨 CVE-2026-21075
Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information.
🎖@cveNotify
Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information.
🎖@cveNotify
🚨 CVE-2026-21076
Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.
🎖@cveNotify
Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.
🎖@cveNotify
🚨 CVE-2026-21077
Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.
🎖@cveNotify
Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.
🎖@cveNotify
🚨 CVE-2026-21078
Insufficient verification of data authenticity in Smart Switch trouble scanning mode prior to version 3.7.72.6 allows adjacent attackers to spoof device identity.
🎖@cveNotify
Insufficient verification of data authenticity in Smart Switch trouble scanning mode prior to version 3.7.72.6 allows adjacent attackers to spoof device identity.
🎖@cveNotify
🚨 CVE-2026-21079
Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data.
🎖@cveNotify
Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data.
🎖@cveNotify
🚨 CVE-2026-21080
Cleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.
🎖@cveNotify
Cleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.
🎖@cveNotify
🚨 CVE-2026-21081
Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitive information. User interaction is required for triggering this vulnerability.
🎖@cveNotify
Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitive information. User interaction is required for triggering this vulnerability.
🎖@cveNotify
🚨 CVE-2026-21082
Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.
🎖@cveNotify
Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.
🎖@cveNotify
🚨 CVE-2026-21083
Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.
🎖@cveNotify
Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.
🎖@cveNotify
🚨 CVE-2026-21084
Improper access control in SmartThings prior to version 1.8.47.24 allows local attackers to access sensitive information.
🎖@cveNotify
Improper access control in SmartThings prior to version 1.8.47.24 allows local attackers to access sensitive information.
🎖@cveNotify
🚨 CVE-2026-18503
Attacker-controlled CSV samples can trigger super-linear
regular-expression work during dialect sniffing and consume significant
CPU when applications pass unbounded input to csv.Sniffer.sniff().
🎖@cveNotify
Attacker-controlled CSV samples can trigger super-linear
regular-expression work during dialect sniffing and consume significant
CPU when applications pass unbounded input to csv.Sniffer.sniff().
🎖@cveNotify
GitHub
[3.12] gh-98820: Fix quadratic time in csv.Sniffer for quoted fields … · python/cpython@063d455
…(GH-154867) (#155166)
(cherry picked from commit b30c7fa9edd921a118f286e9f90f560777fa693b)
Co-authored-by: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
(cherry picked from commit b30c7fa9edd921a118f286e9f90f560777fa693b)
Co-authored-by: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
🚨 CVE-2026-12339
A Zip Slip vulnerability in the WebUI ISP
Upgrade functionality allows arbitrary file write via a crafted archive
containing directory traversal sequences. An authenticated administrator may
overwrite arbitrary files on the system.Successful
exploitation may allow arbitrary file to overwrite on the underlying system, affecting system integrity and availability.
🎖@cveNotify
A Zip Slip vulnerability in the WebUI ISP
Upgrade functionality allows arbitrary file write via a crafted archive
containing directory traversal sequences. An authenticated administrator may
overwrite arbitrary files on the system.Successful
exploitation may allow arbitrary file to overwrite on the underlying system, affecting system integrity and availability.
🎖@cveNotify
TP-Link
Download for Archer MR200 | TP-Link
TP Link - Download Center Detail
🚨 CVE-2025-30237
The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication
checks are not consistently enforced on certain endpoints. An attacker can send
specially crafted requests to bypass authentication and directly invoke
privileged functionality without valid credentials. This issue arises from
improper enforcement of access control mechanisms on sensitive operations.
Successful
exploitation may allow an unauthenticated attacker to execute privileged
operations and gain full control of the device.
🎖@cveNotify
The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication
checks are not consistently enforced on certain endpoints. An attacker can send
specially crafted requests to bypass authentication and directly invoke
privileged functionality without valid credentials. This issue arises from
improper enforcement of access control mechanisms on sensitive operations.
Successful
exploitation may allow an unauthenticated attacker to execute privileged
operations and gain full control of the device.
🎖@cveNotify
🚨 CVE-2025-30238
In affected TP-Link Aginet devices, insufficient
authorization validation allows authenticated low-privileged users to execute higher-privileged
operations.
An attacker
may perform administrative actions such as creating privileged accounts or
modifying critical configuration settings.
🎖@cveNotify
In affected TP-Link Aginet devices, insufficient
authorization validation allows authenticated low-privileged users to execute higher-privileged
operations.
An attacker
may perform administrative actions such as creating privileged accounts or
modifying critical configuration settings.
🎖@cveNotify
🚨 CVE-2025-30239
In affected TP-Link Aginet devices, use of
hardcoded cryptographic keys embedded in the firmware to protect sensitive
configuration data may allow an attacker who has access to device storage to
recover the keys and decrypt stored data.
Successful
exploitation may allow access to decrypted sensitive configuration data,
including credentials and service-related information.
🎖@cveNotify
In affected TP-Link Aginet devices, use of
hardcoded cryptographic keys embedded in the firmware to protect sensitive
configuration data may allow an attacker who has access to device storage to
recover the keys and decrypt stored data.
Successful
exploitation may allow access to decrypted sensitive configuration data,
including credentials and service-related information.
🎖@cveNotify
🚨 CVE-2025-30240
The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage
devices. By placing a crafted symbolic link on supported storage media, an
attacker may cause the system to resolve the link.
Successful
exploitation may allow unauthorized read access to sensitive files within the
device filesystem.
🎖@cveNotify
The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage
devices. By placing a crafted symbolic link on supported storage media, an
attacker may cause the system to resolve the link.
Successful
exploitation may allow unauthorized read access to sensitive files within the
device filesystem.
🎖@cveNotify
🚨 CVE-2026-13716
Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.
🎖@cveNotify
Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.
🎖@cveNotify
GitLab
Path traversal in import/admin file upload (`fileName` header) allows arbitrary file write outside the upload sandbox (#727) ·…
Summary The chunked/non-chunked upload handler ApiFilesUploadHandler derives the destination file path by joining a fixed upload directory...
🚨 CVE-2026-19517
Improper Validation of Specified Quantity in Input and Allocation of Resources Without Limits or Throttling vulnerability in Samsung Open Source rlottie allows Excessive Allocation.
🎖@cveNotify
Improper Validation of Specified Quantity in Input and Allocation of Resources Without Limits or Throttling vulnerability in Samsung Open Source rlottie allows Excessive Allocation.
🎖@cveNotify
GitHub
Safety limits to precomp, repeater, and polystar handling by mmaciola · Pull Request #596 · Samsung/rlottie
Introduce bounds to keep resource use predictable on deeply nested or oversized inputs:
Cap precomp nesting depth in repeater processing, render-tree build, and render walk
Cap total render-node c...
Cap precomp nesting depth in repeater processing, render-tree build, and render walk
Cap total render-node c...