Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,747 results · page 10 of 75
Jun 4, 2026Memory allocation with excessive size value vulnerability in Samsung Open Source rlottie allows Excessive Allocation.CVE-2026-47319 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 6.1
Memory allocation with excessive size value vulnerability in Samsung Open Source rlottie allows Excessive Allocation. This issue affects rlottie: before 0b4e308fa88c72cbb60cc8a2c1d2c2ad89b101dd.
- Product
- rlottie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2026Stack-based buffer overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers.CVE-2026-47318 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 6.1
Stack-based buffer overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers. This issue affects rlottie: before ce72b35a7ad0dded03051d3aa0ef75321c3bd035.
- Product
- rlottie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2026Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Oversized Serialized Data Payloads.CVE-2026-47306 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 6.1
Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Oversized Serialized Data Payloads. This issue affects rlottie: before e2d19e3b150e0e4a9586fa90b56fd3061cc98945.
- Product
- rlottie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2026Out-of-bounds read vulnerability in Samsung Open Source rlottie allows Overread Buffers.CVE-2026-10305 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 6.1
Out-of-bounds read vulnerability in Samsung Open Source rlottie allows Overread Buffers. This issue affects rlottie: before 223a2a41ba4f462e4abe767bebba49a366c9b9fd.
- Product
- rlottie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2026ProjectsAndPrograms school-management-system uses predictable credentials by generating student's and teacher's passwords solely from the user’s date of birth (CVE-2026-47325 · Other software · ProjectsAndPrograms · reported by cvd@cert.plMedium 6.9
ProjectsAndPrograms school-management-system uses predictable credentials by generating student's and teacher's passwords solely from the user’s date of birth (e.g., 12072000 for 12 July 2000). The application does not require or prompt users to change the password upon first login. This behavior allows attackers to easily guess or derive valid credentials, leading to unauthorized account access. The maintainers were notified early about this vulnerability but did not provide details regarding affected versions. The version corresponding to commit 6b6fae5 was tested and confirmed vulnerable; other versions were not tested and may also be affected.
- Product
- school-management-system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2026ProjectsAndPrograms school-management-system is vulnerable to Stored Cross‑Site Scripting (XSS) in multiple attributes of students and teachers objects.CVE-2026-47324 · Other software · ProjectsAndPrograms · reported by cvd@cert.plMedium 5.1
ProjectsAndPrograms school-management-system is vulnerable to Stored Cross‑Site Scripting (XSS) in multiple attributes of students and teachers objects. An authorized attacker (e.g., a teacher or administrator) can inject malicious JavaScript that is subsequently executed in other users’ browsers. Critically, when chained with CVE‑2025‑11661, which allows unauthenticated access to backend endpoints, this vulnerability can be exploited by a remote attacker without privileges to inject and execute arbitrary JavaScript. The maintainers were notified early about this vulnerability but did not provide details regarding affected versions. The version corresponding to commit 6b6fae5 was tested and confirmed vulnerable; other versions were not tested and may also be affected.
- Product
- school-management-system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026Nanobot prior to version 0.2.1 contains a server-side request forgery vulnerability in the Microsoft Teams channel handler that allows remote attackers to exfilCVE-2026-49139 · Other software · HKUDS · reported by VulnCheckHigh 7
Nanobot prior to version 0.2.1 contains a server-side request forgery vulnerability in the Microsoft Teams channel handler that allows remote attackers to exfiltrate Bot Framework bearer tokens by supplying a forged activity with an attacker-controlled serviceUrl value. Attackers can poison the stored conversation reference by sending a crafted inbound activity to the Teams webhook, causing subsequent bot replies to transmit token-bearing Authorization header requests to an attacker-controlled host.
- Product
- nanobot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026Use of hard-coded credentials in KS-SOMED allowed an unauthorized attacker access to FTP server that hosted the application's update packages.CVE-2026-42251 · Other software · KAMSOFT · reported by cvd@cert.plHigh 8.7
Use of hard-coded credentials in KS-SOMED allowed an unauthorized attacker access to FTP server that hosted the application's update packages. The attacker with these credentials could upload a malicious update file, which then may have been distributed and installed on client machines as a legitimate update. This issue affects KS-SOMED with modules: KSPLUPDFTP.exe up to 30.00.00.056 and ANEKSKLIENT.EXE up to 29.00.02.026 Beside removing the hard-coded credentials from the code and changing the update process, access granted by previously exposed credentials was limited to read-only.
- Product
- KS-SOMED
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts.CVE-2026-41159 · Other software · mermaid-js · reported by GitHubMedium 5.3
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, Mermaid's default configuration allows injecting CSS that applies outside of the Mermaid diagram via the fontFamily, themeCSS, and altFontFamily configuration options. The injected CSS exploits stylis's & (scope reference) handling. :not(&) escapes the #mermaid-xxx automatic scoping, applying styles to all page elements. Global at-rules (@font-face, @keyframes, @counter-style) are also injectable as stylis hoists them to top level. This allows page defacement and DOM attribute exfiltration via CSS :has() selectors. This vulnerability is fixed in 10.9.6 and 11.15.0.
- Product
- mermaid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts.CVE-2026-41150 · Other software · mermaid-js · reported by GitHubMedium 5.3
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, there is a denial-of-service attack when rendering gantt charts, if they use the excludes attribute to exclude all dates. mermaid.parse is unaffected, unless you then call the ganttDb.getTasks() (which is called when rendering a diagram). This vulnerability is fixed in 10.9.6 and 11.15.0.
- Product
- mermaid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026In the Linux kernel, the following vulnerability has been resolved: mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() Sashiko noticed an CVE-2026-46190 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.1
In the Linux kernel, the following vulnerability has been resolved: mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() Sashiko noticed an out-of-bounds read [1]. In spi_nor_params_show(), the snor_f_names array is passed to spi_nor_print_flags() using sizeof(snor_f_names). Since snor_f_names is an array of pointers, sizeof() returns the total number of bytes occupied by the pointers (element_count * sizeof(void *)) rather than the element count itself. On 64-bit systems, this makes the passed length 8x larger than intended. Inside spi_nor_print_flags(), the 'names_len' argument is used to bounds-check the 'names' array access. An out-of-bounds read occurs if a flag bit is set that exceeds the array's actual element count but is within the inflated byte-size count. Correct this by using ARRAY_SIZE() to pass the actual number of string pointers in the array.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 28, 2026In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Don't allow pointer operations on unconfigured streams When reporting the pointCVE-2026-46179 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Don't allow pointer operations on unconfigured streams When reporting the pointer for a compressed stream we report the current I/O frame position by dividing the position by the number of channels multiplied by the number of container bytes. These values default to 0 and are only configured as part of setting the stream parameters so this allows a divide by zero to be configured. Validate that they are non zero, returning an error if not
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 27, 2026Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers.CVE-2026-8915 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comHigh 8.8
Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: 36f5fb58366a67b713c02f6fd985e924fcc09e31.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026Anchor is a framework providing several convenient developer tools for writing Solana programs.CVE-2026-45137 · Other software · solana-foundation · reported by GitHubHigh 8.2
Anchor is a framework providing several convenient developer tools for writing Solana programs. From 1.0.0 to before 1.0.2, an logic error causes anchor programs to accept any program id when requiring the system program id, causing false assumptions resulting in potential arbitrary cpi in programs that invoke system program instructions. In the TryFrom<&'a AccountInfo<'a>> implementation for Program<'a, T>, the id of T is compared with Pubkey::default() to check whether anchor should allow any executable account, or a specific account, because when no T is supplied, T defaults to (), which implements Id::id() by returning Pubkey::default(). This results in T = () and T = System (which has Pubkey::default() as the id) having the same behavior, both allow any executable account. Programs built with anchor assume that the anchor runtime verifies passed in programs of type Program<'a, System> are in fact the system program. This false assumption can lead to arbitrary CPI or payment bypassing when programs try making CPI calls to the system program using the passed in system program due to the fact that the attacker can pass in any program instead of the system program. This vulnerabi
- Product
- anchor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026A vulnerability was detected in TeamSpeak 3 Server up to 3.13.7.CVE-2026-4392 · Other software · reported by VulDBMedium 6.9
A vulnerability was detected in TeamSpeak 3 Server up to 3.13.7. This issue affects some unknown processing of the component clientek Handshake Handler. Performing a manipulation of the argument proof results in reachable assertion. Remote exploitation of the attack is possible. Upgrading to version 3.13.8 is capable of addressing this issue. Upgrading the affected component is recommended.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfiles.teamspeak-services.commodzero.com
May 27, 2026A security vulnerability has been detected in TeamSpeak 3 Server up to 3.13.7.CVE-2026-4391 · Other software · reported by VulDBMedium 6.9
A security vulnerability has been detected in TeamSpeak 3 Server up to 3.13.7. This vulnerability affects unknown code of the component ECC Key Parser. Such manipulation leads to heap-based buffer overflow. The attack may be launched remotely. Upgrading to version 3.13.8 is able to resolve this issue. It is suggested to upgrade the affected component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfiles.teamspeak-services.commodzero.com
May 27, 2026A weakness has been identified in TeamSpeak 3 Server up to 3.13.7.CVE-2026-4390 · Other software · reported by VulDBMedium 5.3
A weakness has been identified in TeamSpeak 3 Server up to 3.13.7. This affects the function process_resend_queue of the component Connection State Management. This manipulation causes use after free. The attack may be initiated remotely. Upgrading to version 3.13.8 is able to mitigate this issue. The affected component should be upgraded.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfiles.teamspeak-services.commodzero.com
May 27, 2026Streamlink is a CLI utility which pipes video streams from various services into a video player.CVE-2026-44353 · Other software · streamlink · reported by GitHubMedium 6.5
Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.4.0, Streamlink's HLS and DASH parsers do not validate the URI scheme of segment entries and other resources. A remote .m3u8 HLS playlist or .mpd DASH manifest can list file:///path/to/file as a segment, and streamlink will read that local file and write its contents to the output stream. This vulnerability is fixed in 8.4.0.
- Product
- streamlink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts.CVE-2026-41149 · Other software · mermaid-js · reported by GitHubMedium 5.3
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Versions 10.9.5 and earlier, as well as 11.0.0-alpha.1 through 11.14.0, are vulnerable to HTML injection under the default configuration. Specifically, the classDef directive in Mermaid state diagrams permits DOM injection that escapes the SVG context. However, <script> tags are stripped, which prevents cross-site scripting (XSS). This issue has been fixed in versions 10.9.6 and 11.15.0. If developers are unable to immediately upgrade, they can work around this issue by setting "securityLevel": "sandbox", which prevents the issue by rendering the mermaid diagram in a sandboxed <iframe>.
- Product
- mermaid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts.CVE-2026-41148 · Other software · mermaid-js · reported by GitHubMedium 5.3
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Versions 10.9.5 and prior, in addition to 11.0.0-alpha.1 through 11.12.0 are vulnerable to CSS injection through improper sanitization. The state diagram (and any other diagram type that routes user-controlled style strings through the createCssStyles parser) captures classDef values using an unrestricted regex that matches everything up to a newline. That value then flows unsanitized through addStyleClass() into createCssStyles() and is assigned to style.innerHTML, so a closing brace (}) in the value terminates the generated CSS selector and turns everything after it into a new CSS rule on the page. This enables page defacement, user tracking via url() callbacks, and DOM attribute exfiltration. This issue has been fixed in versions 10.9.6 and 11.15.0. If developers are unable to immediately upgrade, they can work around this issue by setting "securityLevel": "sandbox", which prevents the issue by rendering the mermaid diagram in a sandboxed <iframe>.
- Product
- mermaid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026Uncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Excessive Allocation.CVE-2026-47317 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 5.5
Uncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Excessive Allocation. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026Improper Check or Handling of Exceptional Conditions vulnerability in Samsung Open Source Escargot allows Input Data Manipulation.CVE-2026-47316 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 5.5
Improper Check or Handling of Exceptional Conditions vulnerability in Samsung Open Source Escargot allows Input Data Manipulation. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026Improper Check for Unusual or Exceptional Conditions vulnerability in Samsung Open Source Escargot allows Input Data Manipulation.CVE-2026-47315 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 5.5
Improper Check for Unusual or Exceptional Conditions vulnerability in Samsung Open Source Escargot allows Input Data Manipulation. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers.CVE-2026-47314 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comHigh 7.8
Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026Memory allocation with excessive size value vulnerability in Samsung Open Source Escargot allows Excessive Allocation.CVE-2026-47313 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 5.5
Memory allocation with excessive size value vulnerability in Samsung Open Source Escargot allows Excessive Allocation. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026Release of invalid pointer or reference vulnerability in Samsung Open Source Escargot allows Buffer Manipulation.CVE-2026-47312 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 5.5
Release of invalid pointer or reference vulnerability in Samsung Open Source Escargot allows Buffer Manipulation. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers.CVE-2026-47311 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comHigh 7.8
Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026Use after free vulnerability in Samsung Open Source Escargot allows Pointer Manipulation.CVE-2026-47310 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comHigh 7.8
Use after free vulnerability in Samsung Open Source Escargot allows Pointer Manipulation. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026Uncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Oversized Serialized Data Payloads.CVE-2026-47309 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 5.5
Uncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Oversized Serialized Data Payloads. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026NULL pointer dereference vulnerability in Samsung Open Source Walrus allows Pointer Manipulation.CVE-2026-47308 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 5.5
NULL pointer dereference vulnerability in Samsung Open Source Walrus allows Pointer Manipulation. This issue affects Walrus: f339b8ee4ea701772e8ae640b3d1b12ac02b1ae9.
- Product
- Walrus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026NULL pointer dereference vulnerability in Samsung Open Source Walrus allows an attacker to cause a denial of service via a crafted WebAssembly module containingCVE-2026-47307 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 5.5
NULL pointer dereference vulnerability in Samsung Open Source Walrus allows an attacker to cause a denial of service via a crafted WebAssembly module containing deeply nested instructions. This issue affects Walrus: f339b8ee4ea701772e8ae640b3d1b12ac02b1ae9.
- Product
- Walrus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026Improper privilege management in Samsung System Support Service prior to version 8.0.8.0 allows local attackers to trigger privileged functions.CVE-2026-21024 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.3
Improper privilege management in Samsung System Support Service prior to version 8.0.8.0 allows local attackers to trigger privileged functions.
- Product
- Samsung System Support Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
May 13, 2026Improper handling of insufficient permissions in Routines prior to SMR May-2026 Release 1 allows local attackers to access sensitive information.CVE-2026-21022 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.9
Improper handling of insufficient permissions in Routines prior to SMR May-2026 Release 1 allows local attackers to access sensitive information.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
May 13, 2026Improper input validation in Routines prior to SMR May-2026 Release 1 allows physical attackers to launch privileged activity.CVE-2026-21021 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.1
Improper input validation in Routines prior to SMR May-2026 Release 1 allows physical attackers to launch privileged activity.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
May 13, 2026Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged functions.CVE-2026-21020 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.1
Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged functions.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
May 13, 2026Improper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release 1 allows local attacker to execute arbitrary code with system privilegeCVE-2026-21019 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 8.6
Improper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release 1 allows local attacker to execute arbitrary code with system privilege.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
May 13, 2026Out-of-bounds write in SveService prior to SMR May-2026 Release 1 allows local privileged attackers to execute arbitrary code.CVE-2026-21018 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.8
Out-of-bounds write in SveService prior to SMR May-2026 Release 1 allows local privileged attackers to execute arbitrary code.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
May 13, 2026Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local attackers to access sensitive information.CVE-2026-21016 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.1
Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local attackers to access sensitive information.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
May 13, 2026Incorrect default permissions in FactoryCamera prior to SMR May-2026 Release 1 allows local attacker to access unique identifier.CVE-2026-21015 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.8
Incorrect default permissions in FactoryCamera prior to SMR May-2026 Release 1 allows local attacker to access unique identifier.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
May 12, 2026Kyverno is a policy engine designed for cloud native platform engineering teams.CVE-2026-44245 · Other software · kyverno · reported by GitHubMedium 6.1
Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to 2.5.2, Vue 3's v-html directive is the framework-documented mechanism for injecting raw HTML, and it intentionally disables the auto-escaping that {{ }} interpolation provides. The PropertyCard.vue component uses v-html for the else branch of the URL check, meaning any non-URL string value flows directly into the DOM as HTML. The isURL() guard only filters values that parse as http: or https: URLs, so any HTML payload not starting with those schemes bypasses it entirely. The data originates from Kubernetes PolicyReport .results[].properties fields, which are arbitrary string maps populated by policy engines and potentially by any principal with write access to PolicyReport objects in the cluster. This vulnerability is fixed in 2.5.2.
- Product
- kyverno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Files or directories accessible to external parties in Microsoft Teams allows an unauthorized attacker to perform spoofing locally.CVE-2026-32185 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.5
Files or directories accessible to external parties in Microsoft Teams allows an unauthorized attacker to perform spoofing locally.
- Product
- Microsoft Teams for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026People is an application to handle users and teams, and distribute permissions across La Suite.CVE-2026-42185 · Other software · suitenumerique · reported by GitHubMedium 5.5
People is an application to handle users and teams, and distribute permissions across La Suite. Prior to version 1.25.0, a user holding the Administrator role on a mail domain could send a crafted invitation request to promote any existing user (including users with no current domain access) to the Owner role. The exploit requires a single authenticated HTTP request and grants full domain ownership immediately, without any acceptance step from the target. This issue has been patched in version 1.25.0.
- Product
- people
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026Scoold is a Q&A and a knowledge sharing platform for teams.CVE-2026-42176 · Other software · Erudika · reported by GitHubMedium 6.7
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to version 1.67.0, Scoold allows the admins configuration value to be modified through /api/config/set/admins with a forged Bearer token that is accepted as an admin API token. Once that setting is changed, the target email address is written to the application configuration file. The change does not become active immediately in the current process, because the ADMINS set is loaded once at startup. After a Scoold restart, though, the selected user is recognized as an administrator and gains access to the admin panel. This issue gives an attacker a reliable persistence path: write their own email into scoold.admins, wait for a restart or trigger one operationally, and the account comes back as admin. This issue has been patched in version 1.67.0.
- Product
- scoold
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ XDP multi-buf programs can CVE-2026-43465 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ XDP multi-buf programs can modify the layout of the XDP buffer when the program calls bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The referenced commit in the fixes tag corrected the assumption in the mlx5 driver that the XDP buffer layout doesn't change during a program execution. However, this fix introduced another issue: the dropped fragments still need to be counted on the driver side to avoid page fragment reference counting issues. The issue was discovered by the drivers/net/xdp.py selftest, more specifically the test_xdp_native_tx_mb: - The mlx5 driver allocates a page_pool page and initializes it with a frag counter of 64 (pp_ref_count=64) and the internal frag counter to 0. - The test sends one packet with no payload. - On RX (mlx5e_skb_from_cqe_mpwrq_nonlinear()), mlx5 configures the XDP buffer with the packet data starting in the first fragment which is the page mentioned above. - The XDP program runs and calls bpf_xdp_pull_data() which moves the header into the linear part of the XDP buffer. As the packet doesn't contain mo
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 8, 2026In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ XDP multi-buf programs can moCVE-2026-43464 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.5
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ XDP multi-buf programs can modify the layout of the XDP buffer when the program calls bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The referenced commit in the fixes tag corrected the assumption in the mlx5 driver that the XDP buffer layout doesn't change during a program execution. However, this fix introduced another issue: the dropped fragments still need to be counted on the driver side to avoid page fragment reference counting issues. Such issue can be observed with the test_xdp_native_adjst_tail_shrnk_data selftest when using a payload of 3600 and shrinking by 256 bytes (an upcoming selftest patch): the last fragment gets released by the XDP code but doesn't get tracked by the driver. This results in a negative pp_ref_count during page release and the following splat: WARNING: include/net/page_pool/helpers.h:297 at mlx5e_page_release_fragmented.isra.0+0x4a/0x50 [mlx5_core], CPU#12: ip/3137 Modules linked in: [...] CPU: 12 UID: 0 PID: 3137 Comm: ip Not tainted 6.19.0-rc3+ #12 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 8, 2026In the Linux kernel, the following vulnerability has been resolved: drm/bridge: samsung-dsim: Fix memory leak in error path In samsung_dsim_host_attach(), drmCVE-2026-43397 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: drm/bridge: samsung-dsim: Fix memory leak in error path In samsung_dsim_host_attach(), drm_bridge_add() is called to add the bridge. However, if samsung_dsim_register_te_irq() or pdata->host_ops->attach() fails afterwards, the function returns without removing the bridge, causing a memory leak. Fix this by adding proper error handling with goto labels to ensure drm_bridge_remove() is called in all error paths. Also ensure that samsung_dsim_unregister_te_irq() is called if the attach operation fails after the TE IRQ has been registered. samsung_dsim_unregister_te_irq() function is moved without changes to be before samsung_dsim_host_attach() to avoid forward declaration.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 8, 2026PraisonAI is a multi-agent teams system.CVE-2026-44340 · Other software · MervinPraison · reported by GitHubHigh 8.7
PraisonAI is a multi-agent teams system. Prior to version 4.6.37, the _safe_extractall helper that all recipe pull, recipe publish, and recipe unpack flows route through validates each archive member's name for absolute paths, .. segments, and resolved-path escape — but does not validate member.linkname, does not reject symlink/hardlink members, and calls tar.extractall(dest_dir) without filter="data". A bundle that contains a symlink with a name inside dest_dir but a linkname pointing outside it, followed by a regular file whose path traverses through the just-created symlink, escapes dest_dir and lets the attacker write arbitrary content to an attacker-chosen location on the victim's filesystem. This issue has been patched in version 4.6.37.
- Product
- PraisonAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026PraisonAI is a multi-agent teams system.CVE-2026-44339 · Other software · MervinPraison · reported by GitHubHigh 8.6
PraisonAI is a multi-agent teams system. Prior to praisonai version 4.6.37 and praisonaiagents version 1.6.37, praisonaiagents resolves unresolved tool names against module globals and __main__ after it fails to match the declared tool list and the registry. With the default agent configuration, _perm_allow is None, so undeclared non-dangerous tool names are not rejected by the permission gate. An attacker who can influence tool-call names can therefore invoke unintended application callables that were never declared as tools. This issue has been patched in praisonai version 4.6.37 and praisonaiagents version 1.6.37.
- Product
- PraisonAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026PraisonAI is a multi-agent teams system.CVE-2026-44338 · Other software · MervinPraison · reported by GitHubHigh 7.3
PraisonAI is a multi-agent teams system. From version 2.5.6 to before version 4.6.34, PraisonAI ships a legacy Flask API server with authentication disabled by default. When that server is used, any caller that can reach it can access /agents and trigger the configured agents.yaml workflow through /chat without providing a token. This issue has been patched in version 4.6.34.
- Product
- PraisonAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026PraisonAI is a multi-agent teams system.CVE-2026-44337 · Other software · MervinPraison · reported by GitHubMedium 6.3
PraisonAI is a multi-agent teams system. From version 2.4.1 to before version 4.6.34, PraisonAI exposes optional SQL/CQL-backed knowledge-store implementations that build table and index identifiers from unvalidated name and collection arguments. Applications that pass untrusted collection names into these backends can trigger SQL or CQL injection. This issue has been patched in version 4.6.34.
- Product
- PraisonAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.