CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 08:42 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-21111 | LI libsthmbc Samsung Mobile | 6.9 | Sep 9 | Out-of-bounds write in libsthmbc.so prior to One UI 8.5 allows local attackers to write out-of-bounds memory |
| CVE-2026-21110 | LI libsavscmn.so Samsung Mobile | 6.9 | Sep 9 | Out-of-bounds write in libsavscmn.so prior to One UI 8.5 allows local attackers to execute arbitrary code |
| CVE-2026-21108 | BT Bixby Touch Samsung Mobile | 5.5 | Sep 9 | Improper export of android application components in Bixby Touch prior to version 4.3.01.17 allows local attackers to access sensitive information |
| CVE-2026-21107 | SN Samsung Notes Samsung Mobile | 5.5 | Sep 9 | Out-of-bounds write in Samsung Notes prior to version 4.4.45.5 allows local attackers to write out-of-bounds memory |
| CVE-2026-21106 | SC Samsung Cloud Assistant Samsung Mobile | 5.1 | Sep 9 | Improper verification of intent by broadcast receiver in Samsung Cloud Assistant prior to version 9.0.5 allows local attackers to disable enhanced data protection settings |
| CVE-2026-21105 | CO Collection Samsung Mobile | 5.5 | Sep 9 | Improper access control in Collection prior to version 1.0.1.14 in Android 15 and 2.0.02.7 in Android 16 allows local attackers to access sensitive information |
| CVE-2026-21104 | SM Samsung Mobile Devices Samsung Mobile | 6.7 | Sep 9 | Heap-based buffer overflow in KnoxVault trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code |
| CVE-2026-21103 | SM Samsung Mobile Devices Samsung Mobile | 6.1 | Sep 9 | Path traversal in GalaxyDiagnostics prior to SMR Sep-2026 Release 1 allows physical attackers to access files with system privilege |
| CVE-2026-21102 | SM Samsung Mobile Devices Samsung Mobile | 6.7 | Sep 9 | Use after free in DualDAR prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code with root privilege |
| CVE-2026-21101 | SM Samsung Mobile Devices Samsung Mobile | 6.7 | Sep 9 | Improper input validation in DualDAR driver prior to SMR Sep-2026 Release 1 allows local privileged attackers to potentially execute arbitrary code with root privilege |
| CVE-2026-21099 | SM Samsung Mobile Devices Samsung Mobile | 5.5 | Sep 9 | Improper access control in SettingsProvider prior to SMR Sep-2026 Release 1 allows local attackers to access sensitive information |
| CVE-2026-21098 | SM Samsung Mobile Devices Samsung Mobile | 6.1 | Sep 9 | Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allows local attackers to establish a connection with the PC without proper user interaction |
| CVE-2026-21097 | SM Samsung Mobile Devices Samsung Mobile | 6.7 | Sep 9 | Improper authentication in ActivityTaskManagerService prior to SMR Sep-2026 Release 1 allows local privileged attackers to launch arbitrary activity |
| CVE-2026-21093 | SM Samsung Mobile Devices Samsung Mobile | 6.7 | Sep 9 | Stack-based buffer overflow in PROCA trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to write out-of-bounds memory |
| CVE-2026-21092 | SM Samsung Mobile Devices Samsung Mobile | 5.3 | Sep 9 | Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to create image files with system server privilege |
| CVE-2026-21085 | SM Samsung Mobile Devices Samsung Mobile | 6.7 | Sep 9 | Out-of-bounds write in Keymaster trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to write out-of-bounds memory |
| CVE-2026-11821 | EE Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce arraytics | 5.4 | Sep 9 | Eventin <= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpoint |
| CVE-2026-19945 | WC WP Crowdfunding themeum | 6.4 | Sep 9 | WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter |
| CVE-2026-87737 | MI mirage-crypto-ec OCaml | 5.9 | Sep 9 | An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml |
| CVE-2026-87736 | MI mirage-crypto-ec OCaml | 4.3 | Sep 9 | An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml |
| CVE-2026-87735 | MI mirage-crypto-pk OCaml | 4.3 | Sep 9 | An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml |
| CVE-2026-87733 | MI mirage-crypto-ec OCaml | 6.2 | Sep 9 | An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml |
| CVE-2026-87732 | MI mirage-crypto OCaml | 6.2 | Sep 9 | An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml |
| CVE-2026-49313 | HA HarmonyOS Huawei | 5.5 | Sep 9 | Permission control vulnerability in the app lock module |
| CVE-2026-49309 | EM EMUI Huawei | 4.8 | Sep 9 | Permission control vulnerability in the Settings module |
| CVE-2026-41987 | EM EMUI Huawei | 6.2 | Sep 9 | Permission control vulnerability in the app management module |
| CVE-2026-81647 | HA HarmonyOS Huawei | 5.3 | Sep 9 | Out-of-bounds read vulnerability in the graphics module |
| CVE-2026-81646 | HA HarmonyOS Huawei | 5.9 | Sep 9 | Out-of-bounds read vulnerability in the graphics module |
| CVE-2026-75966 | PP Podlove Podcast Publisher eteubert | 6.4 | Sep 9 | Podlove Podcast Publisher <= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter |
| CVE-2026-11363 | NF Ninja Forms – The Contact Form Builder That Grows With You kstover | 6.6 | Sep 9 | Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import |
| CVE-2026-19944 | WC WP Crowdfunding themeum | 4.9 | Sep 9 | WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta |
| CVE-2026-19800 | MM Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails getwpfunnels | 4.9 | Sep 9 | Mail Mint <= 1.31.0 - Authenticated (Custom+) SQL Injection via 'status' Parameter |
| CVE-2026-19797 | UA User Access Manager gm_alex | 6.1 | Sep 9 | User Access Manager <= 2.3.18 - Reflected Cross-Site Scripting via 'tab_group_section' Parameter |
| CVE-2026-77187 | MC My Calendar – Accessible Event Manager joedolson | 6.4 | Sep 9 | My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes |
| CVE-2026-77186 | MC My Calendar – Accessible Event Manager joedolson | 6.4 | Sep 9 | My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute |
| CVE-2026-7804 | PF Product Filter for WooCommerce by WBW woobewoo | 6.1 | Sep 9 | Product Filter for WooCommerce by WBW <= 3.4.2 - Reflected Cross-Site Scripting via 'wpf_fid' Parameter |
| CVE-2026-81644 | HA HarmonyOS Huawei | 4.3 | Sep 9 | DoS vulnerability in the preview service module |
| CVE-2026-49312 | HA HarmonyOS Huawei | 4.0 | Sep 9 | Permission control vulnerability in the window module |
| CVE-2026-49311 | HA HarmonyOS Huawei | 6.2 | Sep 9 | Permission control vulnerability in the event notification module.Impact: Successful exploitation of this vulnerability may affect availability |
| CVE-2026-13709 | GC Graphina – Charts and Graphs For Elementor iqonicdesign | 6.4 | Sep 9 | Graphina <= 3.1.11 - Authenticated (Author+) Stored Cross-Site Scripting via 'iq_tree_tree_chart_template' Widget Setting |
| CVE-2026-12956 | EE Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce arraytics | 5.3 | Sep 9 | Eventin <= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via 'status' Parameter |
| CVE-2026-87048 | CO Comply Tanium | 5.4 | Sep 9 | Tanium addressed an improper access controls vulnerability in Comply. |
| CVE-2026-87073 | CO Comply Tanium | 6.5 | Sep 9 | Tanium addressed an improper access controls vulnerability in Comply. |
| CVE-2026-87032 | TS Tanium Server Tanium | 4.3 | Sep 9 | Tanium addressed an information disclosure vulnerability in Tanium Server. |
| CVE-2026-87035 | CO Comply Tanium | 4.3 | Sep 9 | Tanium addressed an information disclosure vulnerability in Comply. |
| CVE-2026-87033 | CO Comply Tanium | 5.4 | Sep 9 | Tanium addressed an improper access controls vulnerability in Comply. |
| CVE-2026-14892 | TS Tanium Server Tanium | 4.3 | Sep 9 | Tanium addressed an improper access controls vulnerability in Tanium Server. |
| CVE-2026-87046 | CO Comply Tanium | 4.3 | Sep 9 | Tanium addressed an improper access controls vulnerability in Comply. |
| CVE-2026-87025 | CO Comply Tanium | 5.4 | Sep 9 | Tanium addressed an improper access controls vulnerability in Comply. |
| CVE-2026-87047 | CO Comply Tanium | 6.3 | Sep 9 | Tanium addressed an improper access controls vulnerability in Comply. |