Export limit exceeded: 404479 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (404479 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-48212 | 2026-10-12 | 4.8 Medium | ||
| An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X | ||||
| CVE-2026-48211 | 2026-10-12 | 5.4 Medium | ||
| An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an unauthenticated remote attacker to craft a malicious request that is executed with the privileges of an active administrator session. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected | ||||
| CVE-2026-108809 | 1 Eleveo | 1 Call Recording Software | 2026-10-12 | 3.5 Low |
| A vulnerability was identified in Eleveo Call Recording Software up to 10.3.0. This issue affects some unknown processing of the file /auth/realms/default/protocol/openid-connect/logout. The manipulation leads to session expiration. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-21127 | 2026-10-12 | N/A | ||
| Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive data. | ||||
| CVE-2026-21128 | 2026-10-12 | N/A | ||
| Improper input validation in CreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch arbitrary activity with Samsung Checkout privileges. | ||||
| CVE-2026-21129 | 2026-10-12 | N/A | ||
| Improper input validation in GuestCreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges. | ||||
| CVE-2026-21130 | 2026-10-12 | N/A | ||
| Improper input validation in CreditCardRetrieveActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges. | ||||
| CVE-2026-21132 | 2026-10-12 | N/A | ||
| Improper input validation in Samsung Internet prior to version 30.0.5.24 allows remote attackers to inject arbitrary script. User interaction is required for triggering this vulnerability. | ||||
| CVE-2026-21133 | 2026-10-12 | N/A | ||
| Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data. | ||||
| CVE-2026-21134 | 2026-10-12 | N/A | ||
| Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sensitive information. | ||||
| CVE-2026-21135 | 2026-10-12 | N/A | ||
| Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information. | ||||
| CVE-2026-21136 | 2026-10-12 | N/A | ||
| Improper authorization in Smart Switch prior to version 3.7.73 allows physical attackers to invoke application restore process. | ||||
| CVE-2026-21137 | 2026-10-12 | N/A | ||
| Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege. | ||||
| CVE-2026-21139 | 2026-10-12 | N/A | ||
| Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the connected mobile device. | ||||
| CVE-2026-21122 | 1 Samsung Mobile | 1 Samsung Mobile Devices | 2026-10-12 | N/A |
| Out-of-bounds write in libsamsungtts.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code. | ||||
| CVE-2026-21123 | 1 Samsung Mobile | 1 Samsung Mobile Devices | 2026-10-12 | N/A |
| Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to access data of the tied profile in before first unlock. | ||||
| CVE-2026-21124 | 1 Samsung Mobile | 1 Samsung Mobile Devices | 2026-10-12 | N/A |
| Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code. | ||||
| CVE-2026-21125 | 1 Samsung Mobile | 1 Samsung Mobile Devices | 2026-10-12 | N/A |
| Improper input validation in parsing sheifd in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code. | ||||
| CVE-2026-21126 | 1 Samsung Mobile | 1 Samsung Mobile Devices | 2026-10-12 | N/A |
| Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory. | ||||
| CVE-2026-108808 | 1 Eleveo | 1 Call Recording Software | 2026-10-12 | 2.6 Low |
| A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. This vulnerability affects unknown code of the file /auth/realms/default/protocol/openid-connect/logout of the component JWT Token Handler. Executing a manipulation of the argument id_token_hint can lead to use of get request method with sensitive query strings. The attack may be launched remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. | ||||