CVE Vulnerability Catalog

Improper input validation in GuestCreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges.

Improper input validation in CreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch arbitrary activity with Samsung Checkout privileges.

Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive data.

Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.

Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to access data of the tied profile in before first unlock.

Improper handling of insufficient permission in CmcCore prior to SMR Oct-2026 Release 1 allows local attackers to use the privileged APIs.

Out-of-bounds read and write in lib_sag_ai_sound_sep_v2.00.so prior to SMR Oct-2026 Release 1 allows local attackers to read and write out-of-bounds memory.

Improper access control in DownloadProvider prior to SMR Oct-2026 Release 1 allows local attackers to access files in scoped storage.

Improper access control in CocktailBarService prior to SMR Oct-2026 Release 1 allows local attackers to access sensitive information.

Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.

Out-of-bounds write in libcodec2-sec-flacdec.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.

A security flaw in TinyFileManager up to version 2.6 allows unrestricted file upload via the move_uploaded_file function in tinyfilemanager.php by manipulating the fullpath argument. The attack can be performed remotely, and the exploit is publicly available.

A vulnerability in RuoYi 4.8.3 involves an unknown function that allows cross-site request forgery (CSRF). The attack can be executed remotely.

A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206 affecting unknown code of the file /personnel/api/employees/ in the Employee REST API component. The manipulation leads to authorization bypass and the attack may be initiated remotely.

A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206 affecting an unknown part of the file /iclock/finger_data/ in the Biometric Data Endpoint component. Manipulating the emp_code argument can lead to authorization bypass and the attack can be launched remotely.

A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206 affecting some unknown functionality of the file /base/api/systemSettings in the System Settings API component. The manipulation results in improper access controls and the attack can be initiated remotely.

A security vulnerability has been detected in ZKTeco BioTime 9.5.6 Build 20260130.3206 affecting an unknown functionality of the file /base/api/v1.0/systemSettings/db_migrate_setting/ in the Database Migration Functionality component. Such manipulation leads to SQL injection and the attack can be launched remotely.

A weakness in CicadasCMS up to version 2431154dac8d0735e04f1fd2a3c3556668fc8dab affects the TemplateController.input function in the file /system/cms/template/input of the Template Management component. Manipulation of the filePath argument causes path traversal. The attack can be initiated remotely, and the exploit is publicly available.

A path traversal vulnerability has been discovered in westboy CicadasCMS up to commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab, affecting the TemplateController.save function in /system/cms/template/save (Backend Template Editor component). The attack can be performed remotely and a public exploit is already available. The vendor was contacted but did not respond.

A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.1-rc.2, affecting the agent function of the dsh-workflow-worker-thread component. The manipulation leads to enforcement of behavioral workflow. The attack can be carried out remotely and the exploit is publicly available. The vendor did not respond.