default_status: affected

product: Galaxy Store

vendor: Samsung Mobile

status: unaffected

ecosystem: software/application

metric_type: Secondary

severity: high

metric_type: Primary

severity: medium

part: a

vendor: samsung

quality: metadata-backed

recipe_kind: composed

status: Analyzed

summary: Improper access control in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file with Galaxy Store privilege.


summary: Path traversal in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file with Galaxy Store privilege.


summary: Improper verification of cryptographic signature in Galaxy Store prior to version 4.6.03.8 allows local attacker to install arbitrary application.

title: Samsung Galaxy Store security vulnerability


product: Samsung Mobile Devices

version: SMR Apr-2026 Release in Selected Android 14, 15, 16 devices

version_type: semver

ecosystem: operating-system

part: o

product: android

summary: Improper input validation in data related to network restrictions prior to SMR Apr-2026 Release 1 allows physical attackers to bypass the restrictions.

title: Samsung Android security vulnerability


product: Smart Switch

summary: Improper authentication in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to trigger a denial of service.


summary: Path traversal in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to overwrite arbitrary files with Smart Switch privilege.

title: Samsung Smart Switch security vulnerability


version: SMR Apr-2026 Release in Android 15

archetype: generic

severity: low

summary: Improper access control in Samsung DeX prior to SMR Apr-2026 Release 1 allows physical attackers to access to hidden notification contents.


version: SMR Apr-2026 Release in Android 14, 15, 16

summary: Improper check for exceptional conditions in Device Care prior to SMR Apr-2026 Release 1 allows physical attackers to bypass Knox Guard.


summary: Exposure of sensitive information in S Share prior to SMR Apr-2026 Release 1 allows adjacent attacker to access sensitive information.


summary: Improper check for exceptional conditions in Recents prior to SMR Apr-2026 Release 1 allows physical attacker to bypass App Pinning.


summary: Improper input validation in Retail Mode prior to SMR Apr-2026 Release 1 allows local attackers to trigger privileged functions.


summary: Incorrect privilege assignment in Bluetooth in Maintenance mode prior to SMR Apr-2026 Release 1 allows physical attackers to bypass Extend Unlock.

title: Samsung Android security vulnerability


summary: External control of file name in AODManager prior to SMR Apr-2026 Release 1 allows privileged local attacker to create file with system privilege.

title: Samsung Android security vulnerability


product: Galaxy Wearable

summary: Incorrect default permission in Galaxy Wearable prior to version 2.2.68.26 allows local attackers to access sensitive information.


product: Samsung Camera

product: camera

summary: Improper access control in Samsung Camera prior to version 16.5.00.28 allows local attacker to access location data. User interaction is required for triggering this vulnerability.


version: SMR May-2026 Release in Android 14, 15, 16

summary: Incorrect default permissions in FactoryCamera prior to SMR May-2026 Release 1 allows local attacker to access unique identifier.


summary: Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local attackers to access sensitive information.


version: SMR Jun-2026 Release in Android 14, 15, 16

summary: Improper handling of insufficient privileges in SecTelephonyProvider prior to SMR Jun-2026 Release 1 allows local attackers to access privileged files.

title: Samsung Android security vulnerability


summary: Out-of-bounds write in SveService prior to SMR May-2026 Release 1 allows local privileged attackers to execute arbitrary code.


version: SMR May-2026 Release in Android Watch 14, 16

status: Awaiting Analysis

summary: Improper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release 1 allows local attacker to execute arbitrary code with system privilege.

title: Samsung Mobile Samsung Mobile Devices security vulnerability


summary: Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged functions.

title: Samsung Android security vulnerability


version: SMR May-2026 Release in Android 16

summary: Improper input validation in Routines prior to SMR May-2026 Release 1 allows physical attackers to launch privileged activity.


version: SMR May-2026 Release in Android 15, 16

summary: Improper handling of insufficient permissions in Routines prior to SMR May-2026 Release 1 allows local attackers to access sensitive information.

title: Samsung Android security vulnerability


version: SMR Mar-2026 Release in Android 14, 15, 16

summary: Insufficient verification of data authenticity in PackageManagerService prior to SMR Mar-2026 Release 1 allows local attackers to modify the installation restriction of specific application.

title: Samsung Android security vulnerability


product: Samsung System Support Service

summary: Improper privilege management in Samsung System Support Service prior to version 8.0.8.0 allows local attackers to trigger privileged functions.

title: Samsung Mobile Samsung System Support Service security vulnerability


summary: Incorrect privilege assignment in Telephony prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information.


version: SMR Jun-2026 Release in Android 16

summary: Improper export of android application components in SpriteWallpaper prior to SMR Jun-2026 Release 1 allows local attackers to access to sensitive information.

title: Samsung Android security vulnerability


summary: Improper export of android application components in ImsSettings prior to SMR Jun-2026 Release 1 allows local attackers to trigger logging function.

title: Samsung Android security vulnerability


summary: Improper access control in AuditLogService prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information.


summary: Improper export of android application components in Galaxy Editing Service prior to SMR Jun-2026 Release 1 allows local attacker to execute privileged operations.

title: Samsung Android security vulnerability


summary: Improper access control in MediaTek Audio HAL prior to SMR Jun-2026 Release 1 allows local attackers to trigger privileged functions.


version: SMR Jun-2026 Release in Android 15, 16

summary: Improper authorization in AppBlock prior to SMR Jun-2026 Release 1 allows local attacker to launch arbitrary activity. User interaction is required for triggering this vulnerability.


product: Samsung Assistant

product: assistant

summary: Improper export of android application components in SmartHomeWidgetReceiver of Samsung Assistant prior to version 9.3.14 allows local attacker to execute arbitrary script.

title: Samsung Assistant security vulnerability


summary: Improper export of android application components in ExpressHomeWidgetReceiver of Samsung Assistant prior to version 9.3.14 allows local attacker to execute arbitrary script.


product: Samsung Auto

product: auto

summary: Improper export of android application components in Samsung Auto prior to version 3.1.2.61 in Android 15 and 3.2.0.38 in Android 16 allows local attacker to change audio configuration.

title: Samsung Auto security vulnerability


product: Samsung Plus TV

author: Codex

description: CVE-2026-21035 is Samsung Plus TV input validation. NVD ends before 1.0.28.6. Leftover used that floor as attack prose. GHAD is empty.

maturity: development

model: GPT 5.5 Extra High reasoning

title: CVE-2026-21035: Samsung Plus TV leftover dump

recipe_kind: markdown-draft

summary: Improper input validation in Samsung Plus TV prior to version 1.0.28.6 allows remote attackers to access sensitive information.


product: Samsung Internet

product: internet

summary: Improper authorization in Samsung Internet prior to version 30.0.0.39 allows local attackers to access sensitive information.


product: Samsung Members

description: CVE-2026-21037 is Samsung Members input validation. NVD ends before 5.8.01.5. Leftover used that floor as attack prose. GHAD is empty.

title: CVE-2026-21037: Samsung Members leftover dump

product: members

summary: Improper input validation in Samsung Members prior to version 5.8.01.5 allows local attackers to access arbitrary URL and launch arbitrary activity with Samsung Members privilege.

title: Samsung Members security vulnerability


product: Samsung Android USB Driver for Windows

ecosystem: windows/system

summary: Improper input validation in Samsung Android USB Driver for Windows prior to version 1.9.5.0 allows local attacker to access out-of-bounds memory.

title: Samsung Android Usb Driver security vulnerability


product: Samsung Mobile Devices

version: SMR Jul-2026 Release in Android 15, 16

status: Deferred

summary: Improper access control in Settings prior to SMR Jul-2026 Release 1 allows local attackers to configure Theft protection settings.


version: SMR Jul-2026 Release in Android 14, 15, 16

summary: Improper access control in IAFDService prior to SMR Jul-2026 Release 1 allows local privileged attackers to use the privileged APIs.


summary: Improper access control in SamsungSEAgentService prior to SMR Jul-2026 Release 1 allows local attackers to access sensitive information.


description: CVE-2026-21042 is Samsung libsavsac leftover. No GHAD. NVD Deferred empty CPE. Vendor/NVD prose names SMR Jul-2026 Release 1.

title: CVE-2026-21042: Samsung libsavsac leftover dump

summary: Out-of-bounds write in libsavsac.so prior to SMR Jul-2026 Release 1 allows local attackers to execute arbitrary code.


summary: Path traversal in Wallpaper service prior to SMR Jul-2026 Release 1 allows local privileged attackers to access files with system server privilege.


summary: Improper authorization in KnoxGuardManager prior to SMR Jul-2026 Release 1 allows local attackers to bypass the persistence configuration of the application.


description: CVE-2026-21045 is Samsung TIFF leftover. No GHAD. NVD Deferred empty CPE. Vendor/NVD prose names SMR Jul-2026 Release 1.

title: CVE-2026-21045: Samsung TIFF codec leftover dump

summary: Out-of-bounds write in parsing TIFF format in libimagecodec.media.quram.so prior to SMR Jul-2026 Release 1 allows remote attackers to write out-of-bounds memory.


description: CVE-2026-21046 is Samsung fabricKeymaster leftover. No GHAD. NVD Deferred empty CPE. Vendor/NVD prose names SMR Jul-2026 Release 1.

title: CVE-2026-21046: Samsung fabricKeymaster leftover dump

summary: Time-of-check time-of-use race condition in fabricKeymaster trustlet prior to SMR Jul-2026 Release 1 allows local privileged attackers to execute arbitrary code.


summary: Out-of-bounds write in ImsService prior to SMR Jul-2026 Release 1 allows remote attackers to potentially execute arbitrary code.


description: CVE-2026-21048 is Samsung DNG leftover. No GHAD. NVD Deferred empty CPE. Vendor/NVD prose names SMR Jul-2026 Release 1.

title: CVE-2026-21048: Samsung DNG codec leftover dump

summary: Out-of-bounds write in parsing DNG format in libimagecodec.media.quram.so prior to SMR Jul-2026 Release 1 allows remote attackers to write out-of-bounds memory.


description: CVE-2026-21049 is Samsung libpadm leftover. No GHAD. NVD Deferred empty CPE. Vendor/NVD prose names SMR Jul-2026 Release 1.

title: CVE-2026-21049: Samsung libpadm leftover dump

summary: Out-of-bounds write in libpadm.so library prior to SMR Jul-2026 Release 1 allows local attackers to execute arbitrary code.


version: SMR Jul-2026 Release in Android 16

summary: Improper access control in SmartThingsKit prior to SMR Jul-2026 Release 1 allows local attackers to access sensitive information.


summary: Incorrect default permissions in WLAN security prior to SMR Jul-2026 Release 1 allows local attackers to configure TencentWifiSecurity settings.


summary: Path traversal in SemClipboardService prior to SMR Jul-2026 Release 1 allows local privileged attackers to access files with system privilege.


product: Samsung Email

summary: Improper input validation in Samsung Email prior to version 6.2.13.1 allows local attackers to create arbitrary files within the application sandbox.

title: Samsung Mobile Samsung Email security vulnerability


product: InputSharing

summary: Improper export of android application components in InputSharing prior to version 2.7.01.4 allows local attackers to access sharing data.


product: Bixby

description: CVE-2026-21055 is Samsung Bixby leftover. No GHAD. NVD Deferred empty CPE. Vendor/NVD prose names 4.0.70.8. Do not invent a floor.

title: CVE-2026-21055: Samsung Bixby leftover dump

summary: Improper export of android application components in Bixby prior to version 4.0.70.8 allows local attackers to execute arbitrary commands with Bixby privilege.

title: Samsung Mobile Bixby security vulnerability


product: Samsung Health

summary: Improper authorization in Samsung Health prior to version 7.00.0.107 allows local attackers to access connected device information.


product: Samsung Pass

summary: Improper input validation in Samsung Pass prior to version 5.2.10.3 allows local privileged attackers to write out-of-bounds memory.


version: SMR Aug-2026 Release in Android 16

product: android

summary: Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege.

title: Samsung Android security vulnerability


summary: Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege.

title: Samsung Android security vulnerability


version: SMR Aug-2026 Release in Android 14, 15, 16

summary: Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows physical attackers to access data across multiple user profiles.

title: Samsung Android security vulnerability


summary: Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access SIM related functions. User interaction is required for triggering this vulnerability.


summary: Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local attackers to access clipboard data.


summary: Improper export of android application components in AppLock prior to SMR Aug-2026 Release 1 allows physical attackers to bypass app lock function.

title: Samsung Android security vulnerability


summary: Improper access control in Weaver prior to SMR Aug-2026 Release 1 allows local attackers to cause device inoperability.


summary: Out-of-bounds write in libcodec2secqcelpdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.


summary: Improper input validation in libcodec2_sec_flacdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.


summary: Improper input validation in libsmsd.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.


summary: Stack-based buffer overflow in libril_sem.so prior to SMR Aug-2026 Release 1 allows privileged local attackers to execute arbitrary code.


summary: Incorrect conversion between numeric types in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.

title: Samsung Android security vulnerability


version: SMR Aug-2026 Release in Android 14, 15

summary: Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access sensitive information.


summary: Improper input validation in MPEG4 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.

title: Samsung Android security vulnerability


summary: Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.


summary: Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrary activity.


summary: Incorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute arbitrary commands with Bixby privilege.


product: My Galaxy

summary: Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information.

title: Samsung Mobile My Galaxy security vulnerability


product: health

summary: Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.


title: Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information


product: Smart Switch

summary: Insufficient verification of data authenticity in Smart Switch trouble scanning mode prior to version 3.7.72.6 allows adjacent attackers to spoof device identity.

title: Samsung Smart Switch security vulnerability


summary: Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data.


summary: Cleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.


product: SamsungPassAutofill

summary: Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitive information. User interaction is required for triggering this vulnerability.

title: Samsung Mobile Samsungpassautofill security vulnerability


summary: Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.


summary: Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.


product: SmartThings

summary: Improper access control in SmartThings prior to version 1.8.47.24 allows local attackers to access sensitive information.


vendor: Microsoft

status: affected

version_type: custom

product: .net

vendor: microsoft

summary: Improper handling of missing special element in .NET allows an unauthorized attacker to perform spoofing over a network.


product: Windows SDK

summary: Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.


platforms:
ARM64-based Systems
x64-based Systems

product: Windows 11 Version 24H2

product: Windows 11 Version 25H2

product: Windows Server 2025

product: Windows Server 2025 (Server Core installation)

summary: Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authorized attacker to elevate privileges locally.

title: Microsoft Windows 11 24H2 security vulnerability


platforms:
32-bit Systems
x64-based Systems

product: Windows 10 Version 1607

product: Windows 10 Version 1809

platforms:
32-bit Systems
ARM64-based Systems
x64-based Systems

product: Windows 10 Version 21H2

product: Windows 10 Version 22H2

product: Windows 11 version 22H3

product: Windows 11 Version 23H2

product: Windows Server 2012 R2

product: Windows Server 2012 R2 (Server Core installation)

product: Windows Server 2016

product: Windows Server 2016 (Server Core installation)

product: Windows Server 2019

summary: Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally.


product: Microsoft Edge (Chromium-based)

status: Modified

summary: Improper privilege management in Microsoft Edge (Chromium-based) allows an authorized attacker to bypass a security feature locally.


product: Azure Connected Machine Agent

summary: Stack-based buffer overflow in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.


summary: Deserialization of untrusted data in Azure Core shared client library for Python allows an authorized attacker to execute code over a network.

title: Microsoft Azure Core Shared Client Library security vulnerability


product: Azure Logic Apps

severity: critical

summary: Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.

title: Microsoft Azure Logic Apps security vulnerability


product: Azure Local

summary: Improper certificate validation in Azure Local allows an unauthorized attacker to execute code over a network.


product: Power BI Report Server

summary: Improper input validation in Power BI allows an authorized attacker to execute code over a network.


product: Windows 11 Version 24H2

product: Windows 11 Version 25H2

product: Windows 11 version 26H1

product: Windows Server 2012

product: Windows Server 2012 (Server Core installation)

summary: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.

title: Microsoft Windows 10 1607 security vulnerability


product: Windows 11 version 22H3

product: Windows Server 2022, 23H2 Edition (Server Core installation)

product: Windows Server 2025

product: Windows Server 2025 (Server Core installation)

summary: Untrusted pointer dereference in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.


product: Windows 10 Version 1809

product: Windows 10 Version 21H2

product: Windows 10 Version 22H2

product: Windows 11 Version 23H2

product: Windows Server 2019 (Server Core installation)

product: Windows Server 2022

summary: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally.

title: Microsoft Windows 10 1809 security vulnerability


product: Windows 10 Version 1607

product: Windows Server 2012 R2

product: Windows Server 2012 R2 (Server Core installation)

product: Windows Server 2016

summary: Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.


product: Windows 11 Version 24H2

product: Windows 11 Version 25H2

product: Windows 11 version 26H1

summary: Heap-based buffer overflow in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.


product: Windows 11 version 22H3

summary: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.

title: Microsoft Windows 10 21H2 security vulnerability


product: Windows Server 2012

product: Windows Server 2012 (Server Core installation)

summary: Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.


summary: Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.


product: Windows Server 2019

product: Windows Server 2022, 23H2 Edition (Server Core installation)

summary: Time-of-check time-of-use (toctou) race condition in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.


product: Windows Server 2025

product: Windows Server 2025 (Server Core installation)

summary: Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.


product: Windows 10 Version 21H2

product: Windows 10 Version 22H2

product: Windows 11 Version 23H2

summary: Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.


product: Windows Server 2019 (Server Core installation)

product: Windows Server 2022

summary: Null pointer dereference in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network.

title: Microsoft Windows Server 2019 security vulnerability


product: Windows 10 Version 1607

product: Windows 10 Version 1809

product: Windows Server 2016 (Server Core installation)

summary: Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.


product: Windows 11 Version 24H2

product: Windows 11 Version 25H2

title: Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally


product: Windows 11 version 22H3

product: Windows Server 2012 R2

product: Windows Server 2012 R2 (Server Core installation)

summary: Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.


product: Windows 11 version 26H1

product: Windows Server 2016

product: Windows Server 2019

summary: Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally.


title: Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally


product: Windows Server 2022, 23H2 Edition (Server Core installation)

product: Windows Server 2025

product: Windows Server 2025 (Server Core installation)

title: Untrusted pointer dereference in Windows HTTP.sys allows an authorized attacker to elevate privileges locally


summary: Use after free in Windows Cluster Client Failover allows an authorized attacker to elevate privileges locally.


product: Windows 10 Version 21H2

product: Windows 10 Version 22H2

product: Windows 11 Version 23H2

product: Windows Server 2012

product: Windows Server 2012 (Server Core installation)

summary: Use after free in Mailslot File System allows an authorized attacker to elevate privileges locally.


product: Windows 10 Version 1607

product: Windows 10 Version 1809

product: Windows Server 2016 (Server Core installation)

summary: Improper access control in Windows Hyper-V allows an authorized attacker to bypass a security feature locally.


product: Microsoft Visual Studio 2022 version 17.14

product: Microsoft Visual Studio 2026 version 18.3

summary: Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code over a network.

title: Microsoft Visual Studio 2022 security vulnerability


summary: Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an authorized attacker to elevate privileges over a network.


product: Microsoft 365 Apps for Enterprise

product: Microsoft Excel 2016

product: Microsoft Office 2019

product: Microsoft Office LTSC 2021

product: Microsoft Office LTSC 2024

product: Microsoft Office LTSC for Mac 2021

product: Microsoft Office LTSC for Mac 2024

product: Office Online Server

product: excel

product: office

summary: Improper input validation in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.


summary: Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to elevate privileges locally.


product: Microsoft Outlook 2016

product: Microsoft SharePoint Enterprise Server 2016

product: Microsoft SharePoint Server 2019

product: Microsoft SharePoint Server Subscription Edition

product: outlook

summary: Exposure of sensitive information to an unauthorized actor in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.

title: Microsoft 365 Apps security vulnerability


summary: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.


product: Microsoft SQL Server 2016 Service Pack 3 (GDR)

product: Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack

product: Microsoft SQL Server 2017 (CU 31)

product: Microsoft SQL Server 2017 (GDR)

product: Microsoft SQL Server 2019 (CU 32)

product: Microsoft SQL Server 2019 (GDR)

product: Microsoft SQL Server 2022 (GDR)

product: Microsoft SQL Server 2022 for x64-based Systems (CU 23)

product: Microsoft SQL Server 2025 (CU 2)

product: Microsoft SQL Server 2025 for x64-based Systems (GDR)

summary: Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.


product: Microsoft Account

product: account

summary: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Account allows an unauthorized attacker to perform spoofing over a network.

title: Microsoft Account security vulnerability


product: Windows 10 Version 1607

product: Windows 10 Version 1809

product: Windows 10 Version 21H2

product: Windows 10 Version 22H2

product: Windows 11 version 23H2

product: Windows 11 Version 24H2

product: Windows 11 Version 25H2

product: Windows Server 2012

product: Windows Server 2012 (Server Core installation)

product: Windows Server 2012 R2

product: Windows Server 2012 R2 (Server Core installation)

product: Windows Server 2016

summary: Windows Secure Boot stores Microsoft certificates in the UEFI KEK and DB. These original certificates are approaching expiration, and devices containing affected certificate versions must update them to maintain Secure Boot functionality and avoid compromising security by losing security fixes related to Windows boot manager or Secure Boot. The operating system’s certificate update protection mechanism relies on firmware components that might contain defects, which can cause certificate trust updates to fail or behave unpredictably. This leads to potential disruption of the Secure Boot trust chain and requires careful validation and deployment to restore intended security guarantees. Certificate Authority (CA) Location Purpose Expiration Date Microsoft Corporation KEK CA 2011 KEK Signs updates to the DB and DBX 06/24/2026 Microsoft Corporation UEFI CA 2011 DB Signs 3rd party boot loaders, Option ROMs, etc. 06/27/2026 Microsoft Windows Production PCA 2011 DB Signs the Windows Boot Manager 10/19/2026 For more information see this CVE and Windows Secure Boot certificate expiration and CA updates.


default_status: unaffected

product: Adobe Dreamweaver Desktop

vendor: Adobe

product: dreamweaver

vendor: adobe

summary: Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed.

title: Adobe Dreamweaver security vulnerability


summary: Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed.


product: ColdFusion 2025

product: ColdFusion 2023

ecosystem: javascript/npm

product: coldfusion

summary: is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

title: Adobe Coldfusion security vulnerability


summary: Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system write. An attacker could leverage this vulnerability to manipulate or inject malicious data into files on the system. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed.


summary: is affected by an Improper Input Validation vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain unauthorized read and write access. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.


summary: Dreamweaver Desktop versions 21.6 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could leverage this vulnerability to bypass security measures and execute unauthorized code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


product: InDesign Desktop

product: indesign

summary: InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

title: Adobe Indesign security vulnerability


summary: InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

title: Adobe Indesign security vulnerability


summary: InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to access sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


summary: is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.


product: Illustrator Desktop 2026

product: Illustrator Desktop 2025

product: illustrator

summary: Illustrator versions 29.8.3, 30.0 and earlier are affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. If the application uses a search path to locate critical resources such as programs, an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed.

title: Adobe Illustrator security vulnerability


product: InCopy

product: incopy

summary: InCopy versions 21.0, 19.5.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

title: Adobe Incopy security vulnerability


product: Adobe Commerce

product: Adobe Commerce B2B

product: Magento Open Source

product: commerce

summary: Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Improper Input Validation vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability by providing specially crafted input, causing limited impact to application availability. Exploitation of this issue does not require user interaction.

title: Adobe Commerce security vulnerability


product: Bridge

product: bridge

summary: Bridge versions 15.1.2, 16.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

title: Adobe Bridge security vulnerability


summary: Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field.

title: Adobe Commerce B2B security vulnerability


summary: Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized access to a feature. Exploitation of this issue does not require user interaction.


summary: Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized view access of data. Exploitation of this issue does not require user interaction.


product: Substance3D - Stager

summary: Substance3D - Stager versions 3.1.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

title: Adobe Substance 3D Stager security vulnerability


summary: Illustrator versions 29.8.3, 30.0 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing disruption to services. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


summary: Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized view access of data. Exploitation of this issue does not require user interaction.


summary: Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field.


product: magento

summary: Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field.

title: Adobe Magento security vulnerability


summary: Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker attacker to inject malicious scripts into vulnerable form fields. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field.


archetype: ssrf

summary: Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. A high-privileged attacker could exploit this vulnerability to manipulate server-side requests and access unauthorized resources. Exploitation of this issue does not require user interaction.

title: Adobe Commerce security vulnerability


summary: Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. A high-privileged attacker could exploit this vulnerability to manipulate server-side requests and bypass security controls. Exploitation of this issue does not require user interaction.

title: Adobe Commerce security vulnerability


summary: Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized view access of data. Exploitation of this issue does not require user interaction.

title: Adobe Commerce security vulnerability


title: Adobe Commerce security vulnerability


product: Substance3D - Modeler

summary: Substance3D - Modeler versions 1.22.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

title: Adobe Substance 3D Modeler security vulnerability


summary: Substance3D - Modeler versions 1.22.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


summary: Substance3D - Modeler versions 1.22.4 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


title: Substance3D - Modeler versions 1.22.4 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure


summary: InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

title: Adobe Indesign security vulnerability


product: Substance3D - Painter

summary: Substance3D - Painter versions 11.0.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

title: Adobe Substance 3D Painter security vulnerability


product: Adobe Substance 3D Sampler

summary: Substance3D - Sampler versions 5.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

title: Adobe Substance 3D Sampler security vulnerability


product: Adobe Substance 3D Designer

summary: Substance3D - Designer versions 15.0.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

title: Adobe Substance 3D Designer security vulnerability


summary: Substance3D - Designer versions 15.0.3 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


title: Adobe Commerce security vulnerability


summary: Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass, with limited impact to integrity. Exploitation of this issue does not require user interaction.

title: Adobe Commerce security vulnerability


summary: Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field.

title: Adobe Commerce security vulnerability


product: Audition

product: audition

summary: Audition versions 25.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

title: Adobe Audition security vulnerability


summary: Audition versions 25.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


title: Audition versions 25.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure


summary: Audition versions 25.3 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to access sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


summary: Audition versions 25.3 and earlier are affected by an Access of Memory Location After End of Buffer vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to cause the application to crash or become unresponsive. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

title: Adobe Audition security vulnerability


product: After Effects

summary: After Effects versions 25.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

title: Adobe After Effects security vulnerability


summary: After Effects versions 25.6 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to access sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


summary: After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


summary: After Effects versions 25.6 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


summary: After Effects versions 25.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


summary: After Effects versions 25.6 and earlier are affected by an Access of Resource Using Incompatible Type ('Type Confusion') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


product: Adobe Connect

product: Adobe Connect Desktop Application

product: connect

summary: Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.


product: InDesign Desktop

product: indesign

summary: InDesign Desktop versions 21.1, 20.5.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


product: Illustrator Desktop 2026

product: Illustrator Desktop 2025

product: illustrator

summary: Illustrator versions 29.8.4, 30.1 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute arbitrary code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


summary: Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


summary: Substance3D - Designer versions 15.1.0 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing disruption to services. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


summary: Substance3D - Designer versions 15.1.0 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to access sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


summary: Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


title: Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure


product: Substance3D - Stager

summary: Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


summary: Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


product: Bridge

product: bridge

summary: Bridge versions 15.1.3, 16.0.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

title: Adobe Bridge security vulnerability


summary: Bridge versions 15.1.3, 16.0.1 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

title: Adobe Bridge security vulnerability


product: Substance3D - Modeler

summary: Substance3D - Modeler versions 1.22.5 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


product: Lightroom Desktop

product: lightroom

summary: Lightroom Desktop versions 15.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

title: Adobe Lightroom security vulnerability


summary: After Effects versions 25.6 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing disruption to services. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


summary: After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


product: Adobe DNG Software Development Kit (SDK)

summary: DNG SDK versions 1.7.1 2410 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

title: Adobe Dng Software Development Kit security vulnerability


summary: DNG SDK versions 1.7.1 2410 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


summary: DNG SDK versions 1.7.1 2410 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to cause the application to crash or become unresponsive. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


summary: DNG SDK versions 1.7.1 2410 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


summary: InDesign Desktop versions 21.1, 20.5.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

title: Adobe Indesign security vulnerability


summary: InDesign Desktop versions 21.1, 20.5.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing disruption to services. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

title: Adobe Indesign security vulnerability


product: Adobe Commerce

product: Adobe Commerce B2B

product: Magento Open Source

product: commerce

summary: Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and have limited impact to the integrity and availability of data. The exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.

title: Adobe Commerce security vulnerability


summary: Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a security feature bypass. A high-privileged attacker could leverage this vulnerability to access unauthorized files or directories outside the intended restricted path. Exploitation of this issue does not require user interaction.

title: Adobe Commerce security vulnerability


summary: Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vvulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field.

title: Adobe Commerce security vulnerability


summary: Illustrator versions 29.8.4, 30.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


product: Substance3D - Painter

summary: Substance3D - Painter versions 11.1.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing disruption to services. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


summary: Substance3D - Painter versions 11.1.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to access sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


product: Snapdragon

vendor: Qualcomm, Inc.

version: LeMansAU

vendor: qualcomm

summary: Memory corruption while processing a packet with a size close to the maximum allowed value.


platforms: Snapdragon Consumer Electronics Connectivity

platforms: Snapdragon Wired Infrastructure and Networking

version: Cologne

version: FastConnect 6200

version: FastConnect 6700

version: FastConnect 6900

version: FastConnect 7800

version: FWA Gen 3 Ultra Platform

version: G2 Gen 1

version: Immersive Home 214 Platform

version: Immersive Home 216 Platform

version: Immersive Home 316 Platform

version: Immersive Home 318 Platform

version: Milos

version: Netrani

version: Networking Pro 1200 Platform

summary: Transient DOS when processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial scans.


platforms:
Snapdragon Auto
Snapdragon Compute
Snapdragon Industrial IOT
Snapdragon Mobile

version: G3x Gen 2

version: IQ9 Series Platform

version: Pandeiro

summary: Memory Corruption when parsing jpeg commands due to unaccounted extra writes to the buffer during validation checks.


platforms:
Snapdragon Auto
Snapdragon Compute
Snapdragon Consumer IOT
Snapdragon Industrial IOT
Snapdragon Mobile
Snapdragon Wearables

version: G1 Gen 1

version: Kalpeni

version: LeMansAU

summary: Memory Corruption when handling flash commands due to outdated LED count values being used after userspace modification.


version: FastConnect 6700

version: FastConnect 6900

summary: Memory Corruption when validating input batch size and buffer plane count exceeds maximum allowed values.


platforms:
Snapdragon Compute
Snapdragon Industrial IOT
Snapdragon Mobile

version: Cologne

version: FastConnect 6200

version: FastConnect 6800

version: FastConnect 7800

version: Qualcomm Video Collaboration VC3 Platform

version: Snapdragon 460 Mobile Platform

version: Snapdragon 662 Mobile Platform

version: Snapdragon 7c Compute Platform

version: Snapdragon 7c Gen 2 Compute Platform "Rennell Pro"

version: Snapdragon 7c+ Gen 3 Compute

version: Snapdragon 8c Compute Platform "Poipu Lite"

version: Snapdragon 8c Compute Platform (SC8180XP-AD) "Poipu Lite"

version: Snapdragon 8cx Compute Platform

summary: Memory Corruption when retrieving output buffer with insufficient size validation.


summary: Memory Corruption when sending IOCTL requests with invalid buffer sizes during memcpy operations.


summary: Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.


summary: Memory Corruption when processing auxiliary sensor input/output control commands with insufficient buffer size validation.


version: Snapdragon 8cx Gen 3 Compute Platform

version: Snapdragon AR1 Gen 1 Platform

title: Memory Corruption when accessing an output buffer without validating its size during IOCTL processing


version: FastConnect 6700

summary: Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.


version: FastConnect 6900

version: Snapdragon 8cx Gen 2 5G Compute Platform "Poipu Pro"

title: Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver


platforms:
Snapdragon Compute
Snapdragon Industrial IOT

version: Cologne

version: FastConnect 6200

version: Snapdragon 8cx Compute Platform "Poipu Pro"

version: Snapdragon 8cx Gen 2 5G Compute Platform

summary: Memory Corruption when allocating memory with sizes that exceed the maximum allowed value.


version: FastConnect 7800

summary: Memory Corruption when using deprecated DMABUF IOCTL calls to manage video memory.


version: FWA Gen 3 Ultra Platform

version: G2 Gen 1

version: Milos

version: Netrani

version: Orne

version: Pandeiro

summary: Transient DOS when receiving a service data frame with excessive length during device matching over a neighborhood awareness network protocol connection.

title: Qualcomm Ar8035 Firmware security vulnerability


summary: Memory Corruption when handling power management requests with improperly sized input/output buffers.


platforms:
Snapdragon Auto
Snapdragon CCW
Snapdragon Compute
Snapdragon Industrial IOT
Snapdragon Mobile

version: LeMansAU

summary: Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping, which requires a unique value for each call to ensure security.

title: Qualcomm Fastconnect 6900 Firmware security vulnerability


platforms:
Snapdragon Auto
Snapdragon Compute
Snapdragon Consumer IOT
Snapdragon Industrial IOT
Snapdragon Mobile

summary: Memory Corruption when updating prepared commands with invalid port indices based on user space input exceeds supported read client limits.


platforms:
Snapdragon Auto
Snapdragon CCW
Snapdragon Compute
Snapdragon Connectivity
Snapdragon Consumer IOT
Snapdragon Industrial IOT
Snapdragon Mobile
Snapdragon Voice & Music
Snapdragon WBC
Snapdragon Wearables

version: 5G Fixed Wireless Access Platform

version: FastConnect 6800

version: Flight RB5 5G Platform

version: FSM100 Platform

version: G1 Gen 1

version: IQ6 Series Platform

version: IQ8 Series Platform

version: IQ9 Series Platform

known_ransomware_campaign_use: Unknown

notes: Please check with specific vendors (OEMs,) for information on patching status. For more information, please see: https://source.android.com/docs/security/bulletin/2026/2026-03-01 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21385

product: Multiple Chipsets

required_action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

vendor_project: Qualcomm

vulnerability_name: Qualcomm Multiple Chipsets Memory Corruption Vulnerability

summary: Memory corruption while using alignments for memory allocation.


product: Mattermost

vendor: Mattermost

vendor: mattermost

summary: Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to use consistent error responses when handling the /mute command which allows an authenticated team member to enumerate private channels they are not authorized to know about via differing error messages for nonexistent versus private channels. Mattermost Advisory ID: MMSA-2026-00588

title: Mattermost Mattermost Server security vulnerability


product: Intel(R) LLM Library for PyTorch

version: See references

summary: Protection mechanism failure for some Intel(R) LLM Library for PyTorch within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

title: Intel(R) Llm Library For Pytorch security vulnerability


summary: Mattermost Plugins versions <=2.3.1 fail to limit the request body size on the {{/lifecycle}} webhook endpoint which allows an authenticated attacker to cause memory exhaustion and denial of service via sending an oversized JSON payload. Mattermost Advisory ID: MMSA-2026-00610


product: Copeland XWEB 300D PRO

vendor: Copeland

product: Copeland XWEB 500D PRO

product: Copeland XWEB 500B PRO

vendor: copeland

summary: An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the request body sent to the contacts import route.

title: Copeland Xweb 300D Pro Firmware security vulnerability


product: Movable Type (Software Edition)

vendor: Six Apart Ltd.

product: Movable Type Advanced (Software Edition)

product: Movable Type Premium (Software Edition)

version: 2.13 and earlier (MTP 2 series)

product: Movable Type Premium (Advanced Edition) (Software Edition)

product: Movable Type (Cloud Edition)

product: Movable Type Premium (Cloud Edition)

version: 2.12 (MTP 2 series)

summary: Movable Type contains a stored cross-site scripting vulnerability in Edit Comment. If crafted input is stored by an attacker, arbitrary script may be executed on a logged-in user's web browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.


version: before version 2.0.2

summary: Heap-based buffer overflow for the Intel(R) Open Volume Kernel Library (Intel(R) Open VKL) library maintained by intel(R) before version 2.0.2 within Ring 3: User Applications may allow a denial of service. System software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

title: Intel(R) Open Volume Kernel Library (Intel(R) Open Vkl) Library Maintai… security vulnerability


product: Intel(R) AI Reference Models

version: before version v3.4.1

summary: Protection mechanism failure for some Intel(R) AI Reference Models before version v3.4.1 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

title: Intel(R) Ai Reference Models security vulnerability


product: NavBox

vendor: NAVTOR

vendor: navtor

summary: NAVTOR NavBox through version 4.16.1.20 contains hard-coded credentials within its Windows Communication Foundation (SOAP) implementation. If the SOAP functionality is enabled, a local attacker can extract credentials to bypass the intended transfer workflow. Successful authentication against the SOAP interface grants access to privileged WCF methods, enabling an attacker to write or overwrite files within application-defined paths.


product: beat-access for Windows

vendor: FUJIFILM Business Innovation Corp.

version: version 3.0.3 and prior

summary: beat-access for Windows version 3.0.3 and prior contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with SYSTEM privileges.

title: Fujifilm Business Innovation Corp. Beat-Access For Windows security vulnerability


product: RICOH Streamline NX

vendor: Ricoh Company, Ltd.

summary: Improper authorization vulnerability exists in RICOH Streamline NX 3.5.1 to 24R3. If a man-in-the-middle attack is conducted on the communication between the affected product and its user, and some crafted request is processed by the product, the user's registration information and/or OIDC (OpenID Connect) tokens may be retrieved.


product: MasterSCADA BUK-TS

vendor: InSAT

version: All versions

product: masterscada

vendor: insat

summary: InSAT MasterSCADA BUK-TS is susceptible to SQL Injection through its main web interface. Malicious users that use the vulnerable endpoint are potentially able to cause remote code execution.


product: OpenBlocks IoT DX1 (FW5.0.x)

vendor: Plat'Home Co.,Ltd.

version: all versions prior to FW5.0.8

product: OpenBlocks IoT EX/BX models (FW5.0.x)

product: OpenBlocks IX9 models with FW (FW5.0.x)

product: OpenBlocks IoT VX2 (FW5.0.x)

product: OpenBlocks IDM RX1 (FW5.0.x)

product: OpenBlocks IoT FX1 (FW5.0.x)

summary: Authentication bypass issue exists in OpenBlocks series versions prior to FW5.0.8, which may allow an attacker to bypass administrator authentication and change the password.

title: Plat'Home Co.,Ltd. Openblocks Iot Dx1 (Fw5.0.X) security vulnerability


product: LibRaw

vendor: LibRaw

version: Commit 0b56545

version: Commit d20315b

product: Red Hat Enterprise Linux 8

vendor: Red Hat

version_type: rpm

product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

product: Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

product: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

product: Red Hat Enterprise Linux 8.6 Telecommunications Update Service

product: Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions

product: Red Hat Enterprise Linux 8.8 Telecommunications Update Service

product: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions

product: Red Hat Enterprise Linux 9

product: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

product: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

description: CVE-2026-21413 is a heap overflow in LibRaw lossless_jpeg_load_raw. GHSA names no version range and no floor. Do not invent a LibRaw tag.

title: CVE-2026-21413: LibRaw lossless_jpeg_load_raw, No Named Floor

product: libraw

vendor: libraw

summary: A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.


product: CloudBoost Virtual Appliance

vendor: Dell

vendor: dell

summary: Dell CloudBoost Virtual Appliance, versions prior to 19.14.0.0, contains a Plaintext Storage of Password vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.


product: Unity

summary: Dell Unity, version(s) 5.5.2 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.

title: Dell Unity Operating Environment security vulnerability


summary: Dell Display and Peripheral Manager (Windows) versions prior to 2.2 contain an Improper Link Resolution Before File Access ('Link Following') vulnerability in the Installer and Service. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges

title: Dell Display And Peripheral Manager (Windows) security vulnerability


product: Repository Manager

less_than: 3.4.8 or later

summary: Dell Repository Manager (DRM), versions prior to 3.4.8, contains an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execution and escalation of privileges.


product: PowerScale OneFS

summary: Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an execution with unnecessary privileges vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges.

title: Dell Powerscale Onefs security vulnerability


summary: Dell PowerScale OneFS, versions 9.10.0.0 through 9.13.1.0, contains an external control of system or configuration setting vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to protection mechanism bypass.


version: Versions prior to 9.10.1.6

summary: Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an incorrect default permissions vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to code execution, denial of service, elevation of privileges, and information disclosure.


summary: Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an execution with unnecessary privileges vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.


summary: Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an incorrect privilege assignment vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.


summary: Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an execution with unnecessary privileges vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to denial of service, elevation of privileges, and information disclosure.


product: USB DAC Amplifier APS-DA101JS

vendor: PIONEER CORPORATION

version: all versions

product: USB DAC Amplifier APS-DA101JR

product: USB DAC Amplifier APS-DA101JGL

product: USB DAC Amplifier APS-DA101JGR

product: Stellanova Lite APS-S201JS

product: Stellanova Lite APS-S201JR

product: Stellanova Lite APS-S201JGL

product: Stellanova Lite APS-S201JGR

product: Stellanova Limited APS-S202J-LM

product: Stellanova APS-S301 series

summary: The installers for multiple products provided by PIONEER CORPORATION contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privileges of the running installer.

title: Pioneer Corporation Usb Dac Amplifier Aps-Da101Js security vulnerability


product: cpp-httplib

vendor: yhirose

ecosystem: python/pypi

summary: cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.30.0, the ``write_headers`` function does not check for CR & LF characters in user supplied headers, allowing untrusted header value to escape header lines. This vulnerability allows attackers to add extra headers, modify request body unexpectedly & trigger an SSRF attack. When combined with a server that supports http1.1 pipelining (springboot, python twisted etc), this can be used for server side request forgery (SSRF). Version 0.30.0 fixes this issue.


product: emlog

vendor: emlog

summary: Emlog is an open source website building system. In version 2.5.23, the admin can set controls which makes users unable to edit or delete their articles after publishing them. As of time of publication, no known patched versions are available.


summary: Emlog is an open source website building system. In version 2.5.23, article creation functionality is vulnerable to cross-site request forgery (CSRF). This can lead to a user being forced to post an article with arbitrary, attacker-controlled content. This, when combined with stored cross-site scripting, leads to account takeover. As of time of publication, no known patched versions are available.


summary: Emlog is an open source website building system. Version 2.5.23 has a stored cross-site scripting vulnerability in the `Resource media library ` function while publishing an article. As of time of publication, no known patched versions are available.


summary: Emlog is an open source website building system. Version 2.5.23 has a stored cross-site scripting vulnerability that can lead to account takeover, including takeover of admin accounts. As of time of publication, no known patched versions are available.


summary: Emlog is an open source website building system. Versions up to and including 2.5.19 are vulnerable to server-side Out-of-Band (OOB) requests / SSRF via uploaded SVG files. An attacker can upload a crafted SVG to http[:]//emblog/admin/media[.]php which contains external resource references. When the server processes/renders the SVG (thumbnailing, preview, or sanitization), it issues an HTTP request to the attacker-controlled host. Impact: server-side SSRF/OOB leading to internal network probing and potential metadata/credential exposure. As of time of publication, no known patched versions are available.


product: webtransport-go

vendor: quic-go

summary: webtransport-go is an implementation of the WebTransport protocol. From 0.3.0 to 0.9.0, an attacker can cause excessive memory consumption in webtransport-go's session implementation by sending a WT_CLOSE_SESSION capsule containing an excessively large Application Error Message. The implementation does not enforce the draft-mandated limit of 1024 bytes on this field, allowing a peer to send an arbitrarily large message payload that is fully read and stored in memory. This allows an attacker to consume an arbitrary amount of memory. The attacker must transmit the full payload to achieve the memory consumption, but the lack of any upper bound makes large-scale attacks feasible given sufficient bandwidth. This vulnerability is fixed in 0.10.0.


summary: webtransport-go is an implementation of the WebTransport protocol. Prior to v0.10.0, an attacker can cause a denial of service in webtransport-go by preventing or indefinitely delaying WebTransport session closure. A malicious peer can withhold QUIC flow control credit on the CONNECT stream, blocking transmission of the WT_CLOSE_SESSION capsule and causing the close operation to hang. This vulnerability is fixed in v0.10.0.


product: eopkg

vendor: getsolus

vendor: getsol

summary: eopkg is a Solus package manager implemented in python3. In versions prior to 4.4.0, a malicious package could escape the directory set by `--destdir`. This requires the installation of a package from a malicious or compromised source. Files in such packages would not be installed in the path given by `--destdir`, but on a different location on the host. The issue has been fixed in v4.4.0. Users only installing packages from the Solus repositories are not affected.


summary: eopkg is a Solus package manager implemented in python3. In versions prior to 4.4.0, a malicious package could include files that are not tracked by `eopkg`. This requires the installation of a package from a malicious or compromised source. Files in such packages would not be shown by `lseopkg` and related tools. The issue has been fixed in v4.4.0. Users only installing packages from the Solus repositories are not affected.


summary: webtransport-go is an implementation of the WebTransport protocol. Prior to 0.10.0, an attacker can cause unbounded memory consumption repeatedly creating and closing many WebTransport streams. Closed streams were not removed from an internal session map, preventing garbage collection of their resources. This vulnerability is fixed in v0.10.0.


product: badkeys

vendor: badkeys

summary: badkeys is a tool and library for checking cryptographic public keys for known vulnerabilities. In versions 0.0.15 and below, an attacker may inject content with ASCII control characters like vertical tabs, ANSI escape sequences, etc., that can create misleading output of the badkeys command-line tool. This impacts scanning DKIM keys (both --dkim and --dkim-dns), SSH keys (--ssh-lines mode), and filenames in various modes. This issue is fixed in version 0.0.16.


product: core

vendor: adonisjs

summary: AdonisJS is a TypeScript-first web framework. A Path Traversal vulnerability in AdonisJS multipart file handling may allow a remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This impacts @adonisjs/bodyparser through version 10.1.1 and 11.x prerelease versions prior to 11.0.0-next.6. This issue has been patched in @adonisjs/bodyparser versions 10.1.2 and 11.0.0-next.6.


product: Red Hat Enterprise Linux 10

product: Red Hat Enterprise Linux 10.0 Extended Update Support

product: Red Hat Enterprise Linux 7 Extended Lifecycle Support

product: Red Hat Enterprise Linux 8

product: Red Hat Enterprise Linux 8.2 Advanced Update Support

product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

product: Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

product: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

product: Red Hat Enterprise Linux 8.6 Telecommunications Update Service

product: Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions

product: Red Hat Enterprise Linux 8.8 Telecommunications Update Service

description: CVE-2026-21441 is urllib3 redirect decompression-bomb bypass. GHAD names 2.6.3. Leftover 1.22-before-2.6.3 is the affected range.

title: CVE-2026-21441: urllib3 redirect decompression-bomb bypass

vendor: python

summary: urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects.


product: openemr

vendor: openemr

vendor: open-emr

summary: OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the `xl()` translation function returns unescaped strings. While wrapper functions exist for escaping in different contexts (`xlt()` for HTML, `xla()` for attributes, `xlj()` for JavaScript), there are places in the codebase where `xl()` output is used directly without escaping. If an attacker could insert malicious content into the translation database, these unescaped outputs could lead to XSS. Version 8.0.0 fixes the issue.


product: libtpms

vendor: stefanberger

summary: libtpms, a library that provides software emulation of a Trusted Platform Module, has a flaw in versions 0.10.0 and 0.10.1. The commonly used integration of libtpms with OpenSSL 3.x contained a vulnerability related to the returned IV (initialization vector) when certain symmetric ciphers were used. Instead of returning the last IV it returned the initial IV to the caller, thus weakening the subsequent encryption and decryption steps. The highest threat from this vulnerability is to data confidentiality. Version 0.10.2 fixes the issue. No known workarounds are available.


product: langflow

vendor: langflow-ai

vendor: langflow

summary: Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user conversation data, transaction histories, and perform destructive operations including message deletion. This affects endpoints handling personal data and system operations that should require proper authorization. Version 1.7.0.dev45 contains a patch.


product: bagisto

vendor: bagisto

vendor: webkul

summary: Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after initial installation is complete. The underlying API endpoints (`/install/api/*`) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly. This allows any unauthenticated attacker to create admin accounts, modify application configurations, and potentially overwrite existing data. Version 2.3.10 fixes the issue.


summary: Bagisto is an open source laravel eCommerce platform. Prior to version 2.3.10, an Insecure Direct Object Reference vulnerability in the customer order reorder function allows any authenticated customer to add items from another customer's order to their own shopping cart by manipulating the order ID parameter. This exposes sensitive purchase information and enables potential fraud. Version 2.3.10 patches the issue.


summary: Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection. When a normal customer orders any product, in the `add address` step they can inject a value to run in admin view. The issue can lead to remote code execution. Version 2.3.10 contains a patch.


summary: Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via first name and last name from a low-privilege user. Version 2.3.10 fixes the issue.


summary: Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via type parameter, which can lead to remote code execution or another exploitation. Version 2.3.10 fixes the issue.


summary: Bagisto is an open source laravel eCommerce platform. A stored Cross-Site Scripting (XSS) vulnerability exists in Bagisto prior to version 2.3.10 within the CMS page editor. Although the platform normally attempts to sanitize `<script>` tags, the filtering can be bypassed by manipulating the raw HTTP POST request before submission. As a result, arbitrary JavaScript can be stored in the CMS content and executed whenever the page is viewed or edited. This exposes administrators to a high-severity risk, including complete account takeover, backend hijacking, and malicious script execution. Version 2.3.10 fixes the issue.


product: msgpack-java

vendor: msgpack

ecosystem: java/maven

product: messagepack

summary: MessagePack for Java is a serializer implementation for Java. A denial-of-service vulnerability exists in versions prior to 0.9.11 when deserializing .msgpack files containing EXT32 objects with attacker-controlled payload lengths. While MessagePack-Java parses extension headers lazily, it later trusts the declared EXT payload length when materializing the extension data. When ExtensionValue.getData() is invoked, the library attempts to allocate a byte array of the declared length without enforcing any upper bound. A malicious .msgpack file of only a few bytes can therefore trigger unbounded heap allocation, resulting in JVM heap exhaustion, process termination, or service unavailability. This vulnerability is triggered during model loading / deserialization, making it a model format vulnerability suitable for remote exploitation. The vulnerability enables a remote denial-of-service attack against applications that deserialize untrusted .msgpack model files using MessagePack for Java.


product: listmonk

vendor: knadh

vendor: nadh

summary: listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to version 6.0.0, lower-privileged user with campaign management permissions can inject malicious JavaScript into campaigns or templates. When a higher-privileged user (Super Admin) views or previews this content, the XSS executes in their browser context, allowing the attacker to perform privileged actions such as creating backdoor admin accounts. The attack can be weaponized via the public archive feature, where victims simply need to visit a link - no preview click required. Version 6.0.0 fixes the issue.


product: anything-llm

vendor: Mintplex-Labs

product: anythingllm

vendor: mintplexlabs

summary: AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to commit e287fab56089cf8fcea9ba579a3ecdeca0daa313, the password recovery endpoint returns different error messages depending on whether a username exists, so enabling username enumeration. Commit e287fab56089cf8fcea9ba579a3ecdeca0daa313 fixes this issue.


product: iccDEV

vendor: InternationalColorConsortium

product: iccdev

vendor: color

summary: iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below are prone to have Undefined Behavior (UB) and Out of Memory errors. This issue is fixed in version 2.3.1.2.


summary: iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below contain Use After Free, Heap-based Buffer Overflow and Integer Overflow or Wraparound and Out-of-bounds Write vulnerabilities in its CIccSparseMatrix::CIccSparseMatrix function. This issue is fixed in version 2.3.1.2.


summary: iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below have an Out-of-bounds Read, Use of Out-of-range Pointer Offset and have Improper Input Validation in its CIccProfile::LoadTag function. This issue is fixed in version 2.3.1.2.


summary: iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below are vulnerable to Out-of-bounds Read, Heap-based Buffer Overflow and Improper Null Termination through its CIccTagText::Read function. This issue is fixed in version 2.3.1.2.


summary: iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below have Out-of-bounds Read and Integer Underflow (Wrap or Wraparound) vulnerabilities in its CIccCalculatorFunc::SequenceNeedTempReset function. This issue is fixed in version 2.3.1.2.


summary: iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. A vulnerability present in versions prior to 2.3.1.2 affects users of the iccDEV library who process ICC color profiles. It results in heap buffer overflow in `CIccTagLut16::Validate()`. Version 2.3.1.2 contains a patch. No known workarounds are available.

title: Color Iccdev security vulnerability


summary: iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. A vulnerability present in versions prior to 2.3.1.2 affects users of the iccDEV library who process ICC color profiles. It results in unicode buffer overflow in `CIccTagTextDescription`. Version 2.3.1.2 contains a patch. No known workarounds are available.

title: Color Iccdev security vulnerability


summary: iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a NULL pointer member call vulnerability. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.

title: Color Iccdev security vulnerability


summary: iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below are vulnerable to Type Confusion in its CIccSingleSampledeCurveXml class during XML Curve Serialization. This issue is fixed in version 2.3.1.2.


summary: iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. A vulnerability present in versions prior to 2.3.1.2 affects users of the iccDEV library who process ICC color profiles. It results in heap buffer overflow in `CIccTagLut8::Validate()`. Version 2.3.1.2 contains a patch. No known workarounds are available.

title: Color Iccdev security vulnerability


summary: iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to division by zero in the TIFF Image Reader. This issue has been patched in version 2.3.1.2.


summary: iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to NULL pointer dereference via the signature parser. This issue has been patched in version 2.3.1.2.


summary: iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to NULL pointer dereference via an unknown tag parser. This issue has been patched in version 2.3.1.2.


summary: iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to NULL pointer dereference via the XML calculator parser. This issue has been patched in version 2.3.1.2.


summary: iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to NULL pointer dereference via the XML parser. This issue has been patched in version 2.3.1.2.


summary: iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to stack overflow in the XML calculator macro expansion. This issue has been patched in version 2.3.1.2.


summary: iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to stack overflow in the calculator parser. This issue has been patched in version 2.3.1.2.


summary: iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to NULL pointer dereference via the XML tag parser. This issue has been patched in version 2.3.1.2.


summary: iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV has undefined behavior due to a null pointer passed to memcpy() in CIccTagSparseMatrixArray. This issue has been patched in version 2.3.1.2.