Archive
August 2026
Vulnerabilities first published in this month (UTC), newest first.
4,085 results · Clear filters · Feed
-
Medium 4.8
Android and iOS apps ECOVACS PRO App improperly validate server certificates. Communication may be retrieved and/or alt…
-
Medium 5.3
DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password ma…
-
Medium 4.6
The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords. Physical access to an affec…
-
Medium 4.8
DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle at…
-
Medium 6.5
DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activ…
-
Medium 6.9
Improper access control in SmartThings prior to version 1.8.47.24 allows local attackers to access sensitive informatio…
-
Medium 6.8
Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.
-
Medium 6.9
Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.
-
Medium 5.1
Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attacke…
-
Medium 6.9
Cleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to acces…
-
Medium 4.7
Insufficient verification of data authenticity in Smart Switch trouble scanning mode prior to version 3.7.72.6 allows a…
-
Medium 6.9
Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.
-
Medium 6.9
Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.
-
Medium 5.3
Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to ac…
-
Medium 5.2
Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrar…
-
Medium 5.1
Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write …
-
Medium 5.1
Improper input validation in MPEG4 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to writ…
-
Medium 5.1
Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access sensit…
-
Medium 5.1
Incorrect conversion between numeric types in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local at…
-
Medium 5.1
Improper input validation in libsmsd.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds m…
-
Medium 5.1
Improper input validation in libcodec2_sec_flacdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write o…
-
Medium 4.4
Out-of-bounds write in libcodec2secqcelpdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-b…
-
Medium 6.8
Improper export of android application components in AppLock prior to SMR Aug-2026 Release 1 allows physical attackers …
-
Medium 4.8
Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local attackers to access clipboard …
-
Medium 6.0
Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access SIM relat…
-
Medium 6.7
Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows physical attackers to access data …
-
Medium 6.9
Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local atta…
-
Medium 6.9
Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file wit…
-
Medium 6.8
Cybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script ma…
-
Medium 5.5
Denial of Service via HDF5 Shape Bomb in keras.models.load_model() in keras-team/keras
A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loading malicious .keras model files via the keras.models.load_model() function. The H5IOStore.__getitem__ method in keras/src/saving/saving_lib.py does no…
-
Medium 6.5
Copy & Delete Posts < 1.5.5 - Authenticated Arbitrary Post Deletion via Missing Object-Level Authorization
The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanen…
-
Medium 4.3
FoodBoxBooker < 1.0.8 - Subscriber+ Arbitrary User Profile Update
The FoodBoxBooker WordPress plugin before 1.0.8 does not verify that the user account being updated belongs to the user making the request, allowing authenticated users, with Subscriber-level access and above, to modify the profile details of arbitrary users,…
-
Medium 6.8
s2Member < 260805 - Contributor+ Stored XSS via Shortcode
The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the …
-
Medium 5.3
Advanced Classifieds & Directory Pro < 3.4.3 - Unauthenticated Non-Public Listing Custom Field Disclosure
The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 (<= 3.4.2) is vulnerable to unauthenticated sensitive information exposure via the AJAX action `acadp_public_custom_fields_listings`.
-
Medium 5.0
All-in-One Video Gallery < 4.9.2 - Subscriber+ Server-Side Request Forgery via 'vdl' Parameter
All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by `?vdl=<post_id>` on any `aiovg_videos` post (`public/video.php`, `AIOVG_Public_Video::download_video()`), which reads the post's `mp4` meta value and streams that …
-
Medium 4.8
Salon Booking System – Free Version <= 10.30.33 - Unauthenticated Google Calendar Connection Hijack via OAuth Callback
The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attack…
-
Medium 4.1
Vitepos < 3.6.0 - Admin+ SQL Injection via product-details-report
The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing users with administrator-level access to perform SQL injectio…
-
Medium 5.3
Salon Booking System – Free Version < 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering
The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total …
-
Medium 4.3
Salon Booking System – Free Version <= 10.31.0 - Subscriber+ Arbitrary Booking PII Disclosure
The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user (including a Subscriber or self-…
-
Medium 5.3
Pinpoint Booking System <= 2.9.9.7.1 - Unauthenticated Arbitrary Booking Price Manipulation
The Pinpoint Booking System WordPress plugin through 2.9.9.7.1 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price (including zero) and, by selecting a specific payment method, obtain…