CVE-2026-20xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
846 records · Page 1 of 9
Authentication bypass by replay in Smart Switch prior to version 3.7.69.15 allows remote attackers to trigger privileged functions.
UpdatedImproper authentication in Smart Switch prior to version 3.7.69.15 allows remote attackers to bypass authentication.
UpdatedImproper verification of cryptographic signature in Smart Switch prior to version 3.7.69.15 allows remote attackers to potentially bypass authentication.
UpdatedUse of a broken or risky cryptographic algorithm in Smart Switch prior to version 3.7.69.15 allows remote attackers to configure a downgraded scheme for authentication.
UpdatedExposure of sensitive functionality to an unauthorized actor in Smart Switch prior to version 3.7.69.15 allows remote attackers to set a specific configuration.
UpdatedURL redirection in Samsung Account prior to version 15.5.01.1 allows local attackers to potentially get access token.
UpdatedImproper export of android application components in Samsung Assistant prior to version 9.3.10.7 allows local attacker to access saved information.
UpdatedImproper authorization in Settings prior to SMR Mar-2026 Release 1 allows local attacker to disable configuring the background data usage of application.
UpdatedImproper privilege management in ThemeManager prior to SMR Mar-2026 Release 1 allows local privileged attackers to reuse trial contents.
UpdatedImproper export of android application components in Secure Folder prior to SMR Mar-2026 Release 1 allows local attackers to launch arbitrary activity with Secure Folder privilege.
UpdatedImproper verification of cryptographic signature in Font Settings prior to SMR Mar-2026 Release 1 allows physical attackers to use custom font.
UpdatedImproper verification of intent by broadcast receiver in Settings prior to SMR Mar-2026 Release 1 allows local attacker to launch arbitrary activity with Settings privilege. User interaction is required for triggering this vulnerability.
UpdatedImproper input validation in GalaxyDiagnostics prior to version 3.5.050 allows local privileged attackers to execute privileged commands.
UpdatedPath traversal in Samsung Members prior to Chinese version 15.5.05.4 allows local attackers to overwrite data within Samsung Members.
UpdatedImproper input validation in Samsung Members prior to version 5.6.00.11 allows remote attackers to connect arbitrary URL and launch arbitrary activity with Samsung Members privilege. User interaction is required for triggering this vulnerability.
UpdatedImproper handling of insufficient permission in Galaxy Wearable installed on non-Samsung Device prior to version 2.2.68 allows local attackers to access sensitive information.
UpdatedImproper export of android application components in Samsung Dialer prior to SMR Feb-2026 Release 1 allows local attackers to launch arbitrary activity with Samsung Dialer privilege.
UpdatedPath traversal in ShortcutService prior to SMR Feb-2026 Release 1 allows privileged local attacker to create file with system privilege.
UpdatedImproper input validation in FacAtFunction prior to SMR Feb-2026 Release 1 allows privileged physical attacker to execute arbitrary command with system privilege.
UpdatedImproper input validation in PACM prior to SMR Feb-2026 Release 1 allows physical attacker to execute arbitrary commands.
UpdatedImproper privilege management in Settings prior to SMR Feb-2026 Release 1 allows local attackers to launch arbitrary activity with Settings privilege.
UpdatedImproper authorization in KnoxGuardManager prior to SMR Feb-2026 Release 1 allows local attackers to bypass the persistence configuration of the application.
UpdatedImproper access control in Emergency Sharing prior to SMR Feb-2026 Release 1 allows local attackers to interrupt its functioning.
UpdatedImproper input validation in Galaxy Store prior to version 4.6.02 allows local attacker to execute arbitrary script.
UpdatedImproper handling of insufficient permission in Samsung Cloud prior to version 5.6.11 allows local attackers to access specific files in arbitrary path.
UpdatedImproper input validation in data related to network restrictions prior to SMR Jan-2026 Release 1 allows physical attackers to bypass Carrier Relock.
UpdatedOut-of-bounds read in libimagecodec.quram.so prior to SMR Jan-2026 Release 1 allows remote attacker to access out-of-bounds memory.
UpdatedImproper Export of Android Application Components in UwbTest prior to SMR Jan-2026 Release 1 allows local attackers to enable UWB.
UpdatedUse After Free in PROCA driver prior to SMR Jan-2026 Release 1 allows local attackers to potentially execute arbitrary code.
UpdatedImproper access control in SLocation prior to SMR Jan-2026 Release 1 allows local attackers to execute the privileged APIs.
UpdatedImproper input validation in SecSettings prior to SMR Jan-2026 Release 1 allows local attacker to access file with system privilege. User interaction is required for triggering this vulnerability.
UpdatedUse after free in DualDAR prior to SMR Jan-2026 Release 1 allows local privileged attackers to execute arbitrary code.
Updated- CVE-2026-20967: System Center Operations Manager (SCOM) Elevation of Privilege Vulnerability 8.8 High
Improper input validation in System Center Operations Manager allows an authorized attacker to elevate privileges over a network.
Updated Improper verification of cryptographic signature in Windows Admin Center allows an authorized attacker to elevate privileges locally.
UpdatedDeserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
Updated- CVE-2026-20962: Dynamic Root of Trust for Measurement (DRTM) Information Disclosure Vulnerability 4.4 Medium
Use of uninitialized resource in Dynamic Root of Trust for Measurement (DRTM) allows an authorized attacker to disclose information locally.
Updated Improper authorization in Microsoft Power Apps allows an authorized attacker to execute code over a network.
UpdatedImproper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
UpdatedServer-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
UpdatedInteger underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedUntrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedUntrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedUse after free in Microsoft Office allows an unauthorized attacker to execute code locally.
UpdatedUse after free in Microsoft Office allows an unauthorized attacker to execute code locally.
UpdatedImproper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.
UpdatedUse after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedImproper access control in Microsoft Office Excel allows an unauthorized attacker to bypass a security feature locally.
UpdatedUntrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.
UpdatedImproper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
UpdatedOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedImproper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
UpdatedOut-of-bounds read in Microsoft Office Word allows an unauthorized attacker to execute code locally.
UpdatedUntrusted search path in Microsoft Office allows an unauthorized attacker to execute code locally.
UpdatedImproper restriction of rendered ui layers or frames in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
UpdatedImproper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.
Updated- CVE-2026-20940: Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability 7.8 High
Heap-based buffer overflow in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
Updated Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.
UpdatedUntrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
UpdatedExposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.
UpdatedOut-of-bounds read in Windows NDIS allows an authorized attacker to disclose information with a physical attack.
Updated- CVE-2026-20935: Windows Virtualization-Based Security (VBS) Information Disclosure Vulnerability 6.2 Medium
Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an unauthorized attacker to disclose information locally.
Updated Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network.
UpdatedExposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.
UpdatedExternal control of file name or path in Windows Telephony Service allows an authorized attacker to elevate privileges over an adjacent network.
UpdatedConcurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.
UpdatedImproper access control in Windows HTTP.sys allows an authorized attacker to elevate privileges over a network.
UpdatedImproper removal of sensitive information before storage or transfer in Windows Recovery Environment Agent allows an unauthorized attacker to bypass a security feature with a physical attack.
UpdatedConcurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to deny service over a network.
UpdatedConcurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network.
UpdatedExternal control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
UpdatedUse after free in Windows Management Services allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Management Services allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.
UpdatedConcurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network.
UpdatedUse after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.
UpdatedConcurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network.
UpdatedConcurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.
UpdatedExposure of sensitive information caused by incorrect data forwarding during transient execution for some Intel(R) Processors within Ring 0: Hypervisor and Kernel may allow information disclosure. System software adversary with a privileged user combined with a high complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are not prese
UpdatedAn authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisclosed iControl REST endpoint on the BIG-IQ system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
UpdatedStored cross-site scripting (XSS) in Checkmk version 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create pending changes to inject malicious JavaScript into the Pending Changes sidebar, which will execute in the browsers of other users viewing the sidebar.
UpdatedNull pointer dereference for some Intel(R) QAT software drivers for Windows before version 2.6.0 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special inte
UpdatedImproper input validation for some Intel(R) Neural Compressor software before version v3.7 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without speci
UpdatedGitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.
UpdatedA heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
UpdatedAn OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field of the firmware update action to achieve remote code execution.
UpdatedGitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries.
UpdatedTime-of-check time-of-use race condition for the Intel(R) NPU Driver for Windows for all versions within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal
UpdatedProtection mechanism failure for some Intel(R) Neural Compressor software before version v3.6 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special in
UpdatedImproper input validation for some Intel(R) QAT software drivers for Windows before version 2.6 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special inter
UpdatedGitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.
UpdatedProtection mechanism failure for some Intel(R) AI Containers before version v0.4.0 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge
UpdatedAn OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the map filename field during the map upload action of the parameters route.
UpdatedImproper input validation for some Intel(R) Xeon(R) processors within firmware may allow an escalation of privilege. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable data alteration. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The p
UpdatedImproper access control in the firmware for some in Alias Checking Trusted Module for some Intel(R) Xeon(R) processors may allow an escalation of privilege. Startup code and SMM adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special intern
UpdatedGitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.
UpdatedGitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.
UpdatedThe WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that st
UpdatedCross-site scripting vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA Corporation. If an attacking administrator configures the affected product with some malicious input, an arbitrary script may be executed on the web browser of a victim administrator who accesses the setting screen.
UpdatedOrigin validation error issue exists in Fujitsu Security Solution AuthConductor Client Basic V2 2.0.25.0 and earlier. If this vulnerability is exploited, an attacker who can log in to the Windows system where the affected product is installed may execute arbitrary code with SYSTEM privilege and/or modify the registry value.
UpdatedCode injection vulnerability exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker with administrative privileges to execute arbitrary commands.
Updated