CVEs

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not verify that the acting administrator is authorized to manage each selected user before enabling that user's marketplace seller status, allowing a subsite Administrator on…

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not use a trusted site-owned sender address when relaying its store contact form, instead placing the unauthenticated submitter's supplied address directly in the message's…

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not correctly verify authorization when serving a single order and its order notes, allowing unauthenticated attackers to read customer and order information and to add or…

The Car Dealer (Dealership) and Vehicle sales WordPress plugin through 4.73 does not restrict its unauthenticated single-listing AJAX action to published content, allowing an unauthenticated attacker to read the title, content and metadata of any private, draft, pending, future…

The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise SVG files, which it adds to the list of file types that may be uploaded site-wide, allowing users with the Author role and above to upload a malicious SVG containing XSS payloads. Where another installed Easy…

The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data…

The Cloud Blocks WordPress plugin through 1.1.8 does not perform any authorisation or sanitisation when storing block asset URLs, allowing unauthenticated users to store malicious scripts that are executed in the browser of any privileged user, such as an administrator, who…

The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pages, which could allow high-privilege users such as Administrators to perform Stored Cross-Site Scripting attacks when the unfiltered_html…

The LiteSpeed Cache plugin for WordPress is vulnerable to unauthenticated disclosure of sensitive WooCommerce customer data in all versions up to, and including, 7.9.1 With Cache REST enabled (the shipped default cache-rest=1), LiteSpeed stores WooCommerce Store API GET…

In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a different vulnerability than CVE-2026-52810. This occurs because of a case-sensitivity desync between the authorization classifier and the…

STMicroelectronics st-mems-android-linux-sensors-hal before 7bdf334 does not check whether the allowed number of channels is exceeded.

@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an outbound HTTP request to retrieve a public signing key. There may be other impacts in a misconfiguration where oktaUrl isn't set.

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slides_to_show' parameter in all versions up to, and including, 5.126.0 due to insufficient input sanitization and output escaping. This makes it possible for…

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via theme_opts Parameter via User Profile in all versions up to, and including, 4.5.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.19.1 via the `donor_default_user_role` parameter. This is due to the `sanitize_option_donor_default_user_role()` function…

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to File Deletion in all versions up to, and including, 1.4.128 The vulnerability exists because `stm_save_user_extra_fields()`, hooked to `personal_options_update`, writes the…

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'multi_media' Field Array Key in all versions due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access…

A vulnerability has been found in OpenHands up to 1.24.0. This impacts an unknown function of the component Landing Page. Such manipulation leads to missing authentication. The attack must be carried out from within the local network. The exploit has been disclosed to the public…

A vulnerability was determined in itsourcecode Airline Reservation System 1.0. This affects an unknown function of the file /admin/manage_booked.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been…

A vulnerability was found in SourceCodester Online Food Ordering System 1.0. The impacted element is an unknown function of the file admin/add_category.php of the component Category Management. Performing a manipulation of the argument category_title results in cross site…

Insufficient length validation in the GNSS firmware loader may lead to corruption of kernel memory.

Memory corruption in GPU driver due to improper validation of VMID reservation.

Out-of-bounds memory access in a device driver due to improper resource state tracking.

In the Samsung GPU driver, improper reference count handling during command submission can lead to memory corruption.

In the Samsung Exynos GPU driver, improper synchronization during buffer object creation and closing can lead to memory corruption

In the Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write, which causes a denial of service

Insufficient validation of length fields in the GNSS firmware loader can result in kernel‑memory corruption.

Integer overflow in NPU driver parameter processing due to insufficient bounds checking.

Incorrect authorization in Samsung framework services due to missing permission checks

A double free vulnerability in NPU driver due to improper pointer management (941)

A double free vulnerability in NPU driver due to improper pointer management (940)

In the Samsung Exynos ENN NeuralNetworks HAL, improper input validation during request processing can cause memory corruption and lead to a denial of service condition.

In the Samsung Exynos H-Arx DRM plugin, improper input validation during buffer operations can cause memory corruption, potentially leading to denial of service or privilege escalation.

In the Samsung Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write, which causes a denial of service.

In the Samsung Exynos NPU kernel driver, an integer overflow allows an unprivileged application to trigger memory corruption.

Improper handling of messages before AS security activation can cause unexpected behavior

Improper permission handling during buffer operations allows untrusted applications to create memory mappings with inappropriate permissions

In the Exynos modem's IMS stack, improper handling of SDP payload leads to a Denial of Service

Out of bound access in PPC due to race condition in global variable access

A memory corruption vulnerability caused by improper validation of messages

Processing a malformed RRC message leads to an out-of-bounds read, resulting in a denial-of-service condition.

In the NR RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condition.

In the NAS message handler, improper validation of the length field in NAS message causes memory corruption

In IMS stack, improper handling of SIP packets leads to Incorrect_Access_Control vulnerability

In the baseband, memory corruption during NAS packet processing can cause a denial of service.

In the Exynos modem's IMS stack, Out of Bound access occurs due to improper validation.

In the LTE RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condition.

In the NAS Authentication Request message decoding procedure, a missing lower bound check causes an infinite loop, leading to Denial of Service.

An attacker may send a malicious IMS message to the target device, potentially leading to information exposure through the SIP message flow.

Processing a malformed RRC Reconfiguration message leads to an out-of-bounds (OOB) access, resulting in a denial-of-service (DoS) condition.