CVE watch

CVE-2026-104385 published: Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions.

CVE-2026-85153 published: This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the client application. An unauthenticated remote attacker could exploit this vulnerability by decompiling the distributed application package an...

CVE-2026-105807 published: A vulnerability was found in SourceCodester Simple Student Information System 1.0. This affects an unknown part of the file searchquery.php. Performing a manipulation results in sql injection. The attack can be initiated remotely.

CVE-2026-105305 published: A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the m...

CVE-2026-25302 published: Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed.

CVE-2026-57537 published: Memory Corruption when accessing and modifying geographic mapping data concurrently without proper synchronization.

CVE-2026-57545 published: Memory corruption when processing draw objects of incorrect type during graphics command list execution.

CVE-2026-57546 published: Transient DOS when processing a continuous receive command with a zero-sized global configuration override.

CVE-2026-25269 published: Memory corruption when processing camera requests with excessive batch and IO buffer configurations exceeds allocated memory size.

CVE-2026-25270 published: Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver.

CVE-2026-25272 published: Memory Corruption when processing camera CRE driver operations with improper handling of buffer limits during hardware update preparation.

CVE-2026-25273 published: Memory Corruption when processing camera operations due to out-of-bounds write during driver updates.

CVE-2026-25274 published: Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization.

CVE-2026-25291 published: Memory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms.

CVE-2026-105701 published: The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environm...

CVE-2026-105778 published: A vulnerability has been found in Tenda AC5 02.03.01.111_multi. Affected by this issue is some unknown functionality of the file /goform/setWifi of the component Wifi Handler. Such manipulation of the argument wifiPwd leads to stack-based buffer overflow. I...

CVE-2026-105776 published: A flaw has been found in bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL up to ae783195ba7e0390d3b3bfaddd99944b7e9735a4. Affected by this vulnerability is an unknown functionality of the file /admin_transaction.php. This manipulation o...

CVE-2026-25263 published: Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters.

CVE-2026-25267 published: Memory corruption when non-secure loader rewrites page tables before secure memory initialization.

CVE-2026-97300 published: Unauthenticated Broken Access Control in WP Event Solution <= 4.1.25 versions.