Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,746 results · page 4 of 75
Sep 15, 2026PraisonAI is a multi-agent teams system.CVE-2026-57140 · Other software · MervinPraison · reported by GitHubCritical 9.4
PraisonAI is a multi-agent teams system. From 1.6.0 until 1.7.2, AgentOS in src/praisonai-ts/src/os/agentos.ts uses the 0.0.0.0 default from src/praisonai-ts/src/os/config.ts and registers GET /api/agents and POST /api/chat without authentication middleware. A remote caller who can reach the service can obtain agent names, roles, and instruction prefixes and can invoke a selected agent, potentially reaching its tools, memory, external APIs, credentials, and workflow state. An initial remediation was released in version 1.7.2.
- Product
- PraisonAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026PraisonAI is a multi-agent teams system.CVE-2026-57139 · Other software · MervinPraison · reported by GitHubCritical 9.8
PraisonAI is a multi-agent teams system. From 1.5.0 until 1.7.2, MCPServer.startHttp() in src/praisonai-ts/src/mcp/server.ts binds without a host restriction and forwards every HTTP POST request to handleRequest() without authentication or authorization. Any network client that can reach the port can call tools/list, tools/call, resources/read, or prompts/get, causing registered handlers to run with server-side credentials and process privileges or disclose registered data. An initial remediation was released in version 1.7.2.
- Product
- PraisonAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026PraisonAI is a multi-agent teams system.CVE-2026-57138 · Other software · MervinPraison · reported by GitHubCritical 9.9
PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, codeMode in src/praisonai-ts/src/tools/builtins/code-mode.ts executes untrusted JavaScript with new Function() inside with(sandbox) and relies on a small source-code blocklist plus shadowed process and require properties. Code can use ({}).constructor.constructor to recover the real Function constructor, obtain process and process.mainModule.require, and reach host filesystem and subprocess APIs despite the advertised sandbox. Attackers who control codeMode input can read secrets, modify files, execute commands, or exhaust the host process. This issue is fixed in version 1.7.2.
- Product
- PraisonAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026PraisonAI is a multi-agent teams system.CVE-2026-57137 · Other software · MervinPraison · reported by GitHubHigh 8.8
PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, createAgentLoop() in src/praisonai-ts/src/ai/agent-loop.ts passes executable tools to generateText() before invoking the onToolCall approval callback. Because the wrapped AI SDK executes tool handlers during generation, a callback that returns false records tool_rejected only after the denied tool has already produced side effects and populated toolResults. Applications using onToolCall as a human or policy approval boundary can therefore execute rejected file, command, API, or data-modifying operations. This issue is fixed in version 1.7.2.
- Product
- PraisonAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026PraisonAI is a multi-agent teams system.CVE-2026-57136 · Other software · MervinPraison · reported by GitHubHigh 8.8
PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, CommandValidator in src/praisonai-ts/src/cli/features/sandbox-executor.ts validates only the first whitespace-delimited executable against allowedCommands, then SandboxExecutor passes the complete command string to sh -c. A command beginning with an allowed executable can append a non-allowlisted command through shell metacharacters, causing arbitrary commands to run with the PraisonAI process privileges. This issue is fixed in version 1.7.2.
- Product
- PraisonAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026PraisonAI is a multi-agent teams system.CVE-2026-57135 · Other software · MervinPraison · reported by GitHubHigh 7.6
PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, SandboxExecutor network-isolated mode in src/praisonai-ts/src/cli/features/sandbox-executor.ts uses buildEnv() only to inject invalid http_proxy and https_proxy environment variables and does not establish an operating-system network boundary. Programs that ignore those proxy variables can open sockets directly, allowing supposedly isolated commands to reach localhost, internal services, cloud metadata, or external hosts and potentially exfiltrate data. An initial remediation was released in version 1.7.2.
- Product
- PraisonAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026PraisonAI is a multi-agent teams system.CVE-2026-57134 · Other software · MervinPraison · reported by GitHubHigh 8.2
PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, MCPSecurity.evaluatePolicy() in src/praisonai-ts/src/mcp/security.ts invokes the configured credential validator only when AuthMethod is api-key or bearer. Basic and OAuth policies accept any non-empty Authorization header without calling auth.validate(), then return an authenticated result, allowing callers with invalid credentials to access MCP tools and resources protected by those policies. This issue is fixed in version 1.7.2.
- Product
- PraisonAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026PraisonAI is a multi-agent teams system.CVE-2026-57133 · Other software · MervinPraison · reported by GitHubHigh 8.8
PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, the shell() helper exported from src/praisonai-ts/src/tools/utility-tools.ts checks only the first whitespace-delimited token against safeCommands and then passes the complete original string to child_process.exec(). A string that starts with an allowed read-only command can append a second non-allowlisted command through shell syntax, allowing arbitrary command execution with the PraisonAI process privileges. This issue is fixed in version 1.7.2.
- Product
- PraisonAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026PraisonAI is a multi-agent teams system.CVE-2026-57112 · Other software · MervinPraison · reported by GitHubHigh 8.3
PraisonAI is a multi-agent teams system. From praisonaiagents 0.6.0 until 1.6.59 and PraisonAI 3.10.0 until 4.6.59, ToolsMCPServer.run_sse() in src/praisonai-agents/praisonaiagents/mcp/mcp_server.py mounts SseServerTransport on the legacy /sse and /messages/ endpoints without default Host, Origin, or authentication enforcement. A malicious website can use DNS rebinding against a reachable local or internal SSE server, supply attacker-controlled Host and Origin headers, enumerate registered tools, and invoke them with the server user's privileges. The Streamable HTTP transport rejects the same hostile Origin, which isolates the flaw to the legacy SSE wrapper. An initial remediation was released in praisonaiagents 1.6.59 and PraisonAI 4.6.59.
- Product
- PraisonAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Stack-based buffer overflow vulnerability in Samsung Opensource rLottie allows attackers to overflow buffers, leading to memory corruption when rendering crafteCVE-2026-91826 · Computers, phones & browsers · Samsung Opensource · reported by PSIRT@samsung.comMedium 4.4
Stack-based buffer overflow vulnerability in Samsung Opensource rLottie allows attackers to overflow buffers, leading to memory corruption when rendering crafted vector animations. This issue affects rLottie: 480a2ad0c5d2e45458c545b8213279e9e8b71e39.
- Product
- rLottie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records.CVE-2026-91774 · Other software · YaoApp · reported by VulnCheckMedium 5.3
Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records. Attackers can supply a known team identifier to retrieve sensitive team data including name, description, owner information, and settings without membership verification.
- Product
- yao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 Fail to sanitize Team objects returned by the data retention teamsCVE-2026-91181 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 6.5
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 Fail to sanitize Team objects returned by the data retention teams endpoint which allows an authenticated user holding only the read-only Data Retention Policy permission to obtain a private team's secret invite_id and email, and use it to join the team without authorization, via GET /api/v4/data_retention/policies/{policy_id}/teams.. Mattermost Advisory ID: MMSA-2026-00702
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026PraisonAI is a multi-agent teams system.CVE-2026-57145 · Other software · MervinPraison · reported by GitHubCritical 9.1
PraisonAI is a multi-agent teams system. Prior to 4.6.62, src/praisonai/praisonai/tools/multiedit.py passes the LLM-controlled filepath parameter directly to open for reading and writing without traversal rejection, symlink resolution, a workspace boundary, or protected-path checks. Prompt-influenced agents can read files through edit and diff behavior or overwrite files accessible to the process, exposing secrets and enabling persistence or application tampering. This issue is fixed in 4.6.62.
- Product
- PraisonAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026PraisonAI is a multi-agent teams system.CVE-2026-57132 · Other software · MervinPraison · reported by GitHubHigh 8.2
PraisonAI is a multi-agent teams system. Prior to 4.6.62, setting PRAISONAI_CALL_AUTH to disabled makes verify_token accept requests to /api/v1/agents/{id}/invoke without CALL_SERVER_TOKEN authentication. Deployments that use the application's advertised opt-out can expose registered agents and their connected tools or private context to unauthenticated invocation. The vulnerability is fixed in 4.6.62.
- Product
- PraisonAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026PraisonAI is a multi-agent teams system.CVE-2026-57131 · Other software · MervinPraison · reported by GitHubCritical 9.8
PraisonAI is a multi-agent teams system. Prior to 4.6.58, praisonai.jobs.server.create_app mounts praisonai.jobs.router.create_router under /api/v1/runs without authentication or per-job authorization. Network clients can submit attacker-controlled prompts and agent configuration, list and read jobs, stream results, and cancel or delete other jobs, exposing service credentials and connected tool capabilities to unauthorized agent execution. This vulnerability is fixed in 4.6.58.
- Product
- PraisonAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026PraisonAI is a multi-agent teams system.CVE-2026-57127 · Other software · MervinPraison · reported by GitHubCritical 9.8
PraisonAI is a multi-agent teams system. Prior to 4.6.58, recipe serve installs APIKeyAuthMiddleware or JWTAuthMiddleware when an operator selects api-key or JWT authentication, but each middleware forwards requests when PRAISONAI_API_KEY or PRAISONAI_JWT_SECRET and the corresponding recipe value are absent. Unauthenticated clients can then reach recipe execution, input, and output surfaces and may trigger connected tools despite the operator explicitly enabling authentication. This issue is fixed in 4.6.58.
- Product
- PraisonAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026PraisonAI is a multi-agent teams system.CVE-2026-57124 · Other software · MervinPraison · reported by GitHubCritical 9.8
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands bind to 0.0.0.0 by default, a reachable unauthenticated client can execute commands as the UI service account even when the MCP handshake later fails. This vulnerability is fixed in 4.6.59.
- Product
- PraisonAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026PraisonAI is a multi-agent teams system.CVE-2026-57122 · Other software · MervinPraison · reported by GitHubHigh 8.6
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPP_APP_SECRET or LINEAR_WEBHOOK_SECRET is configured and otherwise parse and dispatch unsigned request bodies. A remote unauthenticated client that reaches the webhook route can forge messages, comments, or agent-session events, impersonate platform users, influence agent prompts and actions, and disrupt bot processing. This issue is fixed in 4.6.59.
- Product
- PraisonAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026PraisonAI is a multi-agent teams system.CVE-2026-57119 · Other software · MervinPraison · reported by GitHubHigh 7.5
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the unauthenticated Jobs API accepts an absolute or traversing agent_file path in POST /api/v1/runs and passes it to the job executor without a workspace allowlist or boundary check. A remote caller can cause the server to open files accessible to the service account, exposing credentials, keys, environment variables, and other local data. This vulnerability is fixed in 4.6.59.
- Product
- PraisonAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026PraisonAI is a multi-agent teams system.CVE-2026-56839 · Other software · MervinPraison · reported by GitHubHigh 7.3
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the CODE_TOOLS wrappers keep _workspace_root as None and pass workspace=None to read_file, search_replace, and apply_diff helpers that enforce path containment only for a truthy workspace. An application that exposes code_read_file, code_search_replace, or code_apply_diff before set_workspace can therefore let prompt-influenced calls read and modify files outside the intended project directory, while explicitly configured workspaces remain effective. This vulnerability is fixed in 4.6.59.
- Product
- PraisonAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026PraisonAI is a multi-agent teams system.CVE-2026-57130 · Other software · MervinPraison · reported by GitHubHigh 8.1
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai-agents/praisonaiagents/tools/email_tools.py interpolates LLM-controlled from_addr, subject, and query values directly into quoted IMAP SEARCH criteria. Embedded quote, backslash, newline, or null characters can escape the intended criterion and alter IMAP operations when search_emails, reply_email, or archive_email is exposed to an agent with configured email credentials, allowing mailbox data access, modification, deletion, or connection disruption. This issue is fixed in praisonaiagents 1.6.59.
- Product
- praisonaiagents
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026PraisonAI is a multi-agent teams system.CVE-2026-57129 · Other software · MervinPraison · reported by GitHubHigh 7.5
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, MentionsParser._process_file_mention accepts file-mention values and falls back from workspace-relative resolution to Path(file_path) without traversal, symlink, or workspace-boundary validation. Prompt input from users, bots, or workflows can therefore read arbitrary files accessible to the process, including credentials, keys, environment files, source code, and system configuration. This issue is fixed in praisonaiagents 1.6.59.
- Product
- praisonaiagents
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026PraisonAI is a multi-agent teams system.CVE-2026-57128 · Other software · MervinPraison · reported by GitHubMedium 4.3
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the SSE server in src/praisonai-agents/praisonaiagents/server/server.py does not consult ServerConfig.auth_token before handling /publish, /events, or /info requests. A network client that can reach the server can broadcast arbitrary events to connected clients and obtain server configuration and client-count information. This issue is fixed in praisonaiagents 1.6.58.
- Product
- PraisonAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026PraisonAI is a multi-agent teams system.CVE-2026-57126 · Other software · MervinPraison · reported by GitHubHigh 8.5
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, SpiderTools._validate_url calls _host_is_blocked, which checks literal host encodings but does not resolve DNS names before scrape_page, crawl, extract_links, extract_text, or URL-mention fetches connect. An attacker-controlled hostname resolving to a loopback, private, link-local, or cloud-metadata address therefore bypasses the SSRF policy without a rebinding race and can expose internal responses to the agent. This issue is fixed in praisonaiagents 1.6.58.
- Product
- PraisonAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026PraisonAI is a multi-agent teams system.CVE-2026-57125 · Other software · MervinPraison · reported by GitHubCritical 9.8
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.59 and praisonaiagents 1.6.59, the unauthenticated POST /api/v1/runs Jobs API accepts attacker-controlled agent_yaml, and the approve field can mark execute_command as YAML-approved before @require_approval checks critical tools. This chain allows a remote caller to cause a configured language model agent to invoke arbitrary operating-system commands without credentials or operator interaction. This vulnerability is fixed in praisonai 4.6.59 and praisonaiagents 1.6.59 as fixed versions.
- Product
- PraisonAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026PraisonAI is a multi-agent teams system.CVE-2026-57123 · Other software · MervinPraison · reported by GitHubCritical 9.8
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, ToolsMCPServer.run_sse and launch_tools_mcp_server bind to 0.0.0.0 and create /sse and /messages/ routes without invoking the available SecurityConfig authentication, origin-validation, or DNS-rebinding controls. Any reachable client can list and invoke registered tools, and a browser can target a local instance through DNS rebinding, with impact determined by the registered file, shell, and code-execution tools. This vulnerability is fixed in praisonaiagents 1.6.59.
- Product
- praisonaiagents
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026PraisonAI is a multi-agent teams system.CVE-2026-57120 · Other software · MervinPraison · reported by GitHubMedium 6.5
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, execute_code sandbox mode permits runtime assembly of blocklisted dunder names and allows str.format or str.format_map to resolve dotted fields through C-level attribute access that bypasses _safe_getattr. This exposes class, qualified-name, base-class, globals, and object-dictionary attributes to prompt-influenced code when approval is automatically granted, producing a high-impact read primitive without establishing a complete in-process execution chain. This issue is fixed in praisonaiagents 1.6.59.
- Product
- praisonaiagents
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026PraisonAI is a multi-agent teams system.CVE-2026-57115 · Other software · MervinPraison · reported by GitHubMedium 6.5
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, SpiderTools.scrape_page validates only the initial URL and lets requests.Session.get follow redirects automatically, so a public-looking URL can redirect to a loopback, private, link-local, or metadata address without revalidation. The redirected response body is returned through scrape_page and its extract_links, crawl, and extract_text callers, allowing disclosure from otherwise blocked services. This issue is fixed in praisonaiagents 1.6.59.
- Product
- PraisonAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor, and Modem Exynos 9810, Exynos 9610, Exynos 9820, Exynos 980, Exynos 850, ExynoCVE-2023-37366 · Computers, phones & browsers · Samsung · reported by MITRELow 2.8
An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor, and Modem Exynos 9810, Exynos 9610, Exynos 9820, Exynos 980, Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 9110, Exynos W920, Exynos Modem 5123, Exynos Modem 5300, an Exynos Auto T5123. In the Shannon SM Task, improper handling of a loop with an unreachable exit condition cannot guarantee the termination of a required service via a malformed SM message.
- Product
- Exynos 850 firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.comsemiconductor.samsung.com
Sep 13, 2026An issue was discovered in NR RRC and L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, CVE-2026-33970 · Computers, phones & browsers · Samsung · reported by MITRELow 3.5
An issue was discovered in NR RRC and L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 1680, W920, W930, W1000, and Modem 5410. In the 5G baseband, a NULL Pointer Dereference occurs when processing a malformed RRC Reconfiguration message.
- Product
- Exynos 850 firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.comsemiconductor.samsung.com
Sep 13, 2026An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680.CVE-2026-33968 · Computers, phones & browsers · Samsung · reported by MITRELow 2.8
An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. In the camera driver, a Time-of-Check Time-of-Use (TOCTOU) race condition leads to out-of-bounds access.
- Product
- Exynos 1330 firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.comsemiconductor.samsung.com
Sep 13, 2026An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680.CVE-2026-33967 · Computers, phones & browsers · Samsung · reported by MITRELow 2.8
An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. In the camera driver, an out-of-bounds array access vulnerability in the error-handling path leads to memory corruption.
- Product
- Exynos 1330 firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.comsemiconductor.samsung.com
Sep 13, 2026An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680.CVE-2026-33966 · Computers, phones & browsers · Samsung · reported by MITRELow 2.8
An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. An information Leak occurs in the camera driver due to Insertion of Sensitive Information Into Debugging Code.
- Product
- Exynos 1330 firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.comsemiconductor.samsung.com
Sep 13, 2026An issue was discovered in camera in Samsung Mobile Processor Exynos 1580 and 2500.CVE-2026-33964 · Computers, phones & browsers · Samsung · reported by MITREMedium 6.4
An issue was discovered in camera in Samsung Mobile Processor Exynos 1580 and 2500. An untrusted pointer dereference occurs when a malformed message is sent to the camera driver, causing limited information disclosure or denial of service.
- Product
- Exynos 1580 firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.comsemiconductor.samsung.com
Sep 13, 2026An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680.CVE-2026-33963 · Computers, phones & browsers · Samsung · reported by MITREHigh 7.5
An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. A stack-based buffer overflow occurs when a malformed message is sent to the camera driver, causing a denial of service.
- Product
- Exynos 1330 firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.comsemiconductor.samsung.com
Sep 13, 2026An issue was discovered in Wi-Fi in Samsung Mobile Processor Exynos 850, 1280, 1330, 1380, 1480, 2400, W920, and W930.CVE-2026-33962 · Computers, phones & browsers · Samsung · reported by MITRELow 2.8
An issue was discovered in Wi-Fi in Samsung Mobile Processor Exynos 850, 1280, 1330, 1380, 1480, 2400, W920, and W930. A malformed Netlink command can trigger an out-of-bounds read, potentially leading to information leakage.
- Product
- Exynos 850 firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.comsemiconductor.samsung.com
Sep 13, 2026An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 1580, 1680, W920, W930, and W1000.CVE-2026-33960 · Computers, phones & browsers · Samsung · reported by MITRELow 2.8
An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 1580, 1680, W920, W930, and W1000. . A malformed ioctl command to the Wi-Fi interface device can lead to improper buffer size allocation, resulting in an out-of-bounds write and causing a denial of service (DoS).
- Product
- Exynos 1330 firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.comsemiconductor.samsung.com
Sep 13, 2026An issue was discovered in CustOS Driver in Samsung Mobile Processor Exynos 1580.CVE-2026-33957 · Computers, phones & browsers · Samsung · reported by MITREMedium 4.2
An issue was discovered in CustOS Driver in Samsung Mobile Processor Exynos 1580. Requesting oversized shared memory from the custos_iwc device enables out-of-bounds read and write, potentially leading to memory corruption or information leakage.
- Product
- Exynos 1580 firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.comsemiconductor.samsung.com
Sep 13, 2026An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, and 2500.CVE-2026-33956 · Computers, phones & browsers · Samsung · reported by MITRELow 2.8
An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, and 2500. Sending a malformed message to the test_msg sysfs entry causes an out-of-bounds write, leading to denial of service.
- Product
- Exynos 1330 firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.comsemiconductor.samsung.com
Sep 13, 2026An issue was discovered in Samsung Mobile Processor Exynos 1330, 1380, 1480, and 2400.CVE-2026-23793 · Computers, phones & browsers · Samsung · reported by MITRELow 3.5
An issue was discovered in Samsung Mobile Processor Exynos 1330, 1380, 1480, and 2400. An out-of-bounds memory access vulnerability in the camera GDC driver may lead to kernel memory corruption under certain conditions.
- Product
- Exynos 1330 firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.comsemiconductor.samsung.com
Sep 13, 2026An issue was discovered in NR RRC in Samsung Mobile Processor and Modem Exynos 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, W1000, Modem 5300, MoCVE-2026-23792 · Computers, phones & browsers · Samsung · reported by MITREMedium 4
An issue was discovered in NR RRC in Samsung Mobile Processor and Modem Exynos 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, W1000, Modem 5300, Modem 5400, and Modem 5410. Incorrect handling of unauthenticated downlink RRC Setup messages can cause the baseband to crash.
- Product
- Exynos 1080 firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.comsemiconductor.samsung.com
Sep 13, 2026An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600.CVE-2026-23791 · Computers, phones & browsers · Samsung · reported by MITREMedium 4.2
An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. An out-of-bounds write vulnerability in the Exynos DPU driver (due to missing input length validation in color mode LUT parsing) leads to kernel memory corruption and potential privilege escalation.
- Product
- Exynos 1280 firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.comsemiconductor.samsung.com
Sep 13, 2026An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600.CVE-2026-23790 · Computers, phones & browsers · Samsung · reported by MITREMedium 4.2
An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. A double-free vulnerability in the Samsung Exynos DPU driver (due to improper pointer management during DMA buffer reallocation) leads to kernel memory corruption and a potential use-after-free.
- Product
- Exynos 1280 firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.comsemiconductor.samsung.com
Sep 13, 2026An issue was discovered in MFC in Samsung Mobile Processor and Wearable Processor Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 2600, CVE-2026-23789 · Computers, phones & browsers · Samsung · reported by MITREHigh 7.8
An issue was discovered in MFC in Samsung Mobile Processor and Wearable Processor Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 2600, 1680, W920, W930, and W1000. A double-free vulnerability in the Exynos MFC encoder driver (due to improper cleanup of dma_buf references during error handling) leads to kernel memory corruption and potential arbitrary code execution.
- Product
- Exynos 850 firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.comsemiconductor.samsung.com
Sep 13, 2026An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, and 1380.CVE-2026-23788 · Computers, phones & browsers · Samsung · reported by MITREMedium 4.2
An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, and 1380. A heap overflow in the Exynos DRM HDR driver (due to improper buffer size validation) leads to kernel memory corruption and a system crash.
- Product
- Exynos 1280 firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.comsemiconductor.samsung.com
Sep 13, 2026An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600.CVE-2026-23787 · Computers, phones & browsers · Samsung · reported by MITREMedium 4.2
An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. A Use-After-Free in the Exynos DRM HDR driver (due to improper cleanup upon vmap failure) leads to a kernel crash.
- Product
- Exynos 1280 firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.comsemiconductor.samsung.com
Sep 13, 2026An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600.CVE-2026-23786 · Computers, phones & browsers · Samsung · reported by MITRELow 2.8
An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. A TOCTOU race condition in the Exynos DRM HDR Driver leads to a heap overflow, causing a kernel crash.
- Product
- Exynos 1280 firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsemiconductor.samsung.comsemiconductor.samsung.com
Sep 13, 2026An issue was discovered in the buffer queue driver in Samsung Automotive Processor Exynos Auto 8890, V7, V9, and V920.CVE-2024-53922 · Computers, phones & browsers · Samsung · reported by MITREMedium 5.7
An issue was discovered in the buffer queue driver in Samsung Automotive Processor Exynos Auto 8890, V7, V9, and V920. Lack of a length check leads to a Denial of Service in the kernel.
- Product
- Exynos 8890 firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiconium.comsemiconductor.samsung.com
Sep 11, 2026In the Linux kernel, the following vulnerability has been resolved: phy: rockchip-samsung-dcphy: fix out-of-range max_register The PHY register block is 64KB,CVE-2026-89721 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: phy: rockchip-samsung-dcphy: fix out-of-range max_register The PHY register block is 64KB, so with a register stride of 4 the last accessible register sits at offset 0xfffc. max_register names 0x10000, one register past the end of the mapping: dumping the registers through the regmap debugfs interface reads beyond the ioremapped region and oopses on the unmapped page. The oops fires with the regmap lock held, so later PHY operations deadlock.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 11, 2026In the Linux kernel, the following vulnerability has been resolved: zram: validate deflate params We must validate user-supplied deflate winbits before we pasCVE-2026-89716 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: zram: validate deflate params We must validate user-supplied deflate winbits before we pass it to zlib_deflate_workspacesize(), which triggers BUG_ON() if winbits value is outside of valid ranges.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.