CVE Vulnerability Catalog

Relative path traversal vulnerability in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.

Improper export of Android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitive information. User interaction is required.

Cleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.

Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data.

Insufficient verification of data authenticity in Smart Switch trouble scanning mode prior to version 3.7.72.6 allows adjacent attackers to spoof device identity.

Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.

Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.

Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information.

Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrary activity.

Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access sensitive information.

Improper access control in Weaver prior to SMR Aug-2026 Release 1 allows local attackers to cause device inoperability.

Improper export of android application components in AppLock prior to SMR Aug-2026 Release 1 allows physical attackers to bypass app lock function.

Cybozu Garoon contains a cross-site scripting vulnerability. If exploited, an arbitrary script may be executed in the web browser of a logged-in user.

Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access SIM related functions. User interaction is required for triggering this vulnerability.

Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows physical attackers to access data across multiple user profiles.

The Duplicate Post plugin before version 1.5.5 does not perform per-object authorization checks in its bulk copy and delete operations. This allows any user whose role an administrator has granted access to the plugin to permanently delete arbitrary posts on the site, including those belonging to other users.

The All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by `?vdl=<post_id>` on any `aiovg_videos` post. It reads the post's `mp4` meta value and streams that URL's response back to the requester.

The Advanced Classifieds & Directory Pro plugin before version 3.4.3 (<= 3.4.2) is vulnerable to unauthenticated sensitive information exposure via the AJAX action `acadp_public_custom_fields_listings`.

The Block User Account plugin before version 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API.

The RSS Aggregator by Feedzy plugin before version 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete the posts created by another user's import job, reset its deduplication and scheduling state, disable it, or clear its error log. One of the affected actions performs no object-type check either, so arbitrary posts and pages can also be unpublished regardless of who owns them.