CVE-2026-21061

SIM Function Access Vulnerability in Samsung Dialer

Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access SIM related functions. User interaction is required for triggering this vulnerability.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Samsung Samsung Mobile

Products

Android Samsung Mobile Devices

CVE-2026-21062

Local Clipboard Data Access via Authorization Bypass in Samsung SemClipboardService

Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local attackers to access clipboard data.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Samsung Samsung Mobile

Products

Android Samsung Mobile Devices

CVE-2026-21063

AppLock Improper Export Enables Physical Access Bypass

Improper export of android application components in AppLock prior to SMR Aug-2026 Release 1 allows physical attackers to bypass app lock function.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Samsung Samsung Mobile

Products

Android Samsung Mobile Devices

CVE-2026-21064

Improper Access Control in Samsung Weaver Enables Local Attacker to Disrupt Device Functionality

Improper access control in Weaver prior to SMR Aug-2026 Release 1 allows local attackers to cause device inoperability.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Samsung Samsung Mobile

Products

Android Samsung Mobile Devices

CVE-2026-21065

Local Out-of-Bounds Write in Samsung Codec Library Allows Memory Corruption

Out-of-bounds write in libcodec2secqcelpdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.

CVSS 4.0 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Samsung

Products

Android Mobile Devices

CVE-2026-21066

Out-of-Bounds Memory Write in Samsung FLAC Decoder (libcodec2_sec_flacdec.so)

Improper input validation in libcodec2_sec_flacdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Samsung Samsung Mobile

Products

Android Samsung Mobile Devices

CVE-2026-21068

Stack-Based Buffer Overflow in Samsung Mobile Device libril_sem.so

Stack-based buffer overflow in libril_sem.so prior to SMR Aug-2026 Release 1 allows privileged local attackers to execute arbitrary code.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Samsung Samsung Mobile

Products

Android Samsung Mobile Devices

CVE-2026-20498

Privilege Escalation in MediaTek geniezone

In geniezone, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10900493; Issue ID: MSV-6765.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Mediatek Mediatek, Inc.

Products

Mt6991 Mt6991 Firmware Mt8768 and 18 more

CVE-2026-20473

Display Memory Corruption in MediaTek Chipsets Leading to Local Privilege Escalation

In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11019722; Issue ID: MSV-7759.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Mediatek Mediatek, Inc.

Products

Mt6991 Mt6991 Firmware Mt6993 and 32 more

CVE-2026-74965

Privilege escalation in the Shell Integration component

Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-74963

Same-origin policy bypass in the Networking: Cookies component

Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-74958

Information disclosure in the WebRTC component

Information disclosure in the WebRTC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-74956

Same-origin policy bypass in the DOM: Service Workers component

Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-74955

Privilege escalation in the Request Handling component

Privilege escalation in the Request Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-74954

Information disclosure due to side-channel in the Storage: Cache API component

Information disclosure due to side-channel in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-74950

Privilege escalation in the Downloads API component

Privilege escalation in the Downloads API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-74947

Privilege escalation due to invalid pointer in the Graphics component

Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-74938

Mitigation bypass in the JavaScript: GC component

Mitigation bypass in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-74937

Use-after-free in the JavaScript: GC component

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2025-23366

Org.jboss.hal:hal-console: wildfly hal console cross-site scripting

A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a web page that is served to other users. The attacker must be authenticated as a user that belongs to management groups “SuperUser”, “Admin”, or “Maintainer”.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Hal Management Console Jboss Data Grid Jboss Enterprise Application Platform and 1 more