CVE Notifier

CVE-2026-0187 CWE-? N/A

CVE-2026-0187

In gsa_sw_pk_hash_compare of image-auth-srv.c, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User …

cve.org Google:Android 15 Sep 2026

CVE-2026-0186 CWE-? N/A

CVE-2026-0186

In ac_init_one_sswrp of init.c, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is …

cve.org Google:Android 15 Sep 2026

CVE-2026-0183 CWE-? N/A

CVE-2026-0183

In CPM, there is a possible information disclosure due to a confused deputy. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

cve.org Google:Android 15 Sep 2026

CVE-2026-0179 CWE-? N/A

CVE-2026-0179

In Bootloader, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploit…

cve.org Google:Android 15 Sep 2026

CVE-2026-0177 CWE-? N/A

CVE-2026-0177

In do_sss_aes_gcm_256_op of crypto-aes.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is…

cve.org Google:Android 15 Sep 2026

CVE-2026-0171 CWE-? N/A

CVE-2026-0171

In multiple locations, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for…

cve.org Google:Android 15 Sep 2026

CVE-2026-0170 CWE-? N/A

CVE-2026-0170

In Vp9DecodeFrameTag of vp9hwd_headers.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User int…

cve.org Google:Android 15 Sep 2026

CVE-2026-0159 CWE-? N/A

CVE-2026-0159

In Cellular Modem, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploi…

cve.org Google:Android 15 Sep 2026

CVE-2026-68533 CWE-862 N/A

Missing Authorization in Concrete CMS versions below 9.5.3 Conversation File Upload Allows File Import Without the Add Message Attachments Permission

Concrete CMS below 9.5.3 conversation attachment uploaded endpoint imported files into the file manager before evaluating the "Add Message Attachments" permission, which was only checked after the file had been stored. A…

cve.org Concrete · CMS:Concrete · CMS 15 Sep 2026

CVE-2026-68534 CWE-79 N/A

Concrete CMS below 9.5.2 is vulnerable to Stored XSS via unescaped Express entry labels in association selectors

Concrete CMS before 9.5.3 rendered Express entry labels as raw HTML when displaying associated entries, resulting in stored cross-site scripting. An unauthenticated attacker could submit a payload through a public Expres…

cve.org Concrete · CMS:Concrete · CMS 15 Sep 2026

CVE-2026-81919 CWE-352 N/A

Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Block Arrangement Endpoint

Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrangement backend endpoint (the arrange() action of Concrete\Controller\Backend\Page\ArrangeBlocks). The action enforced page-edit authorization…

cve.org Concrete · CMS:Concrete · CMS 15 Sep 2026

CVE-2026-19641 CWE-116 5.3

On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legit

On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authenti…

cve.org Arista · Networks:EOS 15 Sep 2026