Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.1AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.Check if you run itEPSS 0.49%Mar 16, 2026
- Medium4.3Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly validate User-Agent header tokens which allows an authenticated attacker t…Check if you run itEPSS 0.33%Mar 16, 2026
- Medium4.3Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to bound memory allocation when processing DOC files which allows an authenticated att…Check if you run itEPSS 0.31%Mar 16, 2026
- High8.7GROWI OpenAI thread/message API endpoints do not perform authorization.Check if you run itEPSS 0.34%Mar 16, 2026
- High7.5Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly handle very long passwords, which allows an attacker to overload the serve…Check if you run itEPSS 0.32%Mar 16, 2026
- High7.1Path traversal in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to overwrite arbitrary files with Smart Switch privilege.Check if you run itEPSS 0.26%Mar 16, 2026
- Medium6.9Improper authentication in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to trigger a denial of service.Check if you run itEPSS 0.21%Mar 16, 2026
- Medium5.9Improper verification of cryptographic signature in Galaxy Store prior to version 4.6.03.8 allows local attacker to install arbitrary application.Check if you run itEPSS 0.08%Mar 16, 2026
- Medium5.9Path traversal in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file with Galaxy Store privilege.Check if you run itEPSS 0.14%Mar 16, 2026
- High7.0Improper access control in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file with Galaxy Store privilege.Check if you run itEPSS 0.15%Mar 16, 2026
- High7.1Authentication bypass by replay in Smart Switch prior to version 3.7.69.15 allows remote attackers to trigger privileged functions.Check if you run itEPSS 0.36%Mar 16, 2026
- High7.1Improper authentication in Smart Switch prior to version 3.7.69.15 allows remote attackers to bypass authentication.Check if you run itEPSS 0.64%Mar 16, 2026
- Medium5.3Improper verification of cryptographic signature in Smart Switch prior to version 3.7.69.15 allows remote attackers to potentially bypass authentication.Check if you run itEPSS 0.30%Mar 16, 2026
- High7.1Use of a broken or risky cryptographic algorithm in Smart Switch prior to version 3.7.69.15 allows remote attackers to configure a downgraded scheme for authentication.Check if you run itEPSS 0.19%Mar 16, 2026
- Medium5.3Exposure of sensitive functionality to an unauthorized actor in Smart Switch prior to version 3.7.69.15 allows remote attackers to set a specific configuration.Check if you run itEPSS 0.33%Mar 16, 2026
- Medium4.8Improper export of android application components in Samsung Assistant prior to version 9.3.10.7 allows local attacker to access saved information.Check if you run itEPSS 0.11%Mar 16, 2026
- Medium4.8Improper authorization in Settings prior to SMR Mar-2026 Release 1 allows local attacker to disable configuring the background data usage of application.Check if you run itEPSS 0.10%Mar 16, 2026
- Medium6.7Improper privilege management in ThemeManager prior to SMR Mar-2026 Release 1 allows local privileged attackers to reuse trial contents.Check if you run itEPSS 0.14%Mar 16, 2026
- High8.4Improper export of android application components in Secure Folder prior to SMR Mar-2026 Release 1 allows local attackers to launch arbitrary activity with Secure Folder privilege.Check if you run itEPSS 0.18%Mar 16, 2026
- Medium5.1Improper verification of cryptographic signature in Font Settings prior to SMR Mar-2026 Release 1 allows physical attackers to use custom font.Check if you run itEPSS 0.13%Mar 16, 2026
- Medium6.8Improper verification of intent by broadcast receiver in Settings prior to SMR Mar-2026 Release 1 allows local attacker to launch arbitrary activity with Settings privilege.Check if you run itEPSS 0.10%Mar 16, 2026
- Medium5.5in OpenHarmony v6.0 and prior versions allow a local attacker case DOS through missing release of memory.Check if you run itEPSS 0.17%Mar 16, 2026
- Medium5.0Microsoft Edge (Chromium-based) for Android Spoofing VulnerabilityCheck if you run itEPSS 0.27%Mar 16, 2026
- Medium5.3Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service (client crash).Check if you run itEPSS 0.32%Mar 16, 2026
- Medium5.5in OpenHarmony v5.1.0 and prior versions allow a local attacker cause DOS through improper input.Check if you run itEPSS 0.17%Mar 16, 2026
Sort