Threat database

CVE-2026-21063 is a medium severity vulnerability in Samsung Mobile Devices related to improper export of Android application components in the AppLock feature prior to the SMR Aug-2026 Release 1. This flaw allows physical attackers to bypass the app lock function, potentially exposing locked applications. The vulnerability is identified as CWE-926, indicating improper export of components. No specific affected versions are provided, and no official patch or remediation guidance is currently available.

CVE-2026-21062 is an authorization bypass vulnerability in the SemClipboardService component of Samsung Mobile Devices prior to the SMR August 2026 Release 1. This flaw allows local attackers with limited privileges to access clipboard data without proper authorization. The vulnerability has a medium severity rating with a CVSS score of 4.8. No official patch or remediation guidance has been provided yet. There are no known exploits in the wild at this time.

CVE-2026-21061 is a medium severity vulnerability in Samsung Mobile Devices involving improper input validation in the Samsung Dialer application prior to the SMR Aug-2026 Release 1. This flaw allows remote attackers to access SIM-related functions, but requires user interaction to trigger. No official patch or remediation level has been confirmed yet.

CVE-2026-21060 is an improper input validation vulnerability in Samsung Contacts on Samsung Mobile Devices prior to the SMR Aug-2026 Release 1. This flaw allows physical attackers to access data across multiple user profiles. The vulnerability has a medium severity with a CVSS 4.0 score of 6.7. No specific affected versions or patch information is provided in the available data.

CVE-2026-21059 is a medium severity vulnerability affecting Samsung Contacts on Samsung Mobile Devices prior to the SMR Aug-2026 Release 1. It involves improper export of Android application components, which allows local attackers to delete files with the privileges of the Samsung Contacts app.

CVE-2026-21058 is a medium severity vulnerability in Samsung Contacts on Samsung Mobile Devices prior to the SMR Aug-2026 Release 1. It involves improper input validation that allows local attackers to delete files with the privileges of the Samsung Contacts app.

Out-of-bounds write in ImsService prior to SMR Jul-2026 Release 1 allows remote attackers to potentially execute arbitrary code.

Improper input validation in Samsung Pass prior to version 5.2.10.3 allows local privileged attackers to write out-of-bounds memory.

Improper authorization in Samsung Health prior to version 7.00.0.107 allows local attackers to access connected device information.

Improper export of android application components in Bixby prior to version 4.0.70.8 allows local attackers to execute arbitrary commands with Bixby privilege.

Improper export of android application components in InputSharing prior to version 2.7.01.4 allows local attackers to access sharing data.

Improper input validation in Samsung Email prior to version 6.2.13.1 allows local attackers to create arbitrary files within the application sandbox.

Path traversal in SemClipboardService prior to SMR Jul-2026 Release 1 allows local privileged attackers to access files with system privilege.

Incorrect default permissions in WLAN security prior to SMR Jul-2026 Release 1 allows local attackers to configure TencentWifiSecurity settings.

Improper access control in SmartThingsKit prior to SMR Jul-2026 Release 1 allows local attackers to access sensitive information.

Out-of-bounds write in libpadm.so library prior to SMR Jul-2026 Release 1 allows local attackers to execute arbitrary code.

Out-of-bounds write in parsing DNG format in libimagecodec.media.quram.so prior to SMR Jul-2026 Release 1 allows remote attackers to write out-of-bounds memory.

Time-of-check time-of-use race condition in fabricKeymaster trustlet prior to SMR Jul-2026 Release 1 allows local privileged attackers to execute arbitrary code.

Out-of-bounds write in parsing TIFF format in libimagecodec.media.quram.so prior to SMR Jul-2026 Release 1 allows remote attackers to write out-of-bounds memory.

Improper authorization in KnoxGuardManager prior to SMR Jul-2026 Release 1 allows local attackers to bypass the persistence configuration of the application.