Threat database

CVE-2026-21139 is a high-severity vulnerability in Samsung Continuity Service for Windows prior to version 4.6.1217.0. It involves improper access control that allows adjacent attackers to manipulate the connected mobile device. The vulnerability has a CVSS 4.0 base score of 7.3, indicating significant risk. No explicit affected versions or patch information is provided in the input data.

CVE-2026-21138 is a vulnerability in Samsung Mobile Smart Switch prior to version 3.7.73 where insufficient verification of data authenticity allows physical attackers to install arbitrary applications on the device. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. No patch or remediation information is provided in the available data. The vulnerability requires physical access and does not require user interaction or privileges. No known exploits are reported in the wild.

Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege.

CVE-2026-21136 is an improper authorization vulnerability in Samsung Mobile Smart Switch prior to version 3.7.73. This flaw allows physical attackers to invoke the application restore process without proper authorization. The vulnerability has a medium severity with a CVSS 4.0 base score of 6.8. No known exploits are reported in the wild. No specific affected versions were explicitly stated beyond being prior to 3.7.73.

CVE-2026-21135 is an improper access control vulnerability in Samsung Internet browser versions prior to 30.0.5.6. It allows local attackers to access sensitive information without proper authorization. The vulnerability has a medium severity with a CVSS 4.0 score of 5.9. No specific affected versions were explicitly stated beyond being prior to 30.0.5.6. There is no information about available patches or vendor advisories confirming remediation status.

CVE-2026-21134 is an improper authentication vulnerability in Samsung Flow prior to version 4.9.22.4. This flaw allows adjacent attackers to access sensitive information without proper authentication. The vulnerability has a medium severity with a CVSS 4.0 base score of 6.1.

CVE-2026-21133 is a medium severity vulnerability in Samsung Flow prior to version 4.9.22.1. It is a path traversal flaw (CWE-22) that allows local attackers to access clipboard data by improperly limiting pathname access to restricted directories.

CVE-2026-21132 is an improper input validation vulnerability in Samsung Internet browser versions prior to 30.0.5.24. This flaw allows remote attackers to inject arbitrary scripts, but requires user interaction to trigger. The vulnerability has a medium severity rating with a CVSS 4.0 score of 6. Affected versions are those before 30.0.5.24. No explicit patch information is provided in the input data.

CVE-2026-21131 is a low-severity vulnerability in Samsung Flow prior to version 4.9.22.4. It involves incorrect default permissions that allow local attackers to launch arbitrary activities with Samsung Flow privileges on a connected device.

CVE-2026-21130 is a medium severity vulnerability in Samsung Checkout prior to version 5.1.03.1. It involves improper input validation in the CreditCardRetrieveActivity component, which allows local attackers to launch arbitrary activities with Samsung Checkout privileges.

CVE-2026-21129 is a medium severity vulnerability in Samsung Checkout prior to version 5.1.03.1. It involves improper input validation in the GuestCreditCardRegisterActivity component, which allows local attackers to launch arbitrary activities with Samsung Checkout privileges.

CVE-2026-21128 is an improper input validation vulnerability in the CreditCardRegisterActivity component of Samsung Checkout prior to version 5.1.03.1. This flaw allows local attackers to launch arbitrary activities with Samsung Checkout privileges. The vulnerability has a medium severity score of 5.1 (CVSS 4.0). No known exploits or patches are currently documented.

CVE-2026-21127 is a vulnerability in Samsung Account prior to version 15.7.01.1 where improper export of Android application components allows local attackers to access sensitive data. The issue is classified under CWE-926, indicating improper export of components. The vulnerability has a CVSS 4.0 base score of 6.9, reflecting a medium severity level. No patch or remediation details are provided in the available data.

CVE-2026-21126 is an improper input validation vulnerability in Samsung Mobile Devices affecting the libsimba.heifdec.media.samsung.so component prior to the SMR Oct-2026 Release 1. This flaw allows local attackers to write out-of-bounds memory, potentially leading to memory corruption. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. No official patch or remediation details are provided in the available data.

CVE-2026-21125 is a high-severity vulnerability in Samsung Mobile Devices involving improper input validation in the parsing of 'sheifd' within the library libsimba.heifdec.media.samsung.so. This flaw affects versions prior to the Samsung Mobile Security Release (SMR) October 2026 Release 1. It allows local attackers to potentially execute arbitrary code on the device without requiring user interaction or elevated privileges.

CVE-2026-21124 is a high-severity vulnerability in Samsung Mobile Devices involving improper input validation in the component libsimba.heifdec.media.samsung.so. This flaw affects the process of obtaining cover images and can allow local attackers to potentially execute arbitrary code. The vulnerability exists in versions prior to the SMR Oct-2026 Release 1. No known exploits are reported in the wild, and no patch links are provided in the available data.

CVE-2026-21123 is a medium severity vulnerability in Samsung Mobile Devices involving improper privilege management in the Locksettings component. It affects devices prior to the SMR Oct-2026 Release 1. Local attackers with root privileges can access data of the tied profile before the device's first unlock. The vulnerability does not require user interaction and has a low attack complexity. No known exploits are reported in the wild.

CVE-2026-21122 is a high-severity vulnerability involving an out-of-bounds write in the libsamsungtts.so component of Samsung Mobile Devices. This flaw exists in versions prior to the SMR Oct-2026 Release 1. It allows local attackers to execute arbitrary code on affected devices without requiring user interaction or elevated privileges.

CVE-2026-21121 is a medium severity vulnerability in Samsung Mobile Devices involving improper handling of insufficient permissions in the CmcCore component prior to the SMR Oct-2026 Release 1. This flaw allows local attackers to access privileged APIs without proper authorization.

CVE-2026-21120 is a use-after-free vulnerability in the WSM service of Samsung Mobile Devices prior to the SMR October 2026 Release 1. This flaw allows local attackers to potentially execute arbitrary code with system privileges. The vulnerability has a high severity score of 8.9 according to CVSS 4.0. No specific affected versions or patch information is provided.