CVE-2026-21135

MediumCVSS 5.9/10Last modified Oct 16, 2026

Description

Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information.

Metrics

CVSS 4.0 5.9/10CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-284

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 12, 2026
Last modified
Oct 16, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-211366.8Improper authorization in Smart Switch prior to version 3.7.73 allows physical attackers to invoke application restore process.CVE-2026-211375.1Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege.CVE-2026-211386.9Insufficient verification of data authenticity in Smart Switch prior to version 3.7.73 allows physical attackers to install arbitrary applicCVE-2026-211397.3Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the coCVE-2026-21149.8A vulnerability was detected in itsourcecode Society Management System 1.0. This vulnerability affects unknown code of the file /admin/edit_CVE-2026-211406.9Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitrary applications.CVE-2026-21159.8A flaw has been found in itsourcecode Society Management System 1.0. This issue affects some unknown processing of the file /admin/delete_exCVE-2026-21169.8A vulnerability has been found in itsourcecode Society Management System 1.0. Impacted is an unknown function of the file /admin/edit_expensCVE-2026-21179.8A vulnerability was found in itsourcecode Society Management System 1.0. The affected element is an unknown function of the file /admin/editCVE-2026-21187.2A vulnerability was determined in UTT HiPER 810 1.7.4-141218. The impacted element is the function sub_4407D4 of the file /goform/formReleasCVE-2026-21207.2A vulnerability was identified in D-Link DIR-823X 250416. This affects an unknown function of the file /goform/set_server_settings of the coCVE-2026-21214.4The Weaver Show Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'add_class' parameter in all versions up to,