Export limit exceeded: 17022 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (110 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-107014 | 2026-11-02 | 9.1 Critical | ||
| Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read notes in another user's' note database. | ||||
| CVE-2026-107030 | 2026-11-02 | 7.5 High | ||
| Insecure permissions in craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) allows unauthorized attackers to trigger the OTP-clipboard (One-Time Password) mechanism, causing a desynchronization of the timing. | ||||
| CVE-2026-107036 | 2026-11-02 | 5.1 Medium | ||
| Insecure permissions in Mission Control / AIMSICD versionCode 2026080501 allows unauthorized attackers to invoke an exported component, impacting the tracker blocker mechanism of the application. | ||||
| CVE-2026-107057 | 2026-11-02 | 9.8 Critical | ||
| An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip. | ||||
| CVE-2026-107019 | 2026-11-02 | 8.8 High | ||
| Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthorized attackers to create forged holiday/work-time entries via crafted ICS imports. | ||||
| CVE-2026-107025 | 2026-11-02 | 7.5 High | ||
| Insecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) allows unauthorized attackers to export the application's data. | ||||
| CVE-2026-107046 | 2026-11-02 | 5.3 Medium | ||
| A Server-Side Request Forgery (SSRF) in the url/title/author/coverUrl component of FocusPodcast versionCode 70allows attackers to scan internal resources via supplying a crafted URL. | ||||
| CVE-2026-107041 | 2026-11-02 | 7.5 High | ||
| Insecure permissions in the FeatureActionActivity component of Oasis Feng Island versionCode 51801 allows unauthorized attackers to arbitrarily force a freeze in the device, leading to a Denial of Service (DoS). | ||||
| CVE-2026-107051 | 2026-11-02 | 7.5 High | ||
| Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified build) allows unauthorized attackers to arbitrarily manipulate another user's FHEM home-automation control configurations. | ||||
| CVE-2026-107032 | 2026-10-30 | 9.1 Critical | ||
| Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow. | ||||
| CVE-2026-113385 | 1 Leedroid Labs | 1 Shortcutter 2 App | 2026-10-20 | 5.3 Medium |
| A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android. This issue affects the function Class.forName of the file ToggleGeneric.java. The manipulation of the argument Class leads to improper export of android application components. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 9.0.90 is capable of addressing this issue. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product. | ||||
| CVE-2026-21127 | 1 Samsung Mobile | 1 Samsung Account | 2026-10-17 | N/A |
| Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive data. | ||||
| CVE-2026-45528 | 1 Google | 1 Android | 2026-09-24 | 7.3 High |
| In getManageSpaceActivityIntent of StorageManagerService.java, there is a possible LaunchAnyWhere chain due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. | ||||
| CVE-2026-21113 | 2 Samsung, Samsung Mobile | 2 Visual Voicemail, Visual Voicemail | 2026-09-23 | 5.5 Medium |
| Improper export of android application components in Visual Voicemail prior to version 20.1.00.05 allows local attackers to initiate call without proper permission. | ||||
| CVE-2026-21108 | 2 Samsung, Samsung Mobile | 2 Bixby, Bixby | 2026-09-23 | 5.5 Medium |
| Improper export of android application components in Bixby Touch prior to version 4.3.01.17 allows local attackers to access sensitive information. | ||||
| CVE-2026-68928 | 1 Acode | 1 Acode | 2026-09-21 | 8.6 High |
| Acode is a powerful text and code editor for Android. From 1.11.6 until 1.12.7, com.foxdebug.acode.rk.exec.terminal.TerminalService is declared as an exported service in src/plugins/terminal/plugin.xml without a binding permission, and src/plugins/terminal/src/android/TerminalService.java does not verify the caller. Any installed Android application can bind the service and send MSG_EXEC with an attacker-controlled cmd value, which the terminal implementation passes to ProcessBuilder with sh -c inside Acode's UID. This allows a zero-permission local application to execute commands with access to Acode private data, remote credentials, Storage Access Framework grants, and runtime permissions without additional interaction at attack time. This issue is fixed in version 1.12.7. | ||||
| CVE-2026-86701 | 1 Ntt Docomo Business | 1 Manabipocket For Parents | 2026-09-17 | N/A |
| Android application "ManabiPocket for Parents" contains an improper access control vulnerability in one of its components. A malicious application installed on the user's Android device may exploit the affected component via an Intent, potentially allowing the malicious application to obtain sensitive information from the affected application. | ||||
| CVE-2026-12960 | 1 Asus | 2 Router, Router App | 2026-09-17 | N/A |
| An Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application on the same device to send a crafted Intent that causes ASUS Router App to open an specified URL. Refer to the ' Security Update for ASUS Router Android App ' section on the ASUS Security Advisory for more information. | ||||
| CVE-2026-81301 | 1 Ekia | 1 File Manager | 2026-09-14 | N/A |
| Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as an exported Android ContentProvider without requiring caller permissions. The provider maps the caller-controlled URI path directly to a filesystem path and passes it to new File(...). It then supports query(), openFile(), and delete() operations. Because the provider is exported and lacks android:permission, android:readPermission, or android:writePermission, another local application can access the provider authority and cause File Manager's process to read, create, overwrite, or delete files that are accessible to that process. | ||||
| CVE-2026-18994 | 1 Lenovo | 1 File Manager Application | 2026-09-11 | 7.1 High |
| A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the Chinese market, that could allow a local authenticated user to read or modify protected files within the application. | ||||