CWE-926

CWE-926 · 21 records · 19 with a public proof-of-concept

Records the NVD classes under CWE-926, highest CVSS first.

  1. CRITICAL 9.8CVE-2026-107057public PoC2026-10-29

    An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip.

    AI risk analysis on Exploit-DB.ai →

  2. CRITICAL 9.8CVE-2026-107048public PoC2026-10-29

    An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted POST request.

    AI risk analysis on Exploit-DB.ai →

  3. CRITICAL 9.1CVE-2026-107043public PoC2026-10-29

    Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's SMS-code-capture mechanism.

    AI risk analysis on Exploit-DB.ai →

  4. CRITICAL 9.1CVE-2026-107040public PoC2026-10-29

    Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow.

    AI risk analysis on Exploit-DB.ai →

  5. CRITICAL 9.1CVE-2026-107038public PoC2026-10-29

    Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of application data.

    AI risk analysis on Exploit-DB.ai →

  6. CRITICAL 9.1CVE-2026-107032public PoC2026-10-29

    Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow.

    AI risk analysis on Exploit-DB.ai →

  7. CRITICAL 9.1CVE-2026-107027public PoC2026-10-29

    Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting.

    AI risk analysis on Exploit-DB.ai →

  8. CRITICAL 9.1CVE-2026-107021public PoC2026-10-29

    Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbitrarily read flashcards across the user's entire memorization database.

    AI risk analysis on Exploit-DB.ai →

  9. CRITICAL 9.1CVE-2026-107014public PoC2026-10-29

    Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read notes in another user's' note database.

    AI risk analysis on Exploit-DB.ai →

  10. HIGH 8.8CVE-2026-107019public PoC2026-10-29

    Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthorized attackers to create forged holiday/work-time entries via crafted ICS imports.

    AI risk analysis on Exploit-DB.ai →

  11. HIGH 8.2CVE-2026-54376public PoC2026-11-04

    VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure custom URI scheme vulnerability that allows a malicious application to intercept Fitbit login tokens by registering the same callback scheme (vitafit://vtio.cn). Attackers can cap…

    AI risk analysis on Exploit-DB.ai →

  12. HIGH 7.5CVE-2026-107059public PoC2026-10-29

    An issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switch to an attacker controlled progile, bypassing authentication.

    AI risk analysis on Exploit-DB.ai →

  13. HIGH 7.5CVE-2026-107051public PoC2026-10-29

    Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified build) allows unauthorized attackers to arbitrarily manipulate another user's FHEM home-automation control configurations.

    AI risk analysis on Exploit-DB.ai →

  14. HIGH 7.5CVE-2026-107041public PoC2026-10-29

    Insecure permissions in the FeatureActionActivity component of Oasis Feng Island versionCode 51801 allows unauthorized attackers to arbitrarily force a freeze in the device, leading to a Denial of Service (DoS).

    AI risk analysis on Exploit-DB.ai →

  15. HIGH 7.5CVE-2026-107030public PoC2026-10-29

    Insecure permissions in craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) allows unauthorized attackers to trigger the OTP-clipboard (One-Time Password) mechanism, causing a desynchronization of the timing.

    AI risk analysis on Exploit-DB.ai →

  16. HIGH 7.5CVE-2026-107025public PoC2026-10-29

    Insecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) allows unauthorized attackers to export the application's data.

    AI risk analysis on Exploit-DB.ai →

  17. MEDIUM 6.5CVE-2026-107033public PoC2026-10-29

    Insecure permissions in the MirakelInternalContentProvider component of Mirakel v3.0 (versionCode 60) allows unauthorized attackers to arbitrarily read and modify another user's task database.

    AI risk analysis on Exploit-DB.ai →

  18. MEDIUM 5.3CVE-2026-107046public PoC2026-10-29

    A Server-Side Request Forgery (SSRF) in the url/title/author/coverUrl component of FocusPodcast versionCode 70allows attackers to scan internal resources via supplying a crafted URL.

    AI risk analysis on Exploit-DB.ai →

  19. MEDIUM 5.3CVE-2026-1133852026-10-20

    A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android. This issue affects the function Class.forName of the file ToggleGeneric.java. The manipulation of the argument Class leads to improper export of android application components…

    AI risk analysis on Exploit-DB.ai →

  20. MEDIUM 5.1CVE-2026-107036public PoC2026-10-29

    Insecure permissions in Mission Control / AIMSICD versionCode 2026080501 allows unauthorized attackers to invoke an exported component, impacting the tracker blocker mechanism of the application.

    AI risk analysis on Exploit-DB.ai →

  21. UNSCOREDCVE-2026-211272026-10-12

    Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive data.

    AI risk analysis on Exploit-DB.ai →