Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,206 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-107051 | Not scored | Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified build) allows unauthorized attackers to arbitrarily manipulate another user's FHEM home-automation control configurations. | Oct 29, 2026 |
| CVE-2026-107050 | Not scored | An issue in libretro RetroArch v1.22.2 allows attackers to force another user into loading attacker-supplied code in their uid, leading to arbitrary code execution. | Oct 29, 2026 |
| CVE-2026-107049 | Not scored | An issue in Forkyz versionCode 8500000 allows attackers to arbitrarily change another user's storage settings via supplying a crafted URI string. | Oct 29, 2026 |
| CVE-2026-107048 | Not scored | An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted POST request. | Oct 29, 2026 |
| CVE-2026-107047 | 7.5 High | Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanism and log data. | Oct 29, 2026 |
| CVE-2026-107046 | Not scored | A Server-Side Request Forgery (SSRF) in the url/title/author/coverUrl component of FocusPodcast versionCode 70allows attackers to scan internal resources via supplying a crafted URL. | Oct 29, 2026 |
| CVE-2026-107045 | Not scored | Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62) allows unauthorized attackers to arbitrarily read another's Nostr event database. | Oct 29, 2026 |
| CVE-2026-107044 | Not scored | Insecure permissions in ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allows unauthorized attackers to arbitrarily manipulate the app's MAXS command/transport mechanism. | Oct 29, 2026 |
| CVE-2026-107043 | Not scored | Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's SMS-code-capture mechanism. | Oct 29, 2026 |
| CVE-2026-107042 | 7.5 High | Insecure permissions in USP Ultimate Screenshot Painter versionCode 240213.009 allows unauthorized attackers to move or overwrite files in another user's private storage via supplying a crafted content URI. | Oct 29, 2026 |
| CVE-2026-107041 | Not scored | Insecure permissions in the FeatureActionActivity component of Oasis Feng Island versionCode 51801 allows unauthorized attackers to arbitrarily force a freeze in the device, leading to a Denial of Service (DoS). | Oct 29, 2026 |
| CVE-2026-107040 | Not scored | Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow. | Oct 29, 2026 |
| CVE-2026-107039 | Not scored | Insecure permissions in the ActivityMain component of M66B/Marcel Bokhorst NetGuard no-root firewall versionCode 2026080101/versionName 2.337 allows unauthorized attackers to arbitrarily force a device reset or Denial of Service (DoS). | Oct 29, 2026 |
| CVE-2026-107038 | Not scored | Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of application data. | Oct 29, 2026 |
| CVE-2026-107037 | 7.5 High | Insecure permissions in the NotificationHelper component of NoNonsense Notes versionCode 72600 allows unauthorized attackers to write in another user's notes via supplying a note id. | Oct 29, 2026 |
| CVE-2026-107036 | Not scored | Insecure permissions in Mission Control / AIMSICD versionCode 2026080501 allows unauthorized attackers to invoke an exported component, impacting the tracker blocker mechanism of the application. | Oct 29, 2026 |
| CVE-2026-107035 | Not scored | Insecure permissions in the object/Page.java component of MBasov OMN Outline notes Markdown versionCode 3400 allows unauthorized attackers to arbitrarily write content into another user's private storage via a crafted payload. | Oct 29, 2026 |
| CVE-2026-107034 | Not scored | Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauthorized attackers to arbitrarily read another user's note data. | Oct 29, 2026 |
| CVE-2026-107033 | Not scored | Insecure permissions in the MirakelInternalContentProvider component of Mirakel v3.0 (versionCode 60) allows unauthorized attackers to arbitrarily read and modify another user's task database. | Oct 29, 2026 |
| CVE-2026-107032 | 9.1 Critical | Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow. | Oct 29, 2026 |
| CVE-2026-107030 | Not scored | Insecure permissions in craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) allows unauthorized attackers to trigger the OTP-clipboard (One-Time Password) mechanism, causing a desynchronization of the timing. | Oct 29, 2026 |
| CVE-2026-107029 | Not scored | Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting. | Oct 29, 2026 |
| CVE-2026-107028 | Not scored | Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows unauthorized attackers to invoke an exported component, leading to manipulation of the shopping-list data. | Oct 29, 2026 |
| CVE-2026-107027 | Not scored | Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting. | Oct 29, 2026 |
| CVE-2026-107026 | 7.5 High | Insecure permissions in Share to Clipboard v1.14.1 (versionCode 32) allows unauthorized attackers to arbitrarily overwrite another user's clipboard content. | Oct 29, 2026 |
| CVE-2026-107025 | Not scored | Insecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) allows unauthorized attackers to export the application's data. | Oct 29, 2026 |
| CVE-2026-107024 | Not scored | Insecure permissions in Share 2 Archive Today versionCode 61 allows unauthorized attackers to arbitrarily overwrite another user's clipboard content via supplying a crafted URL. | Oct 29, 2026 |
| CVE-2026-107023 | Not scored | Insecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 allows unauthorized attackers to arbitrarily read another user's private notes/tasks/diary content. | Oct 29, 2026 |
| CVE-2026-107021 | Not scored | Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbitrarily read flashcards across the user's entire memorization database. | Oct 29, 2026 |
| CVE-2026-107020 | 7.5 High | An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader versionCode 116 allows attackers to force victim users into fetching a crafted URL. | Oct 29, 2026 |
| CVE-2026-107019 | Not scored | Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthorized attackers to create forged holiday/work-time entries via crafted ICS imports. | Oct 29, 2026 |
| CVE-2026-107018 | Not scored | Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read and write files inside the commander's private storage. | Oct 29, 2026 |
| CVE-2026-107017 | Not scored | Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers to arbitrarily trigger another user's configured automated actions. | Oct 29, 2026 |
| CVE-2026-107016 | Not scored | Insecure permissions in Fossify v1.3.0 allows unauthorized attackers to access and read another user's stored contacts. | Oct 29, 2026 |
| CVE-2026-107015 | 9.1 Critical | Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in another user's' note database. | Oct 29, 2026 |
| CVE-2026-107014 | Not scored | Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read notes in another user's' note database. | Oct 29, 2026 |
| CVE-2026-118589 | 6.9 Medium | nschloe meshio VTK Reader _vtk_42.py memory allocation | Oct 28, 2026 |
| CVE-2026-118586 | 6.9 Medium | dfm feedfinder2 feedfinder2.py find_feeds server-side request forgery | Oct 28, 2026 |
| CVE-2026-118585 | 5.1 Medium | configuroweb inventariobasico Add Product addlist.php cross site scripting | Oct 28, 2026 |
| CVE-2026-86983 | Not scored | A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length. This vulnerability is addressed in swift-crypto version 5.0.3. | Oct 28, 2026 |
| CVE-2026-118579 | 9.3 Critical | D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoor | Oct 28, 2026 |
| CVE-2026-118578 | 5.3 Medium | maotoumao MusicFreeDesktop Request Forwarder information disclosure | Oct 28, 2026 |
| CVE-2026-82411 | 6.5 Medium | Objects API: Cross-object-type authorization bypass on the object history-detail endpoint | Oct 28, 2026 |
| CVE-2026-85749 | 8.1 High | MailWatch: IDOR lets any authenticated user release or delete another tenant's quarantined mail | Oct 28, 2026 |
| CVE-2026-55561 | 5.3 Medium | InvoicePlane: Guest user IDOR in quote approval and rejection | Oct 28, 2026 |
| CVE-2026-75520 | 5.4 Medium | Domoticz: Missing authorization and path traversal in the udevices Lua parser handler | Oct 28, 2026 |
| CVE-2026-118577 | 5.3 Medium | maotoumao MusicFreeDesktop Request Forwarder server-side request forgery | Oct 28, 2026 |
| CVE-2026-118538 | 5.1 Medium | a2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributes | Oct 28, 2026 |
| CVE-2026-61575 | 4.7 Medium | AVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titles | Oct 28, 2026 |
| CVE-2026-61569 | 7.5 High | AVideo-Encoder: pre-authentication streamer-login SQL injection | Oct 28, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.