79369 matches found
CVE-2026-66832
When the Mira Android app opens in-app WebView content e.g., shop redirect flows, the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web...
CVE-2026-64934 Mira Hormone Monitor, Mira Android App Reliance on untrusted inputs in a security decision
The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version from the device itself. An authenticated attacker could submit arbitrary firmware version strings for their own device, allowing them to...
CVE-2026-66832 Mira Hormone Monitor, Mira Android App Use of GET request method with sensitive query strings
When the Mira Android app opens in-app WebView content e.g., shop redirect flows, the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web...
CVE-2026-66832
When the Mira Android app opens in-app WebView content e.g., shop redirect flows, the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web...
CVE-2026-66832
CVE-2026-66832 affects Mira Android app WebView usage. The in-app WebView can leak session information: the live session token is appended to the navigated URL as a query parameter, and a persistent user identifier is placed in the WebView’s User-Agent header. These data are transmitted to third-...
EUVD-2026-56978
When the Mira Android app opens in-app WebView content e.g., shop redirect flows, the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web...
CVE-2026-66832 Mira Hormone Monitor, Mira Android App Use of GET request method with sensitive query strings
When the Mira Android app opens in-app WebView content e.g., shop redirect flows, the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web...
Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing
Cybersecurity researchers have discovered a new version of the Kimwolf/AISURU Android and Internet of Things IoT botnet that comes with significant improvements to improve its operational resilience and conduct distributed denial-of-service DDoS attacks. The new version, tracked as Kimwolf v7, wa...
CVE-2026-71391
A flaw was found in GNU Emacs, specifically in GNU Emacs for Android. An off-by-one error can occur when a specially crafted font file is processed due to an improper bounds check. This can cause a heap-based buffer over-read, exposing heap memory contents. Mitigation Do not load untrusted font...
CVE-2026-71393
A flaw was found in GNU Emacs, specifically in GNU Emacs for Android. An integer overflow can occur when a specially crafted font file is processed on 32-bit systems due to an improper overflow checking. This can cause an undersized heap allocation and subsequently a heap-based buffer overflow,...
CVE-2026-71392
A flaw was found in GNU Emacs, specifically in GNU Emacs for Android. An integer overflow can occur when a specially crafted font file is processed on 32-bit systems due to an unguarded addition during memory allocation. This can cause an undersized heap allocation and subsequently a heap-based...
CVE-2026-71394
A flaw was found in GNU Emacs, specifically in GNU Emacs for Android. The parser can return a structure with uninitialized heap memory when a specially crafted font file is processed due to an improper validation. This can lead to the use of uninitialized heap data, potentially resulting in...
CVE-2026-65768
Improper limitation of a pathname to a restricted directory 'path traversal' in Microsoft Teams for Android allows an unauthorized attacker to execute code over a network...
CVE-2026-65767
Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Teams for Android allows an authorized attacker to perform spoofing over a network...
CVE-2026-65767
Microsoft Teams for Android is affected by CVE-2026-65767 due to improper neutralization of input during web page generation (XSS). Attack requires network access with low privileges and no user interaction; an authorized attacker could spoof content. The CVSS v3.1 base score is 8.8 (HIGH). Affec...
CVE-2026-65767 Microsoft Teams for Android Spoofing Vulnerability
...
EUVD-2026-56774
Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Teams for Android allows an authorized attacker to perform spoofing over a network...
CVE-2026-65767 Microsoft Teams for Android Spoofing Vulnerability
...
