GHSA-6HXQ-P678-4HR2 SimpleWebAuthn: Registration verification does not sufficiently ensure that attestation certificates chain to a trust anchor

Summary validateCertificatePath does not verify that an attestation's certificate chain actually terminates at a configured trust anchor. When walking the chain it stops at the first self-signed certificate it finds which could be user-supplied, and exits early. This happens before the configured...

CVE-2026-78745

An issue in HiDPT/ Weyon HiDPTAndroid Hi3751V350 Hi3751V352EDMO allows a remote attacker to execute arbitrary code via the Android Debug Bridge ADB daemon adbd...

CVE-2020-0023

CVE-2020-0022 Seems like Android 9-6 have similar Bluetooth subsystem, Android 5 and 4 are different. Android 9.0 BlueFrag experiments Patch: https://android.googlesource.com/platform/system/bt/+/3cb7149d8fed2d7d77ceaa95bf845224c4db3baf Below I hit the patched condition. OK I think I got it, but...

vulnerabilities present in Google Chrome

Google has identified several vulnerabilities in Google Chrome, particularly in versions for 152.0.7977.82. These vulnerabilities reside in various components of Google Chrome, including DevTools, Network, V8 JavaScript engine, and Transactions Platform on iOS. Attackers can exploit these...

PhoneSploit-Pro v2.3

PhoneSploit Pro The Swiss Army knife for Android. An all-in-one hacking tool written in Python to remotely take over Android devices using ADB, scrcpy, Nmap, and Metasploit-Framework. Table of contents Overview Screenshots Features Requirements Installing dependencies Getting started Device setup...

MAL-2026-15926 Malicious code in astlsi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 222a62d677f99497f67476b9cc87886c05fb2a08827430934fb518798abb8339 The package presents itself as a proxy health-check utility, but its exported starts function walks /storage/emulated/0/ Android user-storage, collec...

Malicious code in astlsi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 222a62d677f99497f67476b9cc87886c05fb2a08827430934fb518798abb8339 The package presents itself as a proxy health-check utility, but its exported starts function walks /storage/emulated/0/ Android user-storage, collec...

HydraDragonAntivirus openedr-v2-release-9

Hydra Dragon Antivirus 📚 For detailed documentation, architecture diagrams, and component guides, visit our Project Wiki. WARNING: ACTIVE DEVELOPMENT IN PROGRESS This project is not production-ready. Breaking changes, bugs, and incomplete features should be expected. ⚠️ NOTICE: This repository is...

Free streaming boxes may be routing criminal traffic through your home

“Free” movies and TV could cost you your privacy, bandwidth, and control of your home network. We've warned about illegal streaming and modded Amazon Fire TV Sticks in the past. Now, researchers have found that certain SuperBox devices and apps could quietly enroll a household connection into a...

oxo v2.9.29

OXO Scan Orchestration Engine OXO is a security scanning framework built for modularity, scalability, and simplicity. OXO Engine combines specialized tools to work cohesively to find vulnerabilities and perform actions like recon, enumeration, and fingerprinting. Documentation Agents Store CLI...

CVE-2026-85094

The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...

CVE-2026-85085

The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session...

EUVD-2026-70915

The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...

CVE-2026-85094

The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...

CVE-2026-85094

The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...

CVE-2026-85094

Canva Android App versions prior to 2.376.0 failed to restrict HTTP headers returned to an external origin running in a privileged WebView . An attacker who gains control of the WebView could read those headers and access a user's session . The CVSS 3.1 score is 8.8 (HIGH) , with a network vector...

CVE-2026-85085

The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session...

CVE-2026-85085

The Canva Android App (versions before 2.376.0 ) contained a vulnerability in a privileged WebView that allowed an external origin to be loaded. A threat actor who controls a page visited by the user can communicate with Canva using the user's session, enabling high confidentiality and integrity ...

EUVD-2026-70914

The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session...

CVE-2026-85085

The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session...