CVE-2026-85153

The Schmooze dating mobile application contains a vulnerability caused by the use of hardcoded credentials and cryptographic keys within the client application. An unauthenticated remote attacker can exploit this by decompiling the distributed application package to extract the embedded secrets. ...

CVE-2026-10580

WordPress - Hippoo Mobile App for WooCommerce = 1.9.4 - Authentication Bypass to Admin Account Takeover Overview This tool is a proof-of-concept exploit for CVE-2026-10580 , an authentication bypass vulnerability affecting the Hippoo Mobile App for WooCommerce WordPress plugin versions = 1.9.4. T...

CVE-2026-105571

A flaw has been found in PickMall Lilishop up to 4.2.4. The impacted element is an unknown function of the file /buyer/passport/member/bindMobile of the component Mobile Binding. This manipulation of the argument Username causes improper authorization. It is possible to initiate the attack...

CVE-2026-105571 PickMall Lilishop Mobile Binding bindMobile improper authorization

A flaw has been found in PickMall Lilishop up to 4.2.4. The impacted element is an unknown function of the file /buyer/passport/member/bindMobile of the component Mobile Binding. This manipulation of the argument Username causes improper authorization. It is possible to initiate the attack...

EUVD-2026-92918

A flaw has been found in PickMall Lilishop up to 4.2.4. The impacted element is an unknown function of the file /buyer/passport/member/bindMobile of the component Mobile Binding. This manipulation of the argument Username causes improper authorization. It is possible to initiate the attack...

CVE-2026-105571 PickMall Lilishop Mobile Binding bindMobile improper authorization

A flaw has been found in PickMall Lilishop up to 4.2.4. The impacted element is an unknown function of the file /buyer/passport/member/bindMobile of the component Mobile Binding. This manipulation of the argument Username causes improper authorization. It is possible to initiate the attack...

CVE-2026-105571

PickMall Lilishop versions up to 4.2.4 are vulnerable to an improper authorization flaw within the Mobile Binding component. The issue originates from an unknown function in the /buyer/passport/member/bindMobile file, where manipulation of the Username argument allows for unauthorized access. Thi...

CVE-2026-105571 PickMall Lilishop Mobile Binding bindMobile improper authorization

A flaw has been found in PickMall Lilishop up to 4.2.4. The impacted element is an unknown function of the file /buyer/passport/member/bindMobile of the component Mobile Binding. This manipulation of the argument Username causes improper authorization. It is possible to initiate the attack...

PT-2026-106750

Name of the Vulnerable Software and Affected Versions Microsoft UFO versions prior to 3.0.9 Description The press key tool in ufo/client/mcp/http servers/mobile mcp server.py accepts a free-form key code parameter and passes it to adb shell input keyevent. The adb client joins the arguments into ...

PT-2026-106311

A flaw has been found in PickMall Lilishop up to 4.2.4. The impacted element is an unknown function of the file /buyer/passport/member/bindMobile of the component Mobile Binding. This manipulation of the argument Username causes improper authorization. It is possible to initiate the attack...

PT-2026-106738

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the type text and launch app tools in ufo/client/mcp/http servers/mobile mcp server.py pass the authenticated caller-controlled text and package name parameters into adb shell comma...

CVE-2026-106427: Unintended Proxy or Intermediary

Confused deputy in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. Chromium security severity: Low...

CVE-2026-106387: Missing Authorization

Missing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106397: Incorrect Authorization

Incorrect authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106353: Improper Input Validation

Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a co-installed app. Chromium security severity: Low...

PT-2026-107059

Missing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

PT-2026-106978

UI misrepresentation in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Low...

PT-2026-107099

Confused deputy in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. Chromium security severity: Low...

PT-2026-106867

Information leak in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via physical access. Chromium security severity: Low...

PT-2026-106881

Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic. Chromium security severity: Medium...