CVE-2026-54375

VitaFit Android application com.vt.vitafit before 2.8.1.0 contains an insecure session management vulnerability that allows attackers to extract or intercept unencrypted msessionid tokens stored in application backups, which remain valid for ten years. Attackers can use a stolen session token to...

CVE-2026-54376

VitaFit Android application com.vt.vitafit before 2.8.1.0 contains an insecure custom URI scheme vulnerability that allows a malicious application to intercept Fitbit login tokens by registering the same callback scheme vitafit://vtio.cn. Attackers can capture the 30-day Fitbit authorization toke...

CVE-2026-54373

VitaFit Android application com.vt.vitafit before 2.8.1.0 contains a cleartext traffic vulnerability that allows network-based attackers to intercept or modify unencrypted HTTP communications due to the absence of an Android network security configuration. Attackers on an untrusted network can...

CVE-2026-54372

VitaFit Android application com.vt.vitafit before 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability that allows network-based attackers to intercept and modify HTTPS traffic by exploiting a custom X509TrustManager that trusts all certificates and a hostname verifier that...

CVE-2026-54376

The VitaFit Android application (com.vt.vitafit) versions prior to 2.8.1.0 is vulnerable to an insecure custom URI scheme vulnerability. A malicious application can register the same callback scheme (vitafit://vtio.cn ) to intercept Fitbit login tokens. By capturing the 30-day Fitbit authorizatio...

CVE-2026-54375

The VitaFit Android application (com.vt.vitafit) versions prior to 2.8.1.0 is vulnerable to an insecure session management flaw. The application stores unencrypted m_session_id tokens in application backups, which remain valid for ten years. An attacker capable of accessing these backups can inte...

CVE-2026-54374 VitaFit Android < 2.8.1.0 Hardcoded Credentials Disclosure

VitaFit Android application com.vt.vitafit before 2.8.1.0 contains a hardcoded credentials vulnerability that allows attackers to extract confidential third-party integration secrets by decompiling the APK. Attackers can retrieve embedded WeChat, Tencent QQ, and Fitbit credentials from the...

CVE-2026-54374

The VitaFit Android application (com.vt.vitafit) versions prior to 2.8.1.0 is vulnerable to a hardcoded credentials disclosure. By decompiling the APK, an attacker can extract confidential third-party integration secrets, specifically for WeChat , Tencent QQ , and Fitbit . These credentials can b...

CVE-2026-54373

The VitaFit Android application (com.vt.vitafit) versions prior to 2.8.1.0 is susceptible to a cleartext traffic vulnerability . The root cause is the absence of an Android network security configuration , which allows network-based attackers to intercept or modify unencrypted HTTP communications...

CVE-2026-54372

The VitaFit Android application (com.vt.vitafit) before version 2.8.1.0 is vulnerable to insecure TLS/SSL certificate validation. The root cause is a custom X509TrustManager that trusts all certificates and a hostname verifier that accepts any hostname. This flaw allows network-based attackers to...

CVE-2026-58128

The Alan: Health Insurance for Android application (version 1.450.0 ) is vulnerable to a path traversal flaw in the exported ShareReceiverActivity . The root cause is the application's failure to sanitize the _display_name value retrieved from a shared content URI when constructing a destination ...

SUSE CVE-2026-121033

Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-121042

Incorrect authorization in Permissions in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-121053

UI misrepresentation in Transactions Platform in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-121074

Memory corruption in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-121106

Information leak in Omnibox in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to leak sensitive information via UI Interaction. Chromium security severity: Medium...

SUSE CVE-2026-121110

UI misrepresentation in Shopping in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-121116

Missing authorization in WebView in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-121165

UI misrepresentation in Mobile in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-121229

Memory corruption in ANGLE in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...