CVE-2026-49190: Improper Neutralization of Special Elements used in an OS Command

The system fails to evaluate instructional permissions over multiple internal operation codes opcodes, permitting unauthorized application installations or command executions...

PT-2026-39938

ACAP applications can gain elevated privileges due to improper input validation during the installation process, potentially leading to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if a...

CVE-2026-21002: Undefined Security Weakness

Improper verification of cryptographic signature in Galaxy Store prior to version 4.6.03.8 allows local attacker to install arbitrary application...

CVE-2025-27389: Authentication Bypass by Spoofing

A flaw exists in the verification of application installation sources within ColorOS. Under specific conditions, this issue may cause the risk detection mechanism to fail, which could allow malicious applications to be installed without proper warning...

CVE-2025-8485

An improper permissions vulnerability was reported in Lenovo App Store that could allow a local authenticated user to execute code with elevated privileges during installation of an application...

CVE-2025-8485

CVE-2025-8485 affects Lenovo App Store. Description: an improper permissions vulnerability could allow a locally authenticated user to execute code with elevated privileges during the installation of an application. Affected component: Lenovo App Store's installation process. Root cause: improper...

EUVD-2025-74044

The ACAP Application framework could allow privilege escalation through a symlink attack. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP...

EUVD-2025-74040

An ACAP configuration file has improper permissions, which could allow command injection and potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces th...

EUVD-2017-2601

Malware in sbrugna...

EUVD-2017-11868

Malware in sbrugna...

EUVD-2006-0224

Malware in sbrugna...

EUVD-2017-9774

Malware in sbrugna...

EUVD-2022-33215

Malicious code in bioql PyPI...

EUVD-2023-25601

Malicious code in bioql PyPI...

EUVD-2022-52224

Malicious code in bioql PyPI...

EUVD-2022-25973

Malicious code in bioql PyPI...

EUVD-2022-25970

Malicious code in bioql PyPI...

EUVD-2022-25969

Malicious code in bioql PyPI...

CVE-2024-34598: Undefined Security Weakness

Improper export of component in GoodLock prior to version 2.2.04.95 allows local attackers to install arbitrary applications from Galaxy Store...

CVE-2025-22442: Concurrent Execution using Shared Resource with Improper Synchronization

In multiple functions of DevicePolicyManagerService.java, there is a possible way to install unauthorized applications into a newly created work profile due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is no...