CVE-2022-44666

Microsoft Windows Contacts VCF/Contact/LDAP syslink 控制 href 属性转义漏洞 CVE-2022-44666 0day. 这是一个关于另一个被遗忘的0day的故事，它在4年多前由 John Page 又名 hyp3rlinxR.1 完全公开。要理解这份报告，你必须考虑我很笨 :- 而我的笨拙驱使我走更长的路来解决简单的问题，但也让我找到了利用某些漏洞的其他方法。我为什么这么说？因为我无法迅速理解创建 .contact 文件的方法只是浏览到联系人文件夹来创建联系人，相反，我利用这些信息首先创建了一个 VCF...

OpenContacts

OpenContacts for Android 保护您的联系人隐私。 翻译 您是否希望看到这个应用以您的母语呈现？请贡献翻译。 关于 此应用将联系人与Android系统分离，存储在自己的数据库中。这样其他应用就无法访问这些联系人。可以作为默认电话（拨号器）应用的替代品使用。 我们可以从Android联系人应用中导出/导入联系人到本应用。 同时维护通话记录，因为Android通话记录应用无法显示联系人姓名。 在收到来电时也会显示联系人姓名。 最新调试应用 最新调试应用可在此处找到。 问题管理...

CVE-2026-28576-poc

CVE-2026-28576: Inyección SQL en el Contacts Provider de Android Un contacto seleccionado, todos los contactos: una puerta de compatibilidad targetSdk convierte una concesión de selección de un solo contacto en un volcado completo de la base de datos de contactos. Android 17 reforzó el Contacts...

CVE-2026-0075

CVE-2026-0075 PoC de investigación de ContactsProvider Un prototipo de investigación de Android en laboratorio controlado para evaluar el comportamiento observable asociado con CVE-2026-0075 en ContactsProvider2. Resumen CVE-2026-0075 es un problema local de elevación de privilegios en Android en...

CVE-2026-87605

Missing authorization in Contacts in Google Chrome prior to 153.0.8010...

DEBIAN-CVE-2026-87605

Missing authorization in Contacts in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially obtain sensitive information via a crafted HTML page. Chromium security severity: Low...

CVE-2026-87605

Missing authorization in Contacts in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially obtain sensitive information via a crafted HTML page. Chromium security severity: Low...

CVE-2026-87605

CVE-2026-87605 is a missing authorization vulnerability in the Contacts component of Google Chrome prior to version 153.0.8010.36 . A remote attacker who had already compromised the renderer process could, by leveraging social engineering and serving a crafted HTML page, potentially obtain sensit...

CVE-2026-87605

Missing authorization in Contacts in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially obtain sensitive information via a crafted HTML page. Chromium security severity: Low...

CVE-2026-87605

Missing authorization in Contacts in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially obtain sensitive information via a crafted HTML page. Chromium security severity: Low...

EUVD-2026-74461

Missing authorization in Contacts in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially obtain sensitive information via a crafted HTML page. Chromium security severity: Low...

Linux Distros Unpatched Vulnerability : CVE-2026-87605

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Contacts in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged socia...

PT-2026-88705

Missing authorization in Contacts in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially obtain sensitive information via a crafted HTML page. Chromium security severity: Low...

CVE-2026-73524

Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...

CVE-2026-73524 Cypht < 2.12.2 XSS via FROM Email Header in Contacts Module

Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...

CVE-2026-73524 Cypht < 2.12.2 XSS via FROM Email Header in Contacts Module

Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...

EUVD-2026-69652

Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...

CVE-2026-73524

CVE-2026-73524 is a cross-site scripting (XSS) vulnerability in Cypht (versions before 2.12.2 ), located in the contacts module . The root cause is a flawed sanitization routine that removes only the first occurrence of each angle bracket character, leaving additional angle brackets intact. An at...

EUVD-2026-67062

opensslencrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corresponding own identity is deleted. When the own identity is deleted, the shadowed contact becomes...

CVE-2026-43679

CVE-2026-43679 is a permissions-checking flaw in the FaceTime component of Apple Watch Series 6 and later . An attacker with physical access to a locked Apple Watch may be able to view user contacts. The issue was addressed with improved permissions checking and is fixed in watchOS 26.4 . The vul...