Mobile-Security-Framework-MobSF

Mobile Security Framework MobSF Mobile Security Framework MobSF is a security research platform for Android, iOS, and Windows apps, used for mobile application security, penetration testing, malware analysis, and privacy analysis. It offers static and dynamic analysis and integrates with DevSecOp...

noia

Noia Noia is a web-based tool whose main aim is to ease the process of browsing mobile applications sandbox and directly previewing SQLite databases, images, and more. Powered by frida.re. Please note that I'm not a programmer, but I'm probably above the median in code-savyness. Try it out, open ...

httptoolkit

HTTP Toolkit !HTTP Toolkit has received funding from NLnet as part of NGI Zero...

maswe

OWASP Mobile Application Security Weakness Enumeration MASWE The OWASP Mobile Application Security Weakness Enumeration MASWE is a list of common security and privacy weaknesses in mobile applications. It is intended to be used as a reference for developers, security researchers, and security...

StaCoAn

StaCoAn Not maintained anymore! Will be archived soon. StaCoAn is a crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications. This tool will look for interesting lines in the code which can contain: Hardcoded credential...

CVE-2026-121144

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to presence of hardcoded service account credentials, API Keys and authorization tokens within the application package. An unauthenticated remote attacker could exploit this vulnerability by downloading application packag...

EUVD-2026-116907

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication tokens in application logs used for development and debugging. A local attacker with an access to logs could exploit this vulnerability by retrieving and misusing the exposed session...

EUVD-2026-116892

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to presence of hardcoded service account credentials, API Keys and authorization tokens within the application package. An unauthenticated remote attacker could exploit this vulnerability by downloading application packag...

CVE-2026-121147: Tata Motors: This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL…

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL certificate pinning in the network security configuration, resulting in ineffective certificate pinning controls. An attacker positioned to intercept network traffic could exploit this...

PT-2026-136951

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to presence of hardcoded service account credentials, API Keys and authorization tokens within the application package. An unauthenticated remote attacker could exploit this vulnerability by downloading application packag...

CVE-2026-121144: Tata Motors: This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to presence of hardcoded service account…

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to presence of hardcoded service account credentials, API Keys and authorization tokens within the application package. An unauthenticated remote attacker could exploit this vulnerability by downloading application packag...

EUVD-2026-106295

Vulnerability in the Oracle HRMS US product of Oracle E-Business Suite component: Mobile Applications. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS US. Successful...

CVE-2026-83377

Vulnerability in the Oracle HRMS US product of Oracle E-Business Suite component: Mobile Applications. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS US. Successful...

CVE-2026-83377

A vulnerability exists in the Mobile Applications component of Oracle HRMS (US) , part of the Oracle E-Business Suite, affecting versions 12.2.3-12.2.15 . A low-privileged attacker with network access via HTTP can exploit this issue to compromise the product, though the attack requires human inte...

Oracle E-Business Suite: CVE-2026-83377: Critical Patch Update

Vulnerability in the Oracle HRMS US product of Oracle E-Business Suite component: Mobile Applications. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS US. Successful...

PT-2026-119572

Vulnerability in the Oracle HRMS US product of Oracle E-Business Suite component: Mobile Applications. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS US. Successful...

Oracle HRMS (US) security vulnerabilities

The Oracle HRMS US versions 12.2.3 to 12.2.15 have security vulnerabilities. These vulnerabilities stem from issues with the Mobile Applications component. They may allow attackers with low privileges to access through the HTTP network, update, insert, or delete certain accessible data without...

UBUNTU-CVE-2026-88057

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for...

CVE-2026-88059

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering SSR and hydration u...

CVE-2026-10557 Yarbo Android/iOS Mobile Application and Cloud Infrastructure Use of Hard-coded Credentials

The Yarbo Android and iOS applications contain hard-coded MQTT broker credentials that are identical for all users and all devices. These credentials are embedded in the application binary and are readily extractable via APK decompilation. The credentials provide access to cloud MQTT brokers...