CVE-2026-28630: URL Redirection to Untrusted Site

In onCreate of ContactsPickerActivity.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28650: Protection Mechanism Failure

In setHiddenWhileSuspended of WindowState.java, there is a possible overlay bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28631: URL Redirection to Untrusted Site

In buildMiniResolver of IntentForwarderActivity.java, there is a possible consent bypass due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28656: Improper Restriction of Rendered UI Layers or Frames

In multiple functions of DeviceAdminAdd.java, there is a possible way to an overlay due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

PT-2026-87384

Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to disclose information locally...

PT-2026-87361

Name of the Vulnerable Software and Affected Versions Windows Overlay Filter affected versions not specified Description A buffer over-read exists in the Windows Overlay Filter. This issue allows an authorized attacker to disclose sensitive information locally, which may subsequently affect the...

PT-2026-87409

Heap-based buffer overflow in Windows Overlay Filter allows an authorized attacker to elevate privileges over a network...

PT-2026-88225

Name of the Vulnerable Software and Affected Versions Android affected versions not specified Description Multiple functions within DeviceAdminAdd.java are susceptible to a tapjacking attack, which occurs when a malicious application overlays a transparent or deceptive window over a legitimate...

CVE-2026-69474: Use After Free

Use after free in Windows Overlay Filter allows an authorized attacker to disclose information over a network...

PT-2026-88209

In onCreate of InstallLaunch.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28572: URL Redirection to Untrusted Site

In onCreate of InstallLaunch.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-69343: Out-of-bounds Read

Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to disclose information locally...

CVE-2026-69350: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Overlay Filter allows an authorized attacker to elevate privileges locally...

CVE-2026-69371: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Overlay Filter allows an authorized attacker to elevate privileges over a network...

CVE-2026-69368: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Overlay Filter allows an authorized attacker to elevate privileges locally...

CVE-2026-69316: Buffer Over-read

Buffer over-read in Windows Overlay Filter allows an authorized attacker to disclose information locally...

CVE-2026-69373: Integer Overflow or Wraparound

Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate privileges locally...

CVE-2026-61699

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that isolates a compromised/offboarded host from a Nebula mesh. Because the blocklist never reaches any peer's config.yml, a Blocked host retains full overlay...

EUVD-2026-71720

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that isolates a compromised/offboarded host from a Nebula mesh. Because the blocklist never reaches any peer's config.yml, a Blocked host retains full overlay...

CVE-2026-61699 nebula-mesh: Certificate revocation is never enforced at the mesh

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that isolates a compromised/offboarded host from a Nebula mesh. Because the blocklist never reaches any peer's config.yml, a Blocked host retains full overlay...