PT-2026-99291

Name of the Vulnerable Software and Affected Versions Capgo CLI versions prior to 7.98.3 Description The Android onboarding flow contains an over-permissioned service account. During Google OAuth onboarding, the CLI assigns the CAN MANAGE DRAFT APPS GLOBAL permission passed via the...

exploit-gym

Smart-contract exploitation gym self-play, verifiable-reward...

CVE-2026-92751

CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of authenticated operators. Attackers can craft hidden forms that submit to destructive endpoints like topic deletion and cluster configuration changes,...

EUVD-2026-81023

CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of authenticated operators. Attackers can craft hidden forms that submit to destructive endpoints like topic deletion and cluster configuration changes,...

CVE-2026-92751 CMAK through 3.0.0.6 Cross-Site Request Forgery via Missing CSRF Filter

CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of authenticated operators. Attackers can craft hidden forms that submit to destructive endpoints like topic deletion and cluster configuration changes,...

CVE-2026-92751 CMAK through 3.0.0.6 Cross-Site Request Forgery via Missing CSRF Filter

CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of authenticated operators. Attackers can craft hidden forms that submit to destructive endpoints like topic deletion and cluster configuration changes,...

CVE-2026-92751

CMAK (Yahoo's Kafka management tool) through version 3.0.0.6 lacks a cross-site request forgery (CSRF) filter, enabling attackers to craft hidden forms that trigger state-changing actions on behalf of authenticated operators. Destructive endpoints such as topic deletion and cluster configuration ...

Astra Linux – Vulnerability in liblivemedia

In Live Networks, Inc., liblivemedia version 20200625, there is a potential buffer overflow bug in the server’s handling of the RTSP “PLAY” command, especially when the command specifies seeking by absolute time...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: PNP: Fixed a name memory leak in pnpallocdev. After committing change 1fa5ae857bb1 “Driver core: get rid of struct device’s busid string array”, the name of the device is allocated dynamically. devsetname was moved after pnpaddid...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10

In the Linux kernel, the following vulnerability has been resolved: media: av7110: prevent underflow in writetstodecoder The value of buf4 comes from the user via tsplay. This value is within the u8 range. The final length that we pass to av7110ipackinstantrepack is “len – buf4 + 1 – 4”. Therefor...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: nfc: nfcmrvl: Fixed a memory leak in nfcmrvlplaydeferred. Similar to the handling of playdeferred in commit 19cfe912c37b “Bluetooth: btusb: Fixed a memory leak in playdeferred”, we thought a patch might be necessary here as well...

Astra Linux – Vulnerability in wpa, pupnp-1.8

The Open Connectivity Foundation’s UPnP specification prior to April 17, 2020, does not prohibit the acceptance of a subscription request with a delivery URL located in a different network segment than the fully qualified event-subscription URL. This is known as the “CallStranger” issue...

Google Play Early Access Abused to Push Thousands of Deceptive Android Apps

Bad actors are misusing Google Play's Early Access program to push deceptive apps that claim to offer money, rewards, casino winnings, and premium content. Early Access apps are apps that haven't been released on the official Android app marketplace. The main idea behind the program is for...

CVE-2026-68830: Improper Link Resolution Before File Access

Improper link resolution before file access 'link following' in Windows Universal Plug and Play UPnP Device Host allows an authorized attacker to disclose information locally...

CVE-2026-69351: Exposure of Private Personal Information to an Unauthorized Actor

Exposure of private personal information to an unauthorized actor in Windows Universal Plug and Play UPnP Device Host allows an authorized attacker to disclose information locally...

Sideloading on Android: What it is, why it’s risky, and how to do it more safely

A Google spokesperson announced on Reddit that it has started rolling out the first version of its Advanced Flow, designed to make installing apps from unverified developers safer. Let us explain what sideloading is, why Google Play is not 100% safe, what to look for when you’re sideloading so yo...

Researchers Turn USB Auto-Install Into a Full SYSTEM Takeover on Windows 11

Windows Plug and Play can be abused to fetch signed vendor software for an emulated USB device and execute privileged installation components that researchers chained to SYSTEM access on a fully updated Windows 11 machine. The same PnP path can be triggered over Remote Desktop without physical...

IT threat evolution in Q2 2026. Mobile statistics

IT threat evolution in Q2 2026. Mobile statistics IT threat evolution in Q2 2026. Non-mobile statistics The mobile section of the quarterly cyberthreat report includes statistics on malware, adware, and potentially unwanted software for Android, as well as descriptions of the most notable threats...

Exploit for CVE-2017-8464

CVE-2017-8464 / research + PoC Tạo 1 Shortcut + 1 .DLL chứa...

Android Security Bulletin—August 2026Stay organized with collectionsSave and categorize content based on your preferences.

This Android Security Bulletin contains details of security vulnerabilities that affect Android devices. Security patch levels of 2026-08-05 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Within 48 hours afte...