CVE-2025-26426

In BroadcastController.java of registerReceiverWithFeatureTraced, there is a possible way to receive broadcasts meant for the "android" package due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is no...

CVE-2025-26426

In BroadcastController.java of registerReceiverWithFeatureTraced, there is a possible way to receive broadcasts meant for the "android" package due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is no...

CVE-2025-26426

In BroadcastController.java of registerReceiverWithFeatureTraced, there is a possible way to receive broadcasts meant for the "android" package due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is no...

CVE-2025-26426

A vulnerability exists in the Framework component of the Android operating system within the registerReceiverWithFeatureTraced function of BroadcastController.java. Due to improper input validation (specifically related to receiving broadcasts intended for the "android" package), a local attacker...

Malicious code in com.microsoft.azure.spatial-anchors-sdk.android (npm)

The package com.microsoft.azure.spatial-anchors-sdk.android was found to contain malicious code...

Malicious code in com.google.android.appbundle (npm)

The package com.google.android.appbundle was found to contain malicious code...

Malicious code in react-native-background-geolocation-android (npm)

The package react-native-background-geolocation-android was found to contain malicious code...

MAL-2025-17324 Malicious code in com.microsoft.azure.spatial-anchors-sdk.android (npm)

The package com.microsoft.azure.spatial-anchors-sdk.android was found to contain malicious code...

New Konfety Malware Variant Evades Detection by Manipulating APKs and Dynamic Code

Cybersecurity researchers have discovered a new, sophisticated variant of a known Android malware referred to as Konfety that leverages the evil twin technique to enable ad fraud. The sneaky approach essentially involves a scenario wherein two variants of an application share the same package nam...

CVE-2023-36629

The ST ST54-android-packages-apps-Nfc package before 130-20230215-23W07p0 for Android has an out-of-bounds read...

CVE-2019-9438

In the Package Manager service, there is a possible information disclosure due to a confused deputy. This could lead to local disclosure of information about installed packages for other users with no additional execution privileges needed. User interaction is not needed for exploitation. Product...

ROADCAM X3 security vulnerabilities

ROADCAM X3 is a car recorder with HD quality and easy to carry by ROADCAM. It is used to record the process of driving, and supports video cropping, sharing and other functions. ROADCAM X3 suffers from a security vulnerability that originates from the inclusion of hard-coded FTP credentials in th...

Sylvania Smart Home security vulnerabilities

Sylvania Smart Home is a smart home control software from Sylvania. A security vulnerability exists in Sylvania Smart Home version v3.0.3, which stems from incorrect access control during firmware updates and downloads, and could allow an attacker to access sensitive information by analyzing code...

Neye3C security vulnerabilities

Neye3C is an application from Neye3C that connects to cloud cameras and DVRs by logging into the cloud. A security vulnerability exists in Neye3C version v4.5.2.0, which stems from incorrect access control during firmware updates and downloads, and allows an attacker to gain access to sensitive...

PT-2024-33143 · Ivy Smart · Ivy Smart

Name of the Vulnerable Software and Affected Versions: IVY Smart version 4.5.0 Description: The issue is related to incorrect access control in the firmware update and download processes. This allows attackers to access sensitive information by analyzing the code and data within the APK file...

CVE-2023-36629

The ST ST54-android-packages-apps-Nfc package before 130-20230215-23W07p0 for Android has an out-of-bounds read...

CVE-2023-42580

Improper URL validation from MCSLaunch deeplink in Galaxy Store prior to version 4.5.64.4 allows attackers to execute JavaScript API to install APK from Galaxy Store...

CVE-2023-21516

XSS vulnerability from InstantPlay in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from Galaxy Store...

Samsung Mobile Devices security vulnerabilities

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc. from the South Korean company Samsung SAMSUNG. A security vulnerability exists in SAMSUNG Mobile devices Galaxy Store InstantPlay versions prior to 4.5.49.8, which stems from vulnerability to a...

PT-2023-18271 · Samsung · Galaxy Store

Name of the Vulnerable Software and Affected Versions: Galaxy Store versions prior to 4.5.49.8 Description: The issue allows attackers to execute javascript API to install APK from Galaxy Store due to a vulnerable script in InstantPlay. This script can execute javascript in Galaxy Store, enabling...