97556 matches found
MAL-2026-15927 Malicious code in qoeoe (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1e6c0c50dfb4a99c6e8b2ca640cadd33877e737479d8739d5db5b39271bc967 The package ships a single module qoeoe/starts.py whose entire body is a lambda that base64-decodes a reversed 108 KB string literal and passes the...
Malicious code in astlsi (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 222a62d677f99497f67476b9cc87886c05fb2a08827430934fb518798abb8339 The package presents itself as a proxy health-check utility, but its exported starts function walks /storage/emulated/0/ Android user-storage, collec...
MAL-2026-15926 Malicious code in astlsi (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 222a62d677f99497f67476b9cc87886c05fb2a08827430934fb518798abb8339 The package presents itself as a proxy health-check utility, but its exported starts function walks /storage/emulated/0/ Android user-storage, collec...
CVE-2026-85085
The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session...
CVE-2026-85094
The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...
CVE-2026-85094
Canva Android App versions prior to 2.376.0 failed to restrict HTTP headers returned to an external origin running in a privileged WebView . An attacker who gains control of the WebView could read those headers and access a user's session . The CVSS 3.1 score is 8.8 (HIGH) , with a network vector...
EUVD-2026-70915
The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...
CVE-2026-85094
The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...
CVE-2026-85094
The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...
CVE-2026-85085
The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session...
EUVD-2026-70914
The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session...
CVE-2026-85085
The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session...
CVE-2026-85085
The Canva Android App (versions before 2.376.0 ) contained a vulnerability in a privileged WebView that allowed an external origin to be loaded. A threat actor who controls a page visited by the user can communicate with Canva using the user's session, enabling high confidentiality and integrity ...
PT-2026-85425
Name of the Vulnerable Software and Affected Versions Canva Android versions prior to 2.376.0 Description An issue exists where an external origin can be loaded within a privileged WebView, a component used to display web content inside a native application. This failure in the origin trust...
CVE-2026-85094: Improper Removal of Sensitive Information Before Storage or Transfer
The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...
CVE-2026-78745
An issue in HiDPT/ Weyon HiDPTAndroid Hi3751V350 Hi3751V352EDMO allows a remote attacker to execute arbitrary code via the Android Debug Bridge ADB daemon adbd...
Linux Distros Unpatched Vulnerability : CVE-2026-85044
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker leveraging social engineering to bypass web...
PT-2026-85426
Name of the Vulnerable Software and Affected Versions Canva Android App versions prior to 2.376.0 Description The application failed to restrict headers returned to an external origin operating within a privileged WebView. A WebView is a system component that allows Android apps to display web...
CVE-2026-85085: Improper Verification of Source of a Communication Channel
The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session...