scrcpy v4.1

This GitHub repo https://github.com/Genymobile/scrcpy is the only official source for the project. Do not download releases from random websites, even if their name contains scrcpy. scrcpy v4.0 pronounced "scr een c opy " This application mirrors Android devices video and audio connected via USB ...

Exploit for Use After Free in Linux Linux_Kernel

CVE-2026-43499 for OnePlus 15 Android 16 local privilege esca...

PT-2026-58854

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx-gui is affected by an HTML injection vulnerability in the Summary tab because SummaryNode.java appends arches and perArchCount values derived from .so file path components inside an APK into an HTML panel without escaping. A malicious APK wit...

PT-2026-68702

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 151.0.7922.109 Description An out of bounds write occurs in ANGLE, a compatibility layer that allows OpenGL ES APIs to run on top of other graphics APIs. This issue allows a remote attacker to...

PT-2026-58735

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.125 Description A use after free issue in the GPU component allows a remote attacker who has already compromised the renderer process to potentially perform a sandbox escape. This is achiev...

PT-2026-58853

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the...

CVE-2026-42049: Improper Control of Generation of Code

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the...

CVE-2026-15772: Use After Free

Use after free in GPU in Google Chrome on Android prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

KLA91179 ACE vulnerability in Microsoft Browser

Arbitrary code execution vulnerability was found in Microsoft Browser. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2026-48561 Exploitation CVE list CVE-2026-48561 unknown Solution Install necessary updates from the Settings and more menu, that...

downitall-android (1.5.0), downitall-windows (1.5.0) +7 more potentially affected by CVE-2026-50023 via yt-dlp (2025.6.30)

yt-dlp PYPI version 2025.6.30 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - downitall-android 1.5.0 - downitall-windows 1.5.0 - extra-demucs =0.1.0, =3.2.3, =2.2.2, =0.1.60, =2025.7.2, =2025.7.4 Source cves: CVE-2026-500...

downitall-android (1.5.0), downitall-windows (1.5.0) +7 more potentially affected by CVE-2026-50574 via yt-dlp (2025.6.30)

yt-dlp PYPI version 2025.6.30 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - downitall-android 1.5.0 - downitall-windows 1.5.0 - extra-demucs =0.1.0, =3.2.3, =2.2.2, =0.1.60, =2025.7.2, =2025.7.4 Source cves: CVE-2026-505...

PYSEC-2026-2516 Home Assistant has stored XSS in history-graphs

Summary The "remaining charge time"-sensor for mobile phones imported/included from Android Auto it appears is vulnerable to the same issue as CVE-2025-62172. This also indicates that any sensor showing their name in the history-graph, is likely to be vulnerable to this issue. Details Another...

chainlite (0.3.6), dsparse (0.0.2) +4 more potentially affected by CVE-2026-26013 via langchain-core (0.3.12)

langchain-core PYPI version 0.3.12 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - chainlite 0.3.6 - dsparse 0.0.2 - pydocify =0.1.0, =0.4.16, =0.4.15, =0.5.38, =0.5.67 Source cves: CVE-2026-26013 Source advisory:...

Exploit for Use After Free in Linux Linux_Kernel

CVE-2026-43499 Detector Android app that detects the kernel v...

CVE-2026-22093

The EVbee Service Android app uses TLS encrypted communication HTTPS, but does not validate the certificate provided by the server. This allows an attacker on the network path between the app and EVbee server to intercept and manipulate the communication between the app and server. The traffic is...

CVE-2026-22093

CVE-2026-22093 affects EVbee Service app (v1.4.101.00). The issue arises because the Android app performs TLS/HTTPS communication but does not validate the server certificate, enabling a man‑in‑the‑middle attacker on the network path to intercept and manipulate traffic. Additionally, the app is d...

CVE-2026-22093 Adversary-in-the-Middle (AitM) attack vulnerability in EVbee Service app

The EVbee Service Android app uses TLS encrypted communication HTTPS, but does not validate the certificate provided by the server. This allows an attacker on the network path between the app and EVbee server to intercept and manipulate the communication between the app and server. The traffic is...

EUVD-2026-43325

The EVbee Service Android app uses TLS encrypted communication HTTPS, but does not validate the certificate provided by the server. This allows an attacker on the network path between the app and EVbee server to intercept and manipulate the communication between the app and server. The traffic is...

CVE-2026-22093: Improper Certificate Validation

The EVbee Service Android app uses TLS encrypted communication HTTPS, but does not validate the certificate provided by the server. This allows an attacker on the network path between the app and EVbee server to intercept and manipulate the communication between the app and server. The traffic is...

BIT-NEXTCLOUD-2026-45153 Nextcloud: PIN bypass in PassCodeActivity via back button

Nextcloud is an open source content collaboration platform. From version 33.0.0 to before version 33.1.0, after unlocking a locked Android phone the back-button could be used to bypass the Nextcloud Files app PIN. This issue has been patched in version 33.1.0...