99136 matches found
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root
A crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same or later archive could traverse that symlink to reach host paths the build user could write to. The root cause was the sanitizePath...
Android Automotive OS Update Bulletin—May 2026Stay organized with collectionsSave and categorize content based on your preferences.
The Android Automotive OS AAOS Update Bulletin contains details of security vulnerabilities affecting the Android Automotive OS platform. The full AAOS update comprises the security patch level of 2026-05-05 or later from the May 2026 Android Security Bulletin in addition to all issues in this...
Wear OS Security Bulletin—May 2026Stay organized with collectionsSave and categorize content based on your preferences.
The Wear OS Security Bulletin contains details of security vulnerabilities affecting the Wear OS platform. The full Wear OS update comprises the security patch level of 2026-05-05 or later from the May 2026 Android Security Bulletin in addition to all issues in this bulletin. We encourage all...
MAL-2026-3247 Malicious code in metoopro (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 6e089d4b8b0fe90a96024c1160f198df5ab7ec0b30f1f5765cf81ef4aa640279 Designed to run on Android. Under the mask of an AI agent, the code downloads a remote executable on import, and during usage, silently exfiltrates data like...
Malicious code in metoopro (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 6e089d4b8b0fe90a96024c1160f198df5ab7ec0b30f1f5765cf81ef4aa640279 Designed to run on Android. Under the mask of an AI agent, the code downloads a remote executable on import, and during usage, silently exfiltrates data like...
CVE-2026-7671: Improper Restriction of Excessive Authentication Attempts
A vulnerability has been found in CodeWise Tornet Scooter Mobile App 4.75 on iOS/Android. The impacted element is an unknown function of the file /TwoFactor. Such manipulation leads to improper restriction of excessive authentication attempts. The attack may be performed from remote. Attacks of...
CVE-2026-7671 CodeWise Tornet Scooter Mobile App TwoFactor excessive authentication
A vulnerability has been found in CodeWise Tornet Scooter Mobile App 4.75 on iOS/Android. The impacted element is an unknown function of the file /TwoFactor. Such manipulation leads to improper restriction of excessive authentication attempts. The attack may be performed from remote. Attacks of...
Android Network Audit
Audit Android network posture: interfaces, IPs, routes, DNS, Wi-Fi, proxy, VPN from kittysploit import import re class ModulePost: info = "name": "Android Network Audit", "description": "Audit Android network posture: interfaces, IPs, routes, DNS, Wi-Fi, proxy, VPN", "author": "KittySploit Team",...
Android Permissions Audit
Audit installed apps for sensitive Android permissions and risky flags from kittysploit import import re class ModulePost: info = "name": "Android Permissions Audit", "description": "Audit installed apps for sensitive Android permissions and risky flags", "author": "KittySploit Team",...
Android Security Posture
Assess Android security posture debug, root, encryption, boot integrity, network exposure from kittysploit import class ModulePost: info = "name": "Android Security Posture", "description": "Assess Android security posture debug, root, encryption, boot integrity, network exposure", "author":...
CVE-2026-7638: Authorization Bypass Through User-Controlled Key
The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 5.6.0. This is due to missing authorization validation in the uploadavatar function, which accepts an attacker-controlled...
CVE-2026-23866
Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device, including triggerin...
CVE-2026-23866
Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device, including triggerin...
CVE-2026-23866
CVE-2026-23866 affects WhatsApp for iOS and Android, in conjunction with Instagram Reels, where incomplete validation of AI-rich response messages could allow a user to trigger processing of media from an arbitrary URL on another user’s device, potentially invoking OS-controlled custom URL scheme...
CVE-2026-23866
Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device, including triggerin...
Exploit for Improper Handling of Insufficient Permissions or Privileges in Google Android
CVE-2026-0047: Missing Permission Check in ActivityManagerServ...
Facebook WhatsApp security vulnerabilities
Facebook WhatsApp is a suite of Android-based mobile applications from Facebook, Inc. in the United States that utilize the Internet to deliver text messages. The application uses the contact information in the smartphone to find contacts using the software to send texts, pictures, etc. A securit...
Facebook WhatsApp security vulnerabilities
Facebook WhatsApp is a suite of Android-based mobile applications from Facebook, Inc. in the United States that utilize the Internet to deliver text messages. The application uses the contact information in a smartphone to find contacts using the software to send texts, pictures, and more. A...
Wireshark 2.2.x < 2.2.14 Multiple Vulnerabilities (macOS)
The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 2.2.14. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-2.2.14 advisory. - The MP4 dissector could crash. It may be possible to make Wireshark crash by injecting a malformed...
CVE-2026-23866: Improper Verification of Source of a Communication Channel
Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device, including triggerin...