io.github.epi155:promethium-pgp-jdk5 (0.5-b1), org.igniterealtime.smack:smack-android (>=4.5.0-alpha2, <=4.5.0-beta2) +196 more potentially affected by CVE-2026-85515 via org.bouncycastle:bcpg-jdk15to18 (>=1.72.1, <=1.84)

org.bouncycastle:bcpg-jdk15to18 MAVEN version =1.72.1, =4.5.0-alpha2, =4.5.0-alpha2, =4.5.0-alpha2, =4.5.0-alpha2, =4.5.0-beta3, =4.5.0-alpha2, =4.5.0-alpha2, =4.5.0-alpha2, =4.5.0-alpha2, =1.9.0, =1.9.0, =1.9.0, =1.9.0, =1.9.0, =1.10.0 and more Source cves: CVE-2026-85515 Source advisory:...

Android 17 Advanced Protection Locks Accessibility Services to Verified Accessibility Tools

Google has announced a new security measure that limits access to Android's accessibility services to verified applications classified as Accessibility Tools when Advanced Protection is enabled. With malicious Android applications abusing the API serving as the main conduit for malware and...

CVE-2026-103097

An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key...

CVE-2026-103096

API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key...

SUSE CVE-2025-8042

Firefox for Android allowed a sandboxed iframe without the allow-downloads attribute to start downloads. This vulnerability was fixed in Firefox 141...

CVE-2026-103097

The GV-Eye Relay Payment API is vulnerable to an information disclosure flaw where an API key is hardcoded and retrievable from the application package. Because Android applications can be reverse-engineered, an unauthorized user can extract these sensitive credentials from the client application...

CVE-2026-103096

The GV-Eye application is vulnerable to a hardcoded API key issue. Because Android applications can be reverse engineered , an attacker can extract sensitive API credentials directly from the application package. This allows unauthorized users to misuse the key for unintended purposes. No specifi...

PT-2026-104062

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description An API key is hardcoded and retrievable from the application package. Because Android applications can be reverse engineered, embedding sensitive API credential...

CVE-2026-102670

Joyland AI app explicitly permits cleartext HTTP traffic on Android 9+ where the default is to block it...

EUVD-2026-91029

Joyland AI app explicitly permits cleartext HTTP traffic on Android 9+ where the default is to block it...

CVE-2026-102670 Joyland AI enables HTTP

Joyland AI app explicitly permits cleartext HTTP traffic on Android 9+ where the default is to block it...

CVE-2026-102670

The Joyland AI app is vulnerable because it explicitly permits cleartext HTTP traffic on devices running Android 9+ . This configuration deviates from the platform's default security behavior, which is to block such traffic, potentially exposing sensitive information during transmission. No speci...

CVE-2026-102670 Joyland AI enables HTTP

Joyland AI app explicitly permits cleartext HTTP traffic on Android 9+ where the default is to block it...

CVE-2026-103922

Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame ...

CVE-2026-103922 Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame ...

CVE-2026-103922

Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame ...

CVE-2026-103922 Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame ...

@cotecna/stencil-components (>=3.0.0, <=3.2.1), @sumaris-net/ngx-components (18.5.0-alpha2) +2 more potentially affected by CVE-2026-103922 via @capacitor/android (>=6.0.0-nightly-20240307T150431.0, <=6.2.0)

@capacitor/android NPM version =6.0.0-nightly-20240307T150431.0, =3.0.0, =1.0.0, =1.0.0, =1.1.6 Source cves: CVE-2026-103922 Source advisory: MEND:CVE-2026-103922...

@cotecna/stencil-components (>=3.3.1, <=4.0.0), @happyknuckles/angular-standalone-clean-code (0.0.2) +3 more potentially affected by CVE-2026-103922 via @capacitor/android (>=7.0.1, <=7.4.4)

@capacitor/android NPM version =7.0.1, =3.3.1, =0.0.24, =1.0.1, =0.0.1, =0.0.2 Source cves: CVE-2026-103922 Source advisory: MEND:CVE-2026-103922...

@vnejs/bundles.canvas.react (>=0.1.1, <=0.2.0), @vnejs/bundles.checkers (>=0.2.1, <=0.2.3) +7 more potentially affected by CVE-2026-103922 via @capacitor/android (8.0.2)

@capacitor/android NPM version 8.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on @capacitor/android and may be impacted: - @vnejs/bundles.canvas.react =0.1.1, =0.2.1, =0.1.0, =0.1.36, =0.1.2, =0.1.1, =0.1.1, =0.1.1, =0.2.20, =0.2.31 Source cves:...