CVE-2026-84283 FluteCode Secure Folder 1.2 -Plaintext vault files in shared storage bypass the PIN gate

Secure Folder 1.2 stores files selected for its password-protected vault as unencrypted files in the Android shared-storage tree. A local application or file manager that has access to the relevant shared-storage path can enumerate, copy, and open those files without authenticating to Secure Fold...

CVE-2026-84283

In FluteCode Secure Folder 1.2 , files designated for the password-protected vault are stored as unencrypted files within the Android shared-storage tree . This flaw allows a local application or file manager with access to the relevant shared-storage path to enumerate, copy, and open these files...

gt-7240r-root

GENESIS GT-7240R Root Tool This tool uses the CVE-2014-3153...

Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions

A OnePlus 15 running the latest OxygenOS can be rooted by a malicious app the owner installs, one that asks for no special permissions. A researcher, Rasmus Moorats, chained two flaws in OnePlus's own software to gain root access, the highest level of control over an Android phone. OnePlus told h...

ThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories

This week, the dangerous stuff keeps arriving dressed as something boring. An update. A login box. A search answer. A coding tool. A link you have clicked a hundred times before. That is the thread running through the pile. Trusted paths get poisoned. Old bugs find new jobs. AI tools leak more th...

downitall-android (1.5.0), downitall-windows (1.5.0) potentially affected by CVE-2026-92164 via streamlink (7.5.0)

streamlink PYPI version 7.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlink and may be impacted: - downitall-android 1.5.0 - downitall-windows 1.5.0 Source cves: CVE-2026-92164 Source advisory: OSV:GHSA-VF2X-4V53-PM7V...

Corp MDM Spyware Targets Logistics Firms, Steals New SMS and Redirects Calls

The logistics sector has become the target of a new malicious cyber campaign that distributes an Android spyware codenamed Corp MDM. According to Have I Been Squatted, the campaign uses fake Google Play pages branded as CEVA and TKW Logistics to distribute an Android Package Kit APK file that's...

Update Chrome: 108 security fixes for desktop, new release for Android

Over the last few days, Google issued several different Chrome updates. On September 22, Google released a Stable Channel Update for Desktop. This is the most important one for desktop users. It brings Chrome to version 154.0.8037.57 for Linux and versions 154.0.8037.57/.58 for Windows and Mac. T...

PT-2026-98306

There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to trigger unprivileged APK installation via serving a malicious APK URL through an unauthenticated download endpoint...

PT-2026-98315

Name of the Vulnerable Software and Affected Versions Secure Folder version 1.2 Description Files selected for the password-protected vault are stored as unencrypted files within the Android shared-storage tree. This allows a local application or file manager with access to the shared-storage pat...

ROS-20260924-73-0086

The vulnerability of the binderupdatepagerange function in the drivers/android/binderalloc.c module of the Linux operating system’s kernel is related to the use of memory after deallocation. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity,...

PT-2026-98307

There is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a remote, unauthenticated attacker to inject arbitrary input into service endpoints via network-based HTTP requests to unauthenticated endpoints...

CVE-2026-94183

Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is running in the background. A remote attacker can exploit this via a specially crafted website to render fake UI elements, such as a spoofed address bar,...

CVE-2026-94183 Address bar spoofing risk in affected Android versions of Arc Search

Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is running in the background. A remote attacker can exploit this via a specially crafted website to render fake UI elements, such as a spoofed address bar,...

EUVD-2026-85570

Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is running in the background. A remote attacker can exploit this via a specially crafted website to render fake UI elements, such as a spoofed address bar,...

CVE-2026-94183 Address bar spoofing risk in affected Android versions of Arc Search

Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is running in the background. A remote attacker can exploit this via a specially crafted website to render fake UI elements, such as a spoofed address bar,...

CVE-2026-94183

Arc Search for Android versions prior to 1.12.10 are vulnerable to a UI spoofing risk. The application fails to display a fullscreen notification when a webpage enters fullscreen mode while the app is running in the background. A remote attacker can exploit this by using a specially crafted websi...

SUSE CVE-2026-95279

UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to spoof address bar via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-95281

Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

SUSE CVE-2026-95283

Buffer overflow in Tint in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...