CVE-2024-53027-WIP

CVE-2024-53027-WIP Работа в процессе над PoC CVE-2024-53027: Уязвимость Qualcomm Bluetooth/Wi-Fi 📄 Обзор CVE-2024-53027 — это уязвимость средней степени серьёзности CVSS не оценён, затрагивающая чипсеты WLAN и Bluetooth компании Qualcomm в устройствах на Android. Она может вызывать кратковременны...

EUVD-2026-66243

Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme CWE-939. A malicious application installed on the user's Android device may exploit the affected application's functionality through an Intent, potentially allowing arbitrary JavaScript to be...

Android 17 Adds OS-Wide ECH to Hide Website Visits From Network Providers

Google on Thursday announced new network security protections in Android 17 to bolster connection privacy, address cellular vulnerabilities, and safeguard the privacy of users' home networks. Topping the list is support for Encrypted Client Hello ECH, a privacy standard that prevents networks fro...

CVE-2026-21018

Dépassement de tampon SveService Samsung SMR Mai 2026 SVE-2026-0478CVE-2026-21018 Versions affectées : Android 14, 15, 16 Statut de divulgation : Divulgué privément Écriture hors limites dans SveService avant SMR Mai-2026 Release 1 permet à des attaquants privilégiés locaux d'exécuter du code...

CVE-2026-82089

The wallabag aka fr.gaulupeau.apps.InThePoche application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView...

CVE-2026-82089

The wallabag aka fr.gaulupeau.apps.InThePoche application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView...

EUVD-2026-67402

The wallabag aka fr.gaulupeau.apps.InThePoche application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView...

CVE-2026-82089

The wallabag aka fr.gaulupeau.apps.InThePoche application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView...

CVE-2026-82089

The wallabag aka fr.gaulupeau.apps.InThePoche application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView...

CVE-2026-82089

The wallabag Android application (package fr.gaulupeau.apps.InThePoche) through version 2.6.0 is affected by a Cross-Site Scripting (XSS) vulnerability. The root cause is that /api/entries data is loaded directly into a WebView , allowing injected script content to execute. The CVSS 4.0 score is ...

CVE-2026-82089

The wallabag aka fr.gaulupeau.apps.InThePoche application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView...

REPLICANT: Learning Policies for Evading and Hardening Malware Detectors

To determine the real-world effectiveness of machine learning based malware detection, it is vital to evaluate its robustness against highly capable adversaries. However, state-of-the-art attacks do not effectively model realistic adversaries, as they often assume access to privileged information...

CVE-2026-38093

filepicker aka flutterfilepicker for Flutter, all versions through 10.3.10, is vulnerable to path traversal CWE-22 in its Android implementation. The openFileStream method in FileUtils.kt uses the DISPLAYNAME obtained from ContentResolver.query directly in file path construction without...

CVE-2026-38093

filepicker aka flutterfilepicker for Flutter, all versions through 10.3.10, is vulnerable to path traversal CWE-22 in its Android implementation. The openFileStream method in FileUtils.kt uses the DISPLAYNAME obtained from ContentResolver.query directly in file path construction without...

CVE-2026-38093: Improper Limitation of a Pathname to a Restricted Directory

filepicker aka flutterfilepicker for Flutter, all versions through 10.3.10, is vulnerable to path traversal CWE-22 in its Android implementation. The openFileStream method in FileUtils.kt uses the DISPLAYNAME obtained from ContentResolver.query directly in file path construction without...

CVE-2026-38093

filepicker aka flutterfilepicker for Flutter, all versions through 10.3.10, is vulnerable to path traversal CWE-22 in its Android implementation. The openFileStream method in FileUtils.kt uses the DISPLAYNAME obtained from ContentResolver.query directly in file path construction without...

EUVD-2026-67771

filepicker aka flutterfilepicker for Flutter, all versions through 10.3.10, is vulnerable to path traversal CWE-22 in its Android implementation. The openFileStream method in FileUtils.kt uses the DISPLAYNAME obtained from ContentResolver.query directly in file path construction without...

CVE-2026-82089: Improper Neutralization of Input During Web Page Generation

The wallabag aka fr.gaulupeau.apps.InThePoche application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView...

Moirae: A Multimodal Agent Collaborative Framework for Dynamic Android Malware Detection

The Android ecosystem faces persistent and rapidly evolving malware threats. Existing machine learning detectors are vulnerable to concept drift because they rely on implementation-specific features whose distributions change over time. Large language models LLMs offer strong semantic understandi...

CVE-2026-38093

filepicker aka flutterfilepicker for Flutter, all versions through 10.3.10, is vulnerable to path traversal CWE-22 in its Android implementation. The openFileStream method in FileUtils.kt uses the DISPLAYNAME obtained from ContentResolver.query directly in file path construction without...