Samsung Smart Switch Privilege Escalation

The vulnerability of the Samsung Smart Switch data transfer service for the Android operating system is related to an incorrect limitation on the path name to the directory. Exploiting this vulnerability can allow a remote attacker to increase their privileges...

Exploit for Use After Free in Linux Linux_Kernel

GhostLock - CVE-2026-43499 Local Privilege Escalation Exploit...

WindRelay Android Malware Turns Victims' Phones Into NFC Relays for Payment Fraud

A previously unseen Android near field communication NFC relay malware family dubbed WindRelay is being deployed in conjunction with a known remote access trojan RAT called SpyNote as part of a contactless payment fraud scheme. The purpose-built malware, according to Group-IB, is designed to...

New Android malware lets criminals use your bank card in real time

Researchers at Group-IB have discovered a new NFC relay malware family, purpose-built to capture live card data via NFC and forward it in real time to attackers. They dubbed it "WindRelay." NFC Near Field Communication is wireless technology that allows devices such as smartphones, payment cards,...

PT-2026-71379

Name of the Vulnerable Software and Affected Versions Palo Alto Networks GlobalProtect app affected versions not specified Description Improper certificate validation allows an unauthenticated attacker with man-in-the-middle MitM access to intercept and modify application communications. MitM is ...

Linux Distros Unpatched Vulnerability : CVE-2026-59112

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority...

CVE-2026-73296

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, createmobiledatacollectionserver and createmobileactionserver in ufo/client/mcp/httpservers/mobilemcpserver.py exposed Streamable HTTP MCP services on TCP ports 8020 and 8021 without...

CVE-2026-73296 Microsoft UFO: Unauthenticated Mobile MCP access allows remote Android device control and screen disclosure

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, createmobiledatacollectionserver and createmobileactionserver in ufo/client/mcp/httpservers/mobilemcpserver.py exposed Streamable HTTP MCP services on TCP ports 8020 and 8021 without...

CVE-2026-73296

The CVE concerns Microsoft UFO, an open-source framework for intelligent automation. Before 3.0.8, the functions create_mobile_data_collection_server and create_mobile_action_server in ufo/client/mcp/http_servers/mobile_mcp_server.py exposed Streamable HTTP MCP services on ports 8020/8021 without...

CVE-2026-73296

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, createmobiledatacollectionserver and createmobileactionserver in ufo/client/mcp/httpservers/mobilemcpserver.py exposed Streamable HTTP MCP services on TCP ports 8020 and 8021 without...

EUVD-2026-57323

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, createmobiledatacollectionserver and createmobileactionserver in ufo/client/mcp/httpservers/mobilemcpserver.py exposed Streamable HTTP MCP services on TCP ports 8020 and 8021 without...

CVE-2026-73296 Microsoft UFO: Unauthenticated Mobile MCP access allows remote Android device control and screen disclosure

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, createmobiledatacollectionserver and createmobileactionserver in ufo/client/mcp/httpservers/mobilemcpserver.py exposed Streamable HTTP MCP services on TCP ports 8020 and 8021 without...

SUSE CVE-2026-71391

GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfntvarysimpleglyph and sfntvarycompoundglyph uses a strict greater-than comparison instead of greater-than-or-equal, allowing a crafted TrueType variable font ...

SUSE CVE-2026-71394

GNU Emacs for Android improperly validates the table header input in sfntreadtabledirectory in src/sfnt.c. Due to an incorrect comparison variable in the read-length check, a crafted font file that claims to contain more table directory entries than actually present causes the parser to return a...

Exploit for SQL Injection in Google Android

CVE-2026-0075 ContactsProvider Research PoC A controlled-la...

bitchat-android v2.0.1

!WARNING This software has not received external security review and may contain vulnerabilities and may not necessarily meet its stated security goals. Do not use it for sensitive use cases, and do not rely on its security until it has been reviewed. Work in progress. bitchat for Android A secur...

EUVD-2026-57006

The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token...

EUVD-2026-57005

The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information...

SveService Component Code Execution

The vulnerability of the SveService component in the Android operating system of Samsung mobile devices is related to writing beyond the buffer boundaries of memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

Black Hat Asia 2024 Conference Slides

Black Hat Asia 2024 conference slides for topics Confused Learning: Supply Chain Attacks through Machine Learning Models, The Fault in Our Metrics: Rethinking How We Measure Detection & Response, The Hack@DAC Story: Learnings from Organizing the World's Largest Hardware Hacking Competition, The...