CVE-2026-19146

A flaw was found in Google Chrome on Android, specifically within its Graphics Processing Unit GPU component. A remote attacker, after compromising the browser's renderer process, could exploit an uninitialized memory vulnerability by tricking a user into visiting a specially crafted HTML page...

CVE-2026-19154

An use after free flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=532941869 Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security...

CVE-2026-19141

A flaw was found in Chromium. This use-after-free vulnerability in the Resources component on Android could allow a remote attacker, who has already compromised the renderer process, to potentially escape the sandbox. This could be achieved by enticing a user to visit a specially crafted HTML pag...

CVE-2026-19143

A flaw was found in Google Chrome on Android. This vulnerability, related to insufficient validation of untrusted input in WebAPKs, allows a local attacker to perform a sandbox escape. By crafting and using a malicious file, an attacker can bypass security restrictions designed to isolate...

CVE-2026-19137

A flaw was found in Google Chrome on Android. This vulnerability, a use-after-free error in the WebGL component, could be exploited by a remote attacker. After compromising the renderer process, the attacker could craft a malicious HTML page to trigger the flaw. This could potentially lead to a...

Microsoft Teams for Android Spoofing Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Teams for Android allows an authorized attacker to perform spoofing over a network...

Microsoft Teams Remote Code Execution Vulnerability

Improper limitation of a pathname to a restricted directory 'path traversal' in Microsoft Teams for Android allows an unauthorized attacker to execute code over a network...

Exploit for CVE-2026-18907

CVE-2026-18907 — Path Traversal in TECNO Hi Browser Download H...

Exploit for Use After Free in Linux Linux_Kernel

GhostLock — CVE-2026-43499 PoC Qualcomm 4.19 kernel Local p...

Mira Hormone Monitor, Mira Android App

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker to access unauthorized health profile information, make changes to health information, cause a denial-of-service condition, disclose session token information, and obtain control of user accounts. 2...

PT-2026-70666

Improper limitation of a pathname to a restricted directory 'path traversal' in Microsoft Teams for Android allows an unauthorized attacker to execute code over a network...

PT-2026-70933

The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token...

CVE-2026-67558: Authentication Bypass by Spoofing

The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token...

PT-2026-70927

When the Mira Android app opens in-app WebView content e.g., shop redirect flows, the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web...

CVE-2026-65767: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Teams for Android allows an authorized attacker to perform spoofing over a network...

PT-2026-70934

The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information...

PT-2026-70665

Name of the Vulnerable Software and Affected Versions Microsoft Teams for Android affected versions not specified Description Improper neutralization of input during web page generation leads to cross-site scripting XSS, a technique where malicious scripts are injected into trusted websites. This...

CVE-2026-67568: Use of Hard-coded Credentials

The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information...

CVE-2026-66832: Use of GET Request Method With Sensitive Query Strings

When the Mira Android app opens in-app WebView content e.g., shop redirect flows, the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web...

CVE-2026-65768: Improper Limitation of a Pathname to a Restricted Directory

Improper limitation of a pathname to a restricted directory 'path traversal' in Microsoft Teams for Android allows an unauthorized attacker to execute code over a network...