CVE-2026-73296 Microsoft UFO: Unauthenticated Mobile MCP access allows remote Android device control and screen disclosure

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, createmobiledatacollectionserver and createmobileactionserver in ufo/client/mcp/httpservers/mobilemcpserver.py exposed Streamable HTTP MCP services on TCP ports 8020 and 8021 without...

CVE-2026-73296 Microsoft UFO: Unauthenticated Mobile MCP access allows remote Android device control and screen disclosure

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, createmobiledatacollectionserver and createmobileactionserver in ufo/client/mcp/httpservers/mobilemcpserver.py exposed Streamable HTTP MCP services on TCP ports 8020 and 8021 without...

PT-2026-71152

Name of the Vulnerable Software and Affected Versions Microsoft UFO versions prior to 3.0.8 Description The create mobile data collection server and create mobile action server functions in ufo/client/mcp/http servers/mobile mcp server.py expose Streamable HTTP MCP services on TCP ports 8020 and...

CVE-2026-11425

A flaw was found in Domoticz. An authenticated attacker can exploit a stored cross-site scripting XSS vulnerability in the mobile dashboard. This allows the attacker to inject malicious code by updating specific device values through the application's programming interface API. When an...

CVE-2026-65769

Exposure of sensitive information to an unauthorized actor in Microsoft Teams Mobile allows an unauthorized attacker to disclose information over a network...

CVE-2026-65767

Microsoft Teams for Android is affected by CVE-2026-65767 due to improper neutralization of input during web page generation (XSS). Attack requires network access with low privileges and no user interaction; an authorized attacker could spoof content. The CVSS v3.1 base score is 8.8 (HIGH). Affec...

CVE-2026-65769

CVE-2026-65769 affects Microsoft Teams Mobile (iOS). It is described as an information disclosure vulnerability where an unauthenticated network attacker could access sensitive data disclosed by the app. The available sources (NVD/MSRC) confirm exposure over a network but do not provide detailed ...

EUVD-2026-56565

Exposure of sensitive information to an unauthorized actor in Microsoft Teams Mobile allows an unauthorized attacker to disclose information over a network...

PT-2026-70667

Name of the Vulnerable Software and Affected Versions Microsoft Teams Mobile affected versions not specified Description An issue in Microsoft Teams Mobile allows an unauthorized actor to disclose sensitive information over a network. Recommendations At the moment, there is no information about a...

CVE-2026-56619

HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting Reflected XSS due to insufficient validation and output encoding of user-controlled input...

CVE-2026-56620

HCL BigFix Mobile is vulnerable to information disclosure due to improper handling of exceptions and verbose error reporting...

EUVD-2026-55668

HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting Reflected XSS due to insufficient validation and output encoding of user-controlled input...

CVE-2026-56619

CVE-2026-56619 affects HCL BigFix Mobile. The issue is a Reflected Cross-Site Scripting (XSS) vulnerability caused by insufficient validation and output encoding of user-controlled input. The CVSS v3.1 base score is 5.4 (Medium) with Network attack, Low attack complexity, Privileges Required: Low...

CVE-2026-56620

Technical details such as affected products, versions, root cause, or exploit information are not publicly provided in the supplied documents. Monitor for updates from official disclosures.

EUVD-2026-55662

HCL BigFix Mobile is vulnerable to information disclosure due to improper handling of exceptions and verbose error reporting...

CVE-2026-59112 Signature validation vulnerability affecting DigiDoc applications

Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority RIA libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS. This issue affects libdigidocpp: from 4.1.0 before 4.2.1; DigiDoc4:...

CVE-2026-66410

Android and iOS apps ECOVACS PRO App improperly validate server certificates. Communication may be retrieved and/or altered...

CVE-2026-66410

Android and iOS apps ECOVACS PRO App improperly validate server certificates. Communication may be retrieved and/or altered...

Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection

The rise of autonomous AI agents represents a major paradigm shift in how users interact with mobile devices. Frameworks such as MobileRun and Mobile-Use can autonomously navigate Android applications and execute complex multi-step tasks. To interpret user interfaces, these frameworks rely...

CVE-2026-66061

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.0, the iOS Companion app treats tag links NFC or QR delivered through an OS-level routing mechanism such as iOS universal links as if they were physically scanned, without validating the...