CVE-2026-35394 Mobile Next has Arbitrary Android Intent Execution via mobile_open_url

Mobile Next is an MCP server for mobile development and automation. Prior to 0.0.50, the mobileopenurl tool in mobile-mcp passes user-supplied URLs directly to Android's intent system without any scheme validation, allowing execution of arbitrary Android intents, including USSD codes, phone calls...

CVE-2026-35394 Mobile Next has Arbitrary Android Intent Execution via mobile_open_url

Mobile Next is an MCP server for mobile development and automation. Prior to 0.0.50, the mobileopenurl tool in mobile-mcp passes user-supplied URLs directly to Android's intent system without any scheme validation, allowing execution of arbitrary Android intents, including USSD codes, phone calls...

CVE-2026-35394 Mobile Next has Arbitrary Android Intent Execution via mobile_open_url

Mobile Next is an MCP server for mobile development and automation. Prior to 0.0.50, the mobileopenurl tool in mobile-mcp passes user-supplied URLs directly to Android's intent system without any scheme validation, allowing execution of arbitrary Android intents, including USSD codes, phone calls...

CVE-2024-48783

creationtimestamp| type| source ---|---|--- 2026-04-06 20:51:48+00:00| seen| https://bsky.app/profile/allsafeus.bsky.social/post/3miu5ewvcf22q...

CVE-2026-35187

CVE-2026-35187 affects pyload/pyload-ng prior to 0.5.0b3.dev97, where parse_urls(...) calls get_url(url) without URL validation, protocol restriction, or IP blacklist. This enables Server-Side Request Forgery (SSRF) via crafted URLs and multi‑protocol support (http/https, file://, gopher://, dict...

CVE-2026-35187

pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the parseurls API function in src/pyload/core/api/init.py fetches arbitrary URLs server-side via geturlurl pycurl without any URL validation, protocol restriction, or IP blacklist. An authenticated...

GHSA-78H2-9FRX-2JM8

creationtimestamp| type| source ---|---|--- 2026-04-06 19:28:45+00:00| published-proof-of-concept| Telegram/ECjdy8s76GZBalwnIB79ij56tbajMeprVumTyCn-zmzM 2026-04-10 17:08:55+00:00| seen| https://gist.github.com/paulo-raca/8a16df3664952c9b185211298075c6ab...

CVE-2026-35164

creationtimestamp| type| source ---|---|--- 2026-04-06 19:25:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mitykuak322n 2026-04-06 19:29:44+00:00| seen| Telegram/RmP7l-K41x9UoCBscD5W8eizA4yDJaPJqAKKOeWwXNyu-8 2026-04-07 06:02:51+00:00| seen|...

CVE-2026-5668

creationtimestamp| type| source ---|---|--- 2026-04-06 19:04:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mitxewiwuz2j...

CVE-2026-34981

creationtimestamp| type| source ---|---|--- 2026-04-06 18:53:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mitwruq3y22s...

CVE-2024-14032

creationtimestamp| type| source ---|---|--- 2026-04-06 18:52:21+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mitwpdda7s2z 2026-04-14 03:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mjgfmj3sxd2v...

CVE-2026-34977

creationtimestamp| type| source ---|---|--- 2026-04-06 18:43:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mitw7xgec32z 2026-04-06 19:28:28+00:00| published-proof-of-concept| Telegram/nNz4AuVWmZsX2vjW9IzWDm0wIi6EKHH8QFJ1lll9JUSWJdI 2026-04-09 21:17:03+00:00| seen|...

CVE-2025-61166

An open redirect in Ascertia SigningHub User v10.0 allows attackers to redirect users to a malicious site via a crafted URL...

CVE-2026-35036

Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, Ech0 implements link preview editor fetches a page title through GET /api/website/title. That is legitimate product behavior, but the implementation is unsafe: the route is unauthenticated, accepts ...

CVE-2026-21371

creationtimestamp| type| source ---|---|--- 2026-04-06 17:00:35+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mitqhfxjy325 2026-04-06 17:31:52+00:00| seen| Telegram/bFzdXG4EHDXBh96IdapV4pte0L7R5RfWgLMclfBuHu5yA-8 2026-04-09 02:40:09+00:00| seen|...

CVE-2026-21367

creationtimestamp| type| source ---|---|--- 2026-04-06 17:00:31+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mitqh7hpx22x 2026-04-06 17:31:48+00:00| seen| Telegram/RGEnmBafEPc7BPP7Kak77rIihdcDD1YNCnC4ac8698Y1cM 2026-04-09 04:40:08+00:00| seen|...

CVE-2026-25932

creationtimestamp| type| source ---|---|--- 2026-04-06 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0401/ 2026-04-06 17:30:24+00:00| published-proof-of-concept| Telegram/i2wIvqy39CRBnxM6Nflxvy-bZIfB5xec6SNNV804lQCNEY 2026-04-08 06:20:08+00:00| seen|...

CVE-2026-35037 Ech0 affected by unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata

Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, the GET /api/website/title endpoint accepts an arbitrary URL via the websiteurl query parameter and makes a server-side HTTP request to it without any validation of the target host or IP address. Th...

CVE-2026-35037

Ech0 (GetWebsiteTitle endpoint) is affected by an unauthenticated SSRF vulnerability (CVE-2026-35037) prior to version 4.2.8. The GET /api/website/title endpoint accepts a user-supplied website_url, makes a server-side HTTP request without validating the target, and returns the HTML title content...

CVE-2026-35036 Ech0 Affected by Unauthenticated Server-Side Request Forgery in Website Preview Feature

Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, Ech0 implements link preview editor fetches a page title through GET /api/website/title. That is legitimate product behavior, but the implementation is unsafe: the route is unauthenticated, accepts ...