# CWE-926.

Every Advisory and CVE whose sources give the weakness CWE-926, newest first.

## Records, newest first

- [VitaFit Android < 2.8.1.0 Custom URI Scheme Token Hijacking](https://agentprime.io/advisories/CVE-2026-54376.md)
  `CVE-2026-54376` · CVE record: Shenzhen Shine Industrial Co., Ltd. VitaFit · CVSS 8.2 High · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-926
- [An issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switch to an attacker controlled progile, bypassing authentication.](https://agentprime.io/advisories/CVE-2026-107059.md)
  `CVE-2026-107059` · CVE record · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-926
- [An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip.](https://agentprime.io/advisories/CVE-2026-107057.md)
  `CVE-2026-107057` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-926
- [Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified build) allows unauthorized attackers to arbitrarily manipulate another user's FHEM home-automation control configurations.](https://agentprime.io/advisories/CVE-2026-107051.md)
  `CVE-2026-107051` · CVE record · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-926
- [An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted POST request.](https://agentprime.io/advisories/CVE-2026-107048.md)
  `CVE-2026-107048` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-926
- [A Server-Side Request Forgery (SSRF) in the url/title/author/coverUrl component of FocusPodcast versionCode 70allows attackers to scan internal resources via supplying a crafted URL.](https://agentprime.io/advisories/CVE-2026-107046.md)
  `CVE-2026-107046` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-926
- [Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's SMS-code-capture mechanism.](https://agentprime.io/advisories/CVE-2026-107043.md)
  `CVE-2026-107043` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-926
- [Insecure permissions in the FeatureActionActivity component of Oasis Feng Island versionCode 51801 allows unauthorized attackers to arbitrarily force a freeze in the device, leading to a Denial of Se…](https://agentprime.io/advisories/CVE-2026-107041.md)
  `CVE-2026-107041` · CVE record · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-926
- [Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow.](https://agentprime.io/advisories/CVE-2026-107040.md)
  `CVE-2026-107040` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-926
- [Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of application data.](https://agentprime.io/advisories/CVE-2026-107038.md)
  `CVE-2026-107038` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-926
- [Insecure permissions in Mission Control / AIMSICD versionCode 2026080501 allows unauthorized attackers to invoke an exported component, impacting the tracker blocker mechanism of the application.](https://agentprime.io/advisories/CVE-2026-107036.md)
  `CVE-2026-107036` · CVE record · CVSS 5.1 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-926
- [Insecure permissions in the MirakelInternalContentProvider component of Mirakel v3.0 (versionCode 60) allows unauthorized attackers to arbitrarily read and modify another user's task database.](https://agentprime.io/advisories/CVE-2026-107033.md)
  `CVE-2026-107033` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-926
- [Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow.](https://agentprime.io/advisories/CVE-2026-107032.md)
  `CVE-2026-107032` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-926
- [Insecure permissions in craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) allows unauthorized attackers to trigger the OTP-clipboard (One-Time Password) mechanism, causing a desynchronization of…](https://agentprime.io/advisories/CVE-2026-107030.md)
  `CVE-2026-107030` · CVE record · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-926
- [Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting.](https://agentprime.io/advisories/CVE-2026-107027.md)
  `CVE-2026-107027` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-926
- [Insecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) allows unauthorized attackers to export the application's data.](https://agentprime.io/advisories/CVE-2026-107025.md)
  `CVE-2026-107025` · CVE record · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-926
- [Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbitrarily read flashcards across the user's entire m…](https://agentprime.io/advisories/CVE-2026-107021.md)
  `CVE-2026-107021` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-926
- [Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthorized attackers to create forged holiday/work-time entries via crafted ICS import…](https://agentprime.io/advisories/CVE-2026-107019.md)
  `CVE-2026-107019` · CVE record · CVSS 8.8 High · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-926
- [Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read notes in another user's' note database.](https://agentprime.io/advisories/CVE-2026-107014.md)
  `CVE-2026-107014` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-926
- [LeeDrOiD Labs Shortcutter 2 App ToggleGeneric.java Class.forName improper export of android application components](https://agentprime.io/advisories/CVE-2026-113385.md)
  `CVE-2026-113385` · CVE record: LeeDrOiD Labs Shortcutter 2 App · CVSS 4.8 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-926
- [Exported Android component in Samsung Mobile Samsung Account](https://agentprime.io/advisories/CVE-2026-21127.md)
  `CVE-2026-21127` · CVE record: Samsung Mobile Samsung Account · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-926
- [Acode: Exported TerminalService (bundled terminal plugin) lets any installed app execute arbitrary shell commands as Acode](https://agentprime.io/advisories/CVE-2026-68928.md)
  `CVE-2026-68928` · CVE record: Acode-Foundation Acode · CVSS 8.6 High · Not analysed yet · Published 18 Sept 2026 · Tags: Broken access control, CWE-749, CWE-926
- [Exported Android component in NTT DOCOMO BUSINESS, Inc. ManabiPocket for Parents](https://agentprime.io/advisories/CVE-2026-86701.md)
  `CVE-2026-86701` · CVE record: NTT DOCOMO BUSINESS, Inc. ManabiPocket for Parents · CVSS 1.8 Low · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-926
- [Ekia File Manager 1.2.7 - Exported ContentProvider allows unauthorized file access](https://agentprime.io/advisories/CVE-2026-81301.md)
  `CVE-2026-81301` · CVE record: Ekia File Manager · CVSS 8.5 High · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-926
- [Exported Android component in Lenovo File Manager Application](https://agentprime.io/advisories/CVE-2026-18994.md)
  `CVE-2026-18994` · CVE record: Lenovo File Manager Application · CVSS 8.4 High · Not analysed yet · Published 10 Sept 2026 · Tags: CWE-926
- [Exported Android component in Samsung Mobile Visual Voicemail](https://agentprime.io/advisories/CVE-2026-21113.md)
  `CVE-2026-21113` · CVE record: Samsung Mobile Visual Voicemail · CVSS 4.8 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-926
- [Exported Android component in Samsung Mobile Bixby Touch](https://agentprime.io/advisories/CVE-2026-21108.md)
  `CVE-2026-21108` · CVE record: Samsung Mobile Bixby Touch · CVSS 6.9 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-926
- [Exported Android component in Google Android](https://agentprime.io/advisories/CVE-2026-45528.md)
  `CVE-2026-45528` · CVE record: Google Android · CVSS 7.3 High · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-926
- [Exported Android component in MediaTek, Inc. MediaTek chipset](https://agentprime.io/advisories/CVE-2026-20516.md)
  `CVE-2026-20516` · CVE record: MediaTek, Inc. MediaTek chipset · CVSS 5.5 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: CWE-926
- [Exported Android component in Samsung Mobile SamsungPassAutofill](https://agentprime.io/advisories/CVE-2026-21081.md)
  `CVE-2026-21081` · CVE record: Samsung Mobile SamsungPassAutofill · CVSS 5.1 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: CWE-926
- [Exported Android component in Samsung Mobile Devices](https://agentprime.io/advisories/CVE-2026-21063.md)
  `CVE-2026-21063` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.8 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: CWE-926
- [Exported Android component in Samsung Mobile Devices](https://agentprime.io/advisories/CVE-2026-21059.md)
  `CVE-2026-21059` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.9 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: CWE-926
- [Exported Android component in Datadog Android App](https://agentprime.io/advisories/CVE-2026-44965.md)
  `CVE-2026-44965` · CVE record: Datadog Android App · CVSS 5.5 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: CWE-926
- [Exported Android component in Datadog Android App](https://agentprime.io/advisories/CVE-2026-47363.md)
  `CVE-2026-47363` · CVE record: Datadog Android App · CVSS 6.3 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: CWE-926
- [Exported Android component in Datadog Android App](https://agentprime.io/advisories/CVE-2026-47361.md)
  `CVE-2026-47361` · CVE record: Datadog Android App · CVSS 6.4 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: CWE-926
- [textPlus Text Message and Call App com.gogii.textplus DialerActivity improper export of android application components](https://agentprime.io/advisories/CVE-2026-18604.md)
  `CVE-2026-18604` · CVE record: textPlus Text Message and Call App · CVSS 4.8 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: CWE-926
- [Exported Android component in MediaTek, Inc. MediaTek chipset](https://agentprime.io/advisories/CVE-2026-20470.md)
  `CVE-2026-20470` · CVE record: MediaTek, Inc. MediaTek chipset · CVSS 6.2 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: CWE-926
- [Stoat for Android Internal File Disclosure via Exported ShareTargetActivity URI Validation](https://agentprime.io/advisories/CVE-2026-57848.md)
  `CVE-2026-57848` · CVE record: stoatchat Stoat for Android · CVSS 6.8 Medium · Not analysed yet · Published 18 Jul 2026 · Tags: CWE-926
- [Exported Android component in ASUS Router app](https://agentprime.io/advisories/CVE-2026-12960.md)
  `CVE-2026-12960` · CVE record: ASUS Router app · CVSS 6.0 Medium · Not analysed yet · Published 3 Jul 2026 · Tags: CWE-926
- [Home Assistant: Exported BroadcastReceiver allows local apps to spoof device location](https://agentprime.io/advisories/CVE-2026-54318.md)
  `CVE-2026-54318` · CVE record: home-assistant core · CVSS 7.1 High · Not analysed yet · Published 23 Jun 2026 · Tags: CWE-926
- [An issue was discovered in Rakuten Send Anywhere (File Transfer) for Android (com.estmob.android.sendanywhere) 23.2.9.](https://agentprime.io/advisories/CVE-2025-68713.md)
  `CVE-2025-68713` · CVE record · CVSS 8.0 High · Not analysed yet · Published 15 Jun 2026 · Tags: CWE-926
- [Exported Android component in Fortinet FortiTokenAndroid](https://agentprime.io/advisories/CVE-2026-44279.md)
  `CVE-2026-44279` · CVE record: Fortinet FortiTokenAndroid · CVSS 5.0 Medium · Not analysed yet · Published 12 May 2026 · Tags: CWE-926
- [Samsung Print Service Plugin – Potential Information Disclosure](https://agentprime.io/advisories/CVE-2026-3291.md)
  `CVE-2026-3291` · CVE record: HP, Inc Samsung Print Service Plugin · CVSS 6.9 Medium · Not analysed yet · Published 6 May 2026 · Tags: CWE-926
- [KL-001-2026-01: yintibao Fun Print Mobile Unauthorized Access via Context Hijacking](https://agentprime.io/advisories/CVE-2025-15464.md)
  `CVE-2025-15464` · CVE record: yintibao Fun Print Mobile · CVSS 7.5 High · Not analysed yet · Published 8 Jan 2026 · Tags: CWE-926
- [Yalantis uCrop AndroidManifest.xml UCropActivity improper export of android application components](https://agentprime.io/advisories/CVE-2025-14517.md)
  `CVE-2025-14517` · CVE record: Yalantis uCrop · CVSS 4.8 Medium · Not analysed yet · Published 11 Dec 2025 · Tags: CWE-926
- [SKTLab Mukbee App com.dw.android.mukbee AndroidManifest.xml improper export of android application components](https://agentprime.io/advisories/CVE-2025-10722.md)
  `CVE-2025-10722` · CVE record: SKTLab Mukbee App · CVSS 4.8 Medium · Not analysed yet · Published 19 Sept 2025 · Tags: CWE-926
- [Webull Investing & Trading App AndroidManifest.xml improper export of android application components](https://agentprime.io/advisories/CVE-2025-10721.md)
  `CVE-2025-10721` · CVE record: Webull Investing & Trading App · CVSS 4.8 Medium · Not analysed yet · Published 19 Sept 2025 · Tags: CWE-926
- [Ooma Office Business Phone App com.ooma.office2 improper export of android application components](https://agentprime.io/advisories/CVE-2025-10718.md)
  `CVE-2025-10718` · CVE record: Ooma Office Business Phone App · CVSS 4.8 Medium · Not analysed yet · Published 19 Sept 2025 · Tags: CWE-926
- [intsig CamScanner App com.intsig.camscanner AndroidManifest.xml improper export of android application components](https://agentprime.io/advisories/CVE-2025-10717.md)
  `CVE-2025-10717` · CVE record: intsig CamScanner App · CVSS 4.8 Medium · Not analysed yet · Published 19 Sept 2025 · Tags: CWE-926
- [Creality Cloud App com.cxsw.sdprinter AndroidManifest.xml improper export of android application components](https://agentprime.io/advisories/CVE-2025-10716.md)
  `CVE-2025-10716` · CVE record: Creality Cloud App · CVSS 4.8 Medium · Not analysed yet · Published 19 Sept 2025 · Tags: CWE-926
- [APEUni PTE Exam Practice App com.ape_edication AndroidManifest.xml improper export of android application components](https://agentprime.io/advisories/CVE-2025-10715.md)
  `CVE-2025-10715` · CVE record: APEUni PTE Exam Practice App · CVSS 4.8 Medium · Not analysed yet · Published 19 Sept 2025 · Tags: CWE-926
- [Seismic App com.seismic.doccenter AndroidManifest.xml improper export of android application components](https://agentprime.io/advisories/CVE-2025-10195.md)
  `CVE-2025-10195` · CVE record: Seismic App · CVSS 4.8 Medium · Not analysed yet · Published 10 Sept 2025 · Tags: CWE-926
- [ZhenShi Mibro Fit App com.xiaoxun.xunoversea.mibrofit AndroidManifest.xml improper export of android application components](https://agentprime.io/advisories/CVE-2025-5500.md)
  `CVE-2025-5500` · CVE record: ZhenShi Mibro Fit App · CVSS 4.8 Medium · Not analysed yet · Published 9 Sept 2025 · Tags: CWE-926
- [Exported Android component in Google Android](https://agentprime.io/advisories/CVE-2025-32347.md)
  `CVE-2025-32347` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 4 Sept 2025 · Tags: CWE-926
- [GalleryVault Gallery Vault App com.thinkyeah.galleryvault AndroidManifest.xml improper export of android application components](https://agentprime.io/advisories/CVE-2025-9695.md)
  `CVE-2025-9695` · CVE record: GalleryVault Gallery Vault App · CVSS 4.8 Medium · Not analysed yet · Published 30 Aug 2025 · Tags: CWE-926
- [Modo Legend of the Phoenix com.duige.hzw.multilingual AndroidManifest.xml improper export of android application components](https://agentprime.io/advisories/CVE-2025-9677.md)
  `CVE-2025-9677` · CVE record: Modo Legend of the Phoenix · CVSS 4.8 Medium · Not analysed yet · Published 29 Aug 2025 · Tags: CWE-926
- [NCSOFT Universe App com.ncsoft.universeapp AndroidManifest.xml improper export of android application components](https://agentprime.io/advisories/CVE-2025-9676.md)
  `CVE-2025-9676` · CVE record: NCSOFT Universe App · CVSS 4.8 Medium · Not analysed yet · Published 29 Aug 2025 · Tags: CWE-926
- [Voice Changer App com.tuyangkeji.changevoice AndroidManifest.xml improper export of android application components](https://agentprime.io/advisories/CVE-2025-9675.md)
  `CVE-2025-9675` · CVE record: Voice Changer App · CVSS 4.8 Medium · Not analysed yet · Published 29 Aug 2025 · Tags: CWE-926
- [Transbyte Scooper News App com.hatsune.eagleee AndroidManifest.xml improper export of android application components](https://agentprime.io/advisories/CVE-2025-9674.md)
  `CVE-2025-9674` · CVE record: Transbyte Scooper News App · CVSS 4.8 Medium · Not analysed yet · Published 29 Aug 2025 · Tags: CWE-926
- [Kakao 헤이카카오 Hey Kakao App com.kakao.i.connect AndroidManifest.xml improper export of android application components](https://agentprime.io/advisories/CVE-2025-9673.md)
  `CVE-2025-9673` · CVE record: Kakao 헤이카카오 Hey Kakao App · CVSS 4.8 Medium · Not analysed yet · Published 29 Aug 2025 · Tags: CWE-926

Older: <https://agentprime.io/advisories/tag/cwe-926.md?cursor=WyIyMDI1LTA4LTI5VDIwOjAyOjA4LjM5NjAwMFoiLCJDVkUtMjAyNS05NjczIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-926>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-926/>. Everything for agents: <https://agentprime.io/llms.txt>.