CWE-926.

VitaFit Android < 2.8.1.0 Custom URI Scheme Token Hijacking

• Shenzhen Shine Industrial Co., Ltd. VitaFit
• CWE-926

An issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switch to an attacker controlled progile, bypassing authentication.

• CWE-926

An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip.

• CWE-926

Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified build) allows unauthorized attackers to arbitrarily manipulate another user's FHEM home-automation control configurations.

• CWE-926

An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted POST request.

• CWE-926

A Server-Side Request Forgery (SSRF) in the url/title/author/coverUrl component of FocusPodcast versionCode 70allows attackers to scan internal resources via supplying a crafted URL.

• CWE-926

Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's SMS-code-capture mechanism.

• CWE-926

Insecure permissions in the FeatureActionActivity component of Oasis Feng Island versionCode 51801 allows unauthorized attackers to arbitrarily force a freeze in the device, leading to a Denial of Se…

• CWE-926

Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow.

• CWE-926

Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of application data.

• CWE-926

Insecure permissions in Mission Control / AIMSICD versionCode 2026080501 allows unauthorized attackers to invoke an exported component, impacting the tracker blocker mechanism of the application.

• CWE-926

Insecure permissions in the MirakelInternalContentProvider component of Mirakel v3.0 (versionCode 60) allows unauthorized attackers to arbitrarily read and modify another user's task database.

• CWE-926

Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow.

• CWE-926

Insecure permissions in craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) allows unauthorized attackers to trigger the OTP-clipboard (One-Time Password) mechanism, causing a desynchronization of…

• CWE-926

Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting.

• CWE-926

Insecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) allows unauthorized attackers to export the application's data.

• CWE-926

Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbitrarily read flashcards across the user's entire m…

• CWE-926

Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthorized attackers to create forged holiday/work-time entries via crafted ICS import…

• CWE-926

Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read notes in another user's' note database.

• CWE-926

LeeDrOiD Labs Shortcutter 2 App ToggleGeneric.java Class.forName improper export of android application components

• LeeDrOiD Labs Shortcutter 2 App
• CWE-926

Exported Android component in Samsung Mobile Samsung Account

• Samsung Mobile Samsung Account
• CWE-926

Acode: Exported TerminalService (bundled terminal plugin) lets any installed app execute arbitrary shell commands as Acode

• Acode
• Broken access control
• CWE-749

Exported Android component in NTT DOCOMO BUSINESS, Inc. ManabiPocket for Parents

• NTT DOCOMO BUSINESS, Inc. ManabiPocket for Parents
• CWE-926

Ekia File Manager 1.2.7 - Exported ContentProvider allows unauthorized file access

• Ekia File Manager
• CWE-926

Exported Android component in Lenovo File Manager Application

• Lenovo File Manager Application
• CWE-926

Exported Android component in Samsung Mobile Visual Voicemail

• Samsung Mobile Visual Voicemail
• CWE-926

Exported Android component in Samsung Mobile Bixby Touch

• Samsung Mobile Bixby Touch
• CWE-926

Exported Android component in Google Android

• Google Android
• CWE-926

Exported Android component in MediaTek, Inc. MediaTek chipset

• MediaTek, Inc. MediaTek chipset
• CWE-926

Exported Android component in Samsung Mobile SamsungPassAutofill

• Samsung Mobile SamsungPassAutofill
• CWE-926

Exported Android component in Samsung Mobile Devices

• Samsung Mobile Devices
• CWE-926

Exported Android component in Samsung Mobile Devices

• Samsung Mobile Devices
• CWE-926

Exported Android component in Datadog Android App

• Datadog Android App
• CWE-926

Exported Android component in Datadog Android App

• Datadog Android App
• CWE-926

Exported Android component in Datadog Android App

• Datadog Android App
• CWE-926

textPlus Text Message and Call App com.gogii.textplus DialerActivity improper export of android application components

• textPlus Text Message and Call App
• CWE-926

Exported Android component in MediaTek, Inc. MediaTek chipset

• MediaTek, Inc. MediaTek chipset
• CWE-926

Stoat for Android Internal File Disclosure via Exported ShareTargetActivity URI Validation

• stoatchat Stoat for Android
• CWE-926

Exported Android component in ASUS Router app

• ASUS Router app
• CWE-926

Home Assistant: Exported BroadcastReceiver allows local apps to spoof device location

• home-assistant core
• CWE-926

An issue was discovered in Rakuten Send Anywhere (File Transfer) for Android (com.estmob.android.sendanywhere) 23.2.9.

• CWE-926

Exported Android component in Fortinet FortiTokenAndroid

• Fortinet FortiTokenAndroid
• CWE-926

Samsung Print Service Plugin – Potential Information Disclosure

• HP, Inc Samsung Print Service Plugin
• CWE-926

KL-001-2026-01: yintibao Fun Print Mobile Unauthorized Access via Context Hijacking

• yintibao Fun Print Mobile
• CWE-926

Yalantis uCrop AndroidManifest.xml UCropActivity improper export of android application components

• Yalantis uCrop
• CWE-926

SKTLab Mukbee App com.dw.android.mukbee AndroidManifest.xml improper export of android application components

• SKTLab Mukbee App
• CWE-926

Webull Investing & Trading App AndroidManifest.xml improper export of android application components

• Webull Investing & Trading App
• CWE-926

Ooma Office Business Phone App com.ooma.office2 improper export of android application components

• Ooma Office Business Phone App
• CWE-926

intsig CamScanner App com.intsig.camscanner AndroidManifest.xml improper export of android application components

• intsig CamScanner App
• CWE-926

Creality Cloud App com.cxsw.sdprinter AndroidManifest.xml improper export of android application components

• Creality Cloud App
• CWE-926

APEUni PTE Exam Practice App com.ape_edication AndroidManifest.xml improper export of android application components

• APEUni PTE Exam Practice App
• CWE-926

Seismic App com.seismic.doccenter AndroidManifest.xml improper export of android application components

• Seismic App
• CWE-926

ZhenShi Mibro Fit App com.xiaoxun.xunoversea.mibrofit AndroidManifest.xml improper export of android application components

• ZhenShi Mibro Fit App
• CWE-926

Exported Android component in Google Android

• Google Android
• CWE-926

GalleryVault Gallery Vault App com.thinkyeah.galleryvault AndroidManifest.xml improper export of android application components

• GalleryVault Gallery Vault App
• CWE-926

Modo Legend of the Phoenix com.duige.hzw.multilingual AndroidManifest.xml improper export of android application components

• Modo Legend of the Phoenix
• CWE-926

NCSOFT Universe App com.ncsoft.universeapp AndroidManifest.xml improper export of android application components

• NCSOFT Universe App
• CWE-926

Voice Changer App com.tuyangkeji.changevoice AndroidManifest.xml improper export of android application components

• Voice Changer App
• CWE-926

Transbyte Scooper News App com.hatsune.eagleee AndroidManifest.xml improper export of android application components

• Transbyte Scooper News App
• CWE-926

Kakao 헤이카카오 Hey Kakao App com.kakao.i.connect AndroidManifest.xml improper export of android application components

• 헤이카카오 Hey Kakao App
• CWE-926