# CWE-939.

Every Advisory and CVE whose sources give the weakness CWE-939, newest first.

## Records, newest first

- [Apache OpenOffice: Remote document loaded without prompt, possibiy leaking environment variables](https://agentprime.io/advisories/CVE-2026-90631.md)
  `CVE-2026-90631` · CVE record: Apache Software Foundation Apache OpenOffice · CVSS 3.3 Low · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-939
- [Dell Alienware Command Center (AWCC): Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0…](https://agentprime.io/advisories/CVE-2026-91901.md)
  `CVE-2026-91901` · CVE record: Dell Alienware Command Center (AWCC) · CVSS 3.5 Low · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-939
- [Dell Alienware Command Center (AWCC): Dell Alienware Command Center (AWCC), version(s) Versions up to and including 6.14.20.0…](https://agentprime.io/advisories/CVE-2026-91900.md)
  `CVE-2026-91900` · CVE record: Dell Alienware Command Center (AWCC) · CVSS 5.8 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-939
- [n8n before 2.41.4 and 2.42.1 Local Gateway Deep-Link Silent Re-pairing to Attacker Instance](https://agentprime.io/advisories/CVE-2026-118677.md)
  `CVE-2026-118677` · CVE record: n8n-io n8n · CVSS 5.9 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-939
- [Nerimity Desktop Window Open mainWindow.js shell.openExternal improper authorization in handler for custom url scheme](https://agentprime.io/advisories/CVE-2026-113411.md)
  `CVE-2026-113411` · CVE record: Nerimity Desktop · CVSS 5.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control, CWE-939
- ["ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme.](https://agentprime.io/advisories/CVE-2026-96614.md)
  `CVE-2026-96614` · CVE record: GEO CORPORATION "ゲオアプリ" for Android and 1 more · CVSS 5.1 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-939
- [Zoom Communications Zoom Workplace: Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android…](https://agentprime.io/advisories/CVE-2026-53418.md)
  `CVE-2026-53418` · CVE record: Zoom Communications Zoom Workplace · CVSS 8.1 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-939
- [Wavedash Co., Ltd. Ticket Ryutsu Center: The Android application "Ticket Ryutsu Center" improperly handles custom URL schemes…](https://agentprime.io/advisories/CVE-2026-92862.md)
  `CVE-2026-92862` · CVE record: Wavedash Co., Ltd. Ticket Ryutsu Center · CVSS 4.6 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-939
- [Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939).](https://agentprime.io/advisories/CVE-2026-73335.md)
  `CVE-2026-73335` · CVE record: Digital Agency Android App "Myna Point" · CVSS 4.6 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-939
- [Samsung Mobile My Galaxy: Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3…](https://agentprime.io/advisories/CVE-2026-21075.md)
  `CVE-2026-21075` · CVE record: Samsung Mobile My Galaxy · CVSS 5.3 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: CWE-939
- [Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local attackers to access clipboard data.](https://agentprime.io/advisories/CVE-2026-21062.md)
  `CVE-2026-21062` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.8 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: CWE-939
- [Home Assistant Companion: \`homeassistant://invite\` Deep Link Credential Phishing](https://agentprime.io/advisories/CVE-2026-59717.md)
  `CVE-2026-59717` · CVE record: home-assistant core · CVSS 4.3 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Open redirect, CWE-939
- [Genspark AI Workspace App ai.mainfunc.genspark improper authorization in handler for custom url scheme](https://agentprime.io/advisories/CVE-2026-12190.md)
  `CVE-2026-12190` · CVE record: Genspark AI Workspace App · CVSS 4.8 Medium · Not analysed yet · Published 14 Jun 2026 · Tags: Broken access control, CWE-939
- [Moovit Bus & Public Transit App com.tranzmate improper authorization in handler for custom url scheme](https://agentprime.io/advisories/CVE-2026-12189.md)
  `CVE-2026-12189` · CVE record: Moovit Bus & Public Transit App · CVSS 4.8 Medium · Not analysed yet · Published 14 Jun 2026 · Tags: Broken access control, CWE-939
- [Zoom Communications Zoom Workplace: Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version…](https://agentprime.io/advisories/CVE-2026-53408.md)
  `CVE-2026-53408` · CVE record: Zoom Communications Zoom Workplace · CVSS 8.1 High · Not analysed yet · Published 12 Jun 2026 · Tags: CWE-939
- [Zoom Communications Zoom Workplace: Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version…](https://agentprime.io/advisories/CVE-2026-53407.md)
  `CVE-2026-53407` · CVE record: Zoom Communications Zoom Workplace · CVSS 8.1 High · Not analysed yet · Published 12 Jun 2026 · Tags: CWE-939
- [Groww Stock, Mutual Fund, Gold App WebView URL improper authorization in handler for custom url scheme](https://agentprime.io/advisories/CVE-2026-12065.md)
  `CVE-2026-12065` · CVE record: Groww Stock, Mutual Fund, Gold App · CVSS 1.0 Low · Not analysed yet · Published 12 Jun 2026 · Tags: Broken access control, CWE-939
- [Everpure FlashArray: A flaw exists in FlashArray Purity where insufficient filtering of certain data paths…](https://agentprime.io/advisories/CVE-2026-6445.md)
  `CVE-2026-6445` · CVE record: Everpure FlashArray · CVSS 8.7 High · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-939
- [Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop App](https://agentprime.io/advisories/CVE-2026-3471.md)
  `CVE-2026-3471` · CVE record: Mattermost Mattermost · CVSS 6.5 Medium · Not analysed yet · Published 18 May 2026 · Tags: CWE-939
- [@mobilenext/mobile-mcp: Arbitrary Android Intent Execution via mobile_open_url](https://agentprime.io/advisories/GHSA-5qhv-x9j4-c3vm.md)
  `GHSA-5qhv-x9j4-c3vm`, `CVE-2026-35394` · npm `@mobilenext/mobile-mcp`: affected `<0.0.50`, fixed in `0.0.50` · CVSS 8.3 High · Not analysed yet · Published 4 Apr 2026 · Tags: CWE-939
- [Vikunja Desktop allows arbitrary local application invocation via unvalidated shell.openExternal](https://agentprime.io/advisories/CVE-2026-33335.md)
  `CVE-2026-33335` · CVE record: go-vikunja vikunja · CVSS 6.4 Medium · Not analysed yet · Published 24 Mar 2026 · Tags: CWE-939
- [Microsoft Authenticator Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-26123.md)
  `CVE-2026-26123` · CVE record: Microsoft Microsoft Authenticator for Android and 1 more · CVSS 5.5 Medium · Not analysed yet · Published 10 Mar 2026 · Tags: CWE-939
- [Arbitrary application execution via unvalidated server-controlled URLs in Help menu](https://agentprime.io/advisories/CVE-2026-1046.md)
  `CVE-2026-1046` · CVE record: Mattermost Mattermost · CVSS 7.6 High · Not analysed yet · Published 16 Feb 2026 · Tags: CWE-939
- [JetBrains TeamCity: In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to…](https://agentprime.io/advisories/CVE-2025-67739.md)
  `CVE-2025-67739` · CVE record: JetBrains TeamCity · CVSS 3.1 Low · Not analysed yet · Published 11 Dec 2025 · Tags: CWE-939
- [Improper authorization in handler for custom URL scheme issue in "Yahoo!](https://agentprime.io/advisories/CVE-2025-41408.md)
  `CVE-2025-41408` · CVE record: LY Corporation "Yahoo! Shopping" App for Android · CVSS 5.3 Medium · Not analysed yet · Published 5 Sept 2025 · Tags: CWE-939
- [Links using non-HTTP schemes opened from other apps such as Safari could have allowed spoofing of website addresses](https://agentprime.io/advisories/CVE-2025-5020.md)
  `CVE-2025-5020` · CVE record: Mozilla Firefox for iOS · CVSS 4.3 Medium · Not analysed yet · Published 21 May 2025 · Tags: CWE-939
- [SHUEISHA INC. "Shonen Jump+" App for Android: Improper authorization in handler for custom URL scheme issue in "Shonen Jump+" App for…](https://agentprime.io/advisories/CVE-2024-54125.md)
  `CVE-2024-54125` · CVE record: SHUEISHA INC. "Shonen Jump+" App for Android · CVSS 3.3 Low · Not analysed yet · Published 17 Dec 2024 · Tags: CWE-939
- [SKYLARK HOLDINGS CO., LTD. 'Skylark' App for Android: Improper authorization in handler for custom URL scheme issue in 'Skylark' App for…](https://agentprime.io/advisories/CVE-2024-54014.md)
  `CVE-2024-54014` · CVE record: SKYLARK HOLDINGS CO., LTD. 'Skylark' App for Android and 1 more · CVSS 3.6 Low · Not analysed yet · Published 5 Dec 2024 · Tags: CWE-939
- [istyle Inc. "@cosme" App for Android: Improper authorization in handler for custom URL scheme issue in "@cosme" App for Android…](https://agentprime.io/advisories/CVE-2024-45203.md)
  `CVE-2024-45203` · CVE record: istyle Inc. "@cosme" App for Android and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 9 Sept 2024 · Tags: CWE-939
- [Rakuten Group, Inc. 'Rakuten Ichiba App' for Android: 'Rakuten Ichiba App' for Android 12.4.0 and earlier and 'Rakuten Ichiba App' for iOS…](https://agentprime.io/advisories/CVE-2024-41918.md)
  `CVE-2024-41918` · CVE record: Rakuten Group, Inc. 'Rakuten Ichiba App' for Android and 1 more · CVSS 3.1 Low · Not analysed yet · Published 29 Aug 2024 · Tags: CWE-939
- [ZOZO, Inc. 'ZOZOTOWN' App for Android: Improper authorization in handler for custom URL scheme issue in 'ZOZOTOWN' App for…](https://agentprime.io/advisories/CVE-2024-35298.md)
  `CVE-2024-35298` · CVE record: ZOZO, Inc. 'ZOZOTOWN' App for Android · CVSS 4.3 Medium · Not analysed yet · Published 19 Jun 2024 · Tags: CWE-939
- [MicroDicom DICOM Viewer Improper Authorization in Handler for Custom URL Scheme](https://agentprime.io/advisories/CVE-2024-33606.md)
  `CVE-2024-33606` · CVE record: MicroDicom DICOM Viewer · CVSS 8.6 High · Not analysed yet · Published 11 Jun 2024 · Tags: CWE-939
- [Zoom Video Communications, Inc. Zoom Clients: Improper authorization in some Zoom clients may allow an authorized user to conduct an…](https://agentprime.io/advisories/CVE-2023-43582.md)
  `CVE-2023-43582` · CVE record: Zoom Video Communications, Inc. Zoom Clients · CVSS 5.5 Medium · Not analysed yet · Published 14 Nov 2023 · Tags: CWE-939
- [Cisco AppDynamics Controller Authorization Bypass Vulnerability](https://agentprime.io/advisories/CVE-2022-20736.md)
  `CVE-2022-20736` · CVE record: Cisco Cisco AppDynamics · CVSS 5.3 Medium · Not analysed yet · Published 15 Jun 2022 · Tags: CWE-939
- [Junos OS: SRX Series: Under a specific device configuration an attacker can access the devices J-Web management services from any interface, regardless of security settings protecting the service](https://agentprime.io/advisories/CVE-2021-31384.md)
  `CVE-2021-31384` · CVE record: Juniper Networks Junos OS · CVSS 7.2 High · Not analysed yet · Published 19 Oct 2021 · Tags: Broken access control, CWE-551, CWE-939, CWE-1220
- [Improper URL validation in GreenBrowser](https://agentprime.io/advisories/CVE-2020-11000.md)
  `CVE-2020-11000` · CVE record: luchua-bc GreenBrowser · CVSS 5.7 Medium · Not analysed yet · Published 8 Apr 2020 · Tags: CWE-939

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-939>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-939/>. Everything for agents: <https://agentprime.io/llms.txt>.