Tailscale Android build versionCode 297862600 exports a broadcast receiver without a permission or caller check. A locally installed app with no permissions can send a broadcast that changes the VPN exit-node setting, the allow-LAN-access setting, or the connect/disconnect state of the VPN. The exit node must already exist in the victim's netmap, and the connect action may require the system VPN consent on a fresh profile. The CVE record itself describes the issue only as insecure permissions, and the CVSS 9.1 score and CWE-732 are from NVD and could not be confirmed on NVD at the time of research.
Tailscale · Android app
The Nextcloud Android app (com.nextcloud.client) contains an exported activity without permission protection. A malicious app installed on the same phone, holding no permissions, can send a crafted login deep link that creates an account and sets it as current, so the victim app switches to an attacker-controlled server profile. The attacker must control the server named in the link, and no user interaction is needed. The NVD record and its network-based CVSS vector are unconfirmed, and the third-party advisory describes a local attack, so the severity rating is disputed.
Nextcloud · Android client
Shelter versionCode 445 (F-Droid version 1.9.1) exports an activity that accepts intents from any app without a permission. According to a third-party advisory, a local app with no permissions can register its own auth_key on a Shelter instance that was never enrolled and then use the app's binder service and change its preference state. Once a key is enrolled, the stored key is required, so the main risk is during first setup. The NVD score of 9.8 assumes network access, which the advisory does not confirm, so this should be treated as a risk from other apps on the same device.
PeterCxy · Shelter
AndBible, an offline Bible study app for Android, is affected by an issue in versionCode 1111 that allows arbitrary code execution. An attacker can exploit it by getting a user to upload a crafted module zip file. The CVE record does not state whether any user interaction beyond the upload is required, and no authentication is mentioned. The CVSS 9.8 score and the CWE classification in the CVE data could not be verified against NVD.
AndBible · AndBible: Bible Study
The io.file.importer.ImportActivity component of OpenTracks versionCode 6751 has insecure permissions. An attacker can inject crafted tracking data into the location database of the app via a crafted SEND message. The records were reported with CVSS 9.1 by the CVE data, but the scoring and attack vector are not confirmed by other sources, and the advisory text could not be read directly.
OpenTracks Team · OpenTracks
neutriNote CE for Android, versionCode 1387, has insecure permissions in its autosave component. According to the linked third-party advisory, an app without permissions could launch an exported activity and make the app write attacker-chosen content to a file URI the app can access. The CVE record states that unauthorized attackers can write arbitrary files, but the conditions and the real attack path are not confirmed. The advisory's CVSS attack vector (network) is disputed, and the sources do not show that the flaw is reachable remotely.
AppML · neutriNote CE
Librera Reader for Android (versionCode 7222) exports an activity that other apps can call without any permission. A calling app can supply a crafted file name that the reader uses to write and truncate files in shared storage outside its sandbox. No user interaction is needed, and the advisory states that writes beyond the Download folder additionally require that the victim app has been granted All files access.
foobnix · Librera Reader
The AIDL interface of the MAXS Module FileRead Android add-on (versionCode 27) has insecure permissions. An unauthorized attacker can read arbitrary files outside the app sandbox by supplying an absolute path. The CVSS 3.1 base score of 7.5 comes from NVD; VulDB rates the issue at 5.3 and limits the impact to confidentiality, and the required access path is unclear.
ProjectMAXS · MAXS Module FileRead
AndFHEM 2.4.1, an Android client for the FHEM home-automation server, exports two components without a permission check. Any app installed on the same device can send commands to the configured FHEM server, using the stored credentials of the user. The attack requires no user interaction, but the victim must have configured an FHEM server.
klassm · AndFHEM
RetroArch for Android (com.retroarch) version 1.22.2 exports an activity that accepts a file path from another app and loads that file as a native library. A locally installed app without any permissions can therefore make RetroArch copy and load attacker-supplied code, which runs with the uid and privileges of RetroArch. The official CVE record rates exploitation as possible through a proof of concept and automatable, but the NVD analysis is pending and the CVSS score of 9.8 is not yet confirmed by NVD.
libretro · RetroArch
An issue in Forkyz, an unofficial Android crossword app, versionCode 8500000 (Version 85), allows an attacker to change another user's storage settings by supplying a crafted URI string. The conditions for exploitation are not fully confirmed, and the vulnerability is unclear about whose storage is affected. The NVD score of 7.5 is not verified and conflicts with a VulDB score of 3.5 (Low).
Forkyz · Forkyz
Motion UI for Android (app.motionui.android), versionCode 101, exposes an activity to other apps on the same device without permission checks. A locally installed app can make it load an attacker-chosen URL in a WebView, which injects the victim's stored username and password into that page and submits them automatically. The attacker can receive the credentials and run script inside the WebView. The NVD description instead speaks of remote code execution via a crafted POST request; the primary advisory does not confirm this, so the NVD CVSS 9.8 rating should be treated with caution.
MotionCreative · Motion UI
GPSLogger version 137 for Android has insecure permissions that let unauthorized attackers manipulate the app's logging mechanism and the logged data. According to the third-party advisory, any app can start an exported activity without permissions and make GPSLogger download a profile from an attacker-chosen URL and activate it, which can redirect where logged data is uploaded. The victim must already have granted location access to the app. The CVSS vector assumes network access, while VulDB describes local access as required, so the real attack path needs verification.
mendhak · GPSLogger
Research and translation in progress – available shortly.
Citrine, a Nostr relay app for Android, exposes its Nostr event database through a content provider whose read permission is only protected at normal level. Any app on the same device that holds this permission can read the stored events, including direct messages and gift-wrapped events addressed to the user, by supplying a public key as a URI parameter that is not authenticated. The NVD record gives CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), but other sources rate it lower and dispute the network attack vector, so the real exposure depends on whether other apps on the device can reach the provider.
greenart7c3 · Citrine
MAXS Main, an Android app for remote control over XMPP, has insecure permissions in its command/transport mechanism in version 0.5.19. According to the CVE description, an unauthorized attacker can manipulate this mechanism. The public descriptions do not explain how an attacker reaches the app over the network, so the exact conditions are unclear. No fix, exploitation or public exploit is known, and the 7.5 score is unconfirmed.
ProjectMAXS · MAXS Main
CodeCatcher version 131 for Android exports an activity without permission protection. Any installed app without runtime permissions can send it the DEBUG action, which permanently enables a debug component that is disabled in the shipped build. The attacker can then open the internal debug UI, which shows the app's logs, including the logs of its SMS code capture service. No user interaction is required.
CNSYN · CodeCatcher
Research and translation in progress – available shortly.
A remote code execution vulnerability exists in the lmadmin web user interface of FlexNet Publisher, licence-management software that runs on licence servers. An attacker with high privileges on the lmadmin interface can execute code on the server, with high impact on confidentiality, integrity and availability. The CVSS vector requires no user interaction, but the attacker needs administrative access to the interface, so exposure of the web UI determines the practical risk.
Flexera · FlexNet Publisher
A use-after-free vulnerability (CWE-416) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over the network, according to the CNA record. The attack requires user interaction, for example opening a malicious web page. The CVSS 3.1 base score is 8.8 (High), and NVD analysis is still pending.
Microsoft · Edge (Chromium-based)
A heap-based buffer overflow (CWE-122) in Microsoft Edge (Chromium-based) allows a remote attacker without privileges to execute code. The victim must take an action, such as visiting a malicious or compromised web page. The CVSS base score is 8.8 (High), but the fixed build is not yet confirmed.
Microsoft · Microsoft Edge (Chromium-based)
A heap-based buffer overflow (CWE-122) in Microsoft Edge (Chromium-based) allows an unauthenticated remote attacker to execute code. The CVSS base score is 8.8 (High). Exploitation requires that a user is tricked into interacting, most likely by opening a malicious web page. CISA SSVC lists exploitation as none and automatable as no.
Microsoft · Edge (Chromium-based)
Microsoft Edge (Chromium-based) contains a security feature bypass caused by an incomplete list of disallowed inputs (CWE-184). An unauthenticated remote attacker can bypass a browser security feature over the network. Exploitation requires that a user visits a malicious or crafted web page. Microsoft rates the impact as High for confidentiality, integrity and availability.
Microsoft · Edge (Chromium-based)
A use-after-free vulnerability (CWE-416) in Microsoft Edge allows an unauthorized attacker to execute code over a network. The description also refers to Edge for iOS, while the affected products are listed as Chromium-based Edge. The CNA rates the issue at CVSS 3.1 8.8 with high impact on confidentiality, integrity and availability, and exploitation requires a user to visit a malicious page or perform a similar action but no privileges. VulDB scores the issue lower (6.3), so the severity assessment is inconsistent across sources.
Microsoft · Edge
A type confusion weakness (CWE-843) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. User interaction is required, so the victim must open crafted web content, for example via a link in an email or message. Only confidentiality is affected, with high impact, and the CVSS scope is changed, so the effect may reach beyond the browser.
Microsoft · Edge (Chromium-based)
