Librera Reader for Android (versionCode 7222) exports an activity that other apps can call without any permission. A calling app can supply a crafted file name that the reader uses to write and truncate files in shared storage outside its sandbox. No user interaction is needed, and the advisory states that writes beyond the Download folder additionally require that the victim app has been granted All files access.
foobnix · Librera Reader
The AIDL interface of the MAXS Module FileRead Android add-on (versionCode 27) has insecure permissions. An unauthorized attacker can read arbitrary files outside the app sandbox by supplying an absolute path. The CVSS 3.1 base score of 7.5 comes from NVD; VulDB rates the issue at 5.3 and limits the impact to confidentiality, and the required access path is unclear.
ProjectMAXS · MAXS Module FileRead
AndFHEM 2.4.1, an Android client for the FHEM home-automation server, exports two components without a permission check. Any app installed on the same device can send commands to the configured FHEM server, using the stored credentials of the user. The attack requires no user interaction, but the victim must have configured an FHEM server.
klassm · AndFHEM
RetroArch for Android (com.retroarch) version 1.22.2 exports an activity that accepts a file path from another app and loads that file as a native library. A locally installed app without any permissions can therefore make RetroArch copy and load attacker-supplied code, which runs with the uid and privileges of RetroArch. The official CVE record rates exploitation as possible through a proof of concept and automatable, but the NVD analysis is pending and the CVSS score of 9.8 is not yet confirmed by NVD.
libretro · RetroArch
An issue in Forkyz, an unofficial Android crossword app, versionCode 8500000 (Version 85), allows an attacker to change another user's storage settings by supplying a crafted URI string. The conditions for exploitation are not fully confirmed, and the vulnerability is unclear about whose storage is affected. The NVD score of 7.5 is not verified and conflicts with a VulDB score of 3.5 (Low).
Forkyz · Forkyz
Motion UI for Android (app.motionui.android), versionCode 101, exposes an activity to other apps on the same device without permission checks. A locally installed app can make it load an attacker-chosen URL in a WebView, which injects the victim's stored username and password into that page and submits them automatically. The attacker can receive the credentials and run script inside the WebView. The NVD description instead speaks of remote code execution via a crafted POST request; the primary advisory does not confirm this, so the NVD CVSS 9.8 rating should be treated with caution.
MotionCreative · Motion UI
GPSLogger version 137 for Android has insecure permissions that let unauthorized attackers manipulate the app's logging mechanism and the logged data. According to the third-party advisory, any app can start an exported activity without permissions and make GPSLogger download a profile from an attacker-chosen URL and activate it, which can redirect where logged data is uploaded. The victim must already have granted location access to the app. The CVSS vector assumes network access, while VulDB describes local access as required, so the real attack path needs verification.
mendhak · GPSLogger
Research and translation in progress – available shortly.
Citrine, a Nostr relay app for Android, exposes its Nostr event database through a content provider whose read permission is only protected at normal level. Any app on the same device that holds this permission can read the stored events, including direct messages and gift-wrapped events addressed to the user, by supplying a public key as a URI parameter that is not authenticated. The NVD record gives CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), but other sources rate it lower and dispute the network attack vector, so the real exposure depends on whether other apps on the device can reach the provider.
greenart7c3 · Citrine
MAXS Main, an Android app for remote control over XMPP, has insecure permissions in its command/transport mechanism in version 0.5.19. According to the CVE description, an unauthorized attacker can manipulate this mechanism. The public descriptions do not explain how an attacker reaches the app over the network, so the exact conditions are unclear. No fix, exploitation or public exploit is known, and the 7.5 score is unconfirmed.
ProjectMAXS · MAXS Main
CodeCatcher version 131 for Android exports an activity without permission protection. Any installed app without runtime permissions can send it the DEBUG action, which permanently enables a debug component that is disabled in the shipped build. The attacker can then open the internal debug UI, which shows the app's logs, including the logs of its SMS code capture service. No user interaction is required.
CNSYN · CodeCatcher
Centreon Web does not properly enforce object-level authorization on the users configuration endpoint /centreon/api/latest/configuration/users. An authenticated user with a low-privilege account can query this endpoint and obtain sensitive configuration data of other users, such as contact details and access settings. Exploitation requires a valid account and a vulnerable version; no unauthenticated access is needed.
Centreon · Centreon Web
A remote code execution vulnerability exists in the lmadmin web user interface of FlexNet Publisher, licence-management software that runs on licence servers. An attacker with high privileges on the lmadmin interface can execute code on the server, with high impact on confidentiality, integrity and availability. The CVSS vector requires no user interaction, but the attacker needs administrative access to the interface, so exposure of the web UI determines the practical risk.
Flexera · FlexNet Publisher
A use-after-free vulnerability (CWE-416) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over the network, according to the CNA record. The attack requires user interaction, for example opening a malicious web page. The CVSS 3.1 base score is 8.8 (High), and NVD analysis is still pending.
Microsoft · Edge (Chromium-based)
A heap-based buffer overflow (CWE-122) in Microsoft Edge (Chromium-based) allows a remote attacker without privileges to execute code. The victim must take an action, such as visiting a malicious or compromised web page. The CVSS base score is 8.8 (High), but the fixed build is not yet confirmed.
Microsoft · Microsoft Edge (Chromium-based)
A heap-based buffer overflow (CWE-122) in Microsoft Edge (Chromium-based) allows an unauthenticated remote attacker to execute code. The CVSS base score is 8.8 (High). Exploitation requires that a user is tricked into interacting, most likely by opening a malicious web page. CISA SSVC lists exploitation as none and automatable as no.
Microsoft · Edge (Chromium-based)
Microsoft Edge (Chromium-based) contains a security feature bypass caused by an incomplete list of disallowed inputs (CWE-184). An unauthenticated remote attacker can bypass a browser security feature over the network. Exploitation requires that a user visits a malicious or crafted web page. Microsoft rates the impact as High for confidentiality, integrity and availability.
Microsoft · Edge (Chromium-based)
A use-after-free vulnerability (CWE-416) in Microsoft Edge allows an unauthorized attacker to execute code over a network. The description also refers to Edge for iOS, while the affected products are listed as Chromium-based Edge. The CNA rates the issue at CVSS 3.1 8.8 with high impact on confidentiality, integrity and availability, and exploitation requires a user to visit a malicious page or perform a similar action but no privileges. VulDB scores the issue lower (6.3), so the severity assessment is inconsistent across sources.
Microsoft · Edge
A type confusion weakness (CWE-843) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. User interaction is required, so the victim must open crafted web content, for example via a link in an email or message. Only confidentiality is affected, with high impact, and the CVSS scope is changed, so the effect may reach beyond the browser.
Microsoft · Edge (Chromium-based)
IBM Langflow OSS 1.0.0 through 1.12.8, an open-source tool for building AI agents and workflows, contains an improper authentication flaw (CWE-287). According to IBM, a remote attacker without credentials can bypass security restrictions. IBM groups this issue with other Langflow vulnerabilities, including remote code execution, and a public Metasploit module is reported.
IBM · Langflow OSS
Research and translation in progress – available shortly.
Szafir and Szafir Weryfikująca, Polish electronic signature applications from Krajowa Izba Rozliczeniowa, process external entities in XML files. When a user signs or verifies a crafted XML file with an external DTD reference, an attacker can read arbitrary files from the victim's system. Exploitation requires the victim to open the file, for example one received by email or download, and no network service is exposed.
Krajowa Izba Rozliczeniowa · Szafir
IBM Langflow OSS versions 1.0.0 through 1.12.4 allow a remote attacker with a valid user account to cause a denial of service. The cause is resource allocation without limits or throttling (CWE-770). An attacker can make the service unavailable by consuming resources, but cannot read or change data according to the CVSS vector. The vulnerable component and trigger are not described by IBM.
IBM · Langflow OSS
A flaw in the Manager web console of WS_FTP Server on Windows allows injection of directives into dynamically evaluated code (CWE-94/CWE-95). An authenticated Manager administrator can execute arbitrary commands with the privileges of the WS_FTP Server IIS worker process. The attack requires valid Manager administrator credentials and network access to the console. The CVSS 3.1 base score is 6.6 (MEDIUM).
Progress Software · WS_FTP Server
Research and translation in progress – available shortly.
