CWE-926
119 published CVEs are weaknesses of this kind, as the records or NVD name it.
- Published CVEs
- 119
- Last 12 months
- 45
- Critical
- 9
- Known exploited
- 0
Critical 9High 20Medium 85Low 5Not scored 0
CVEs per yearBy the year they were published
- 20218
- 20221
- 20236
- 202410
- 202550
- 202644
Newest CVEs
- CVE-2026-54376
VitaFit Android < 2.8.1.0 Custom URI Scheme Token Hijacking
Shenzhen Shine Industrial Co., Ltd. · VitaFit
High8.2 - CVE-2026-107059
An issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switch to an attacker controlled progile,…
Product not named
High7.5 - CVE-2026-107057
An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip.
Product not named
Critical9.8 - CVE-2026-107051
Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified build) allows unauthorized attackers to arbitrarily manipulate another user's FHEM…
Product not named
High7.5 - CVE-2026-107048
An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted…
Product not named
Critical9.8 - CVE-2026-107046
A Server-Side Request Forgery (SSRF) in the url/title/author/coverUrl component of FocusPodcast versionCode 70allows attackers to scan internal resources via…
Product not named
Medium5.3 - CVE-2026-107043
Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's SMS-code-capture mechanism.
Product not named
Critical9.1 - CVE-2026-107041
Insecure permissions in the FeatureActionActivity component of Oasis Feng Island versionCode 51801 allows unauthorized attackers to arbitrarily force a freeze…
Product not named
High7.5 - CVE-2026-107040
Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and…
Product not named
Critical9.1 - CVE-2026-107038
Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data…
Product not named
Critical9.1