Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-90600 | medium | 6.3 | No | A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/inv_edit1... | 2026-09-15 |
| CVE-2026-90595 | medium | 6.3 | No | A security flaw has been discovered in wxiaoqi Spring-Cloud-Platform 1.0/2.2/3.0. This issue affects the function OnlineController.getOnline... | 2026-09-15 |
| CVE-2026-28609 | high | 8.8 | No | In read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting. This could lead to remote code execution... | 2026-09-15 |
| CVE-2026-28662 | high | 8.0 | No | In p2p_process_prov_disc_bootstrap_req of p2p_pd.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead t... | 2026-09-15 |
| CVE-2026-28658 | high | 7.8 | No | In findMetaAuthUid of AccountsDb.java, there is a possible frp bypass due to a logic error in the code. This could lead to local escalation... | 2026-09-15 |
| CVE-2026-28657 | high | 7.8 | No | In onActivityResult of AppWidgetConfigActivityProxy.java, there is a possible unauthorized URI permission grant due to a confused deputy. Th... | 2026-09-15 |
| CVE-2026-28656 | high | 7.3 | No | In multiple functions of DeviceAdminAdd.java, there is a possible way to an overlay due to a tapjacking/overlay attack. This could lead to l... | 2026-09-15 |
| CVE-2026-28655 | high | 7.8 | No | In multiple functions of RemoteViews.java, there is a possible background activity launch bypass due to a logic error in the code. This coul... | 2026-09-15 |
| CVE-2026-28650 | high | 7.8 | No | In setHiddenWhileSuspended of WindowState.java, there is a possible overlay bypass due to a logic error in the code. This could lead to loca... | 2026-09-15 |
| CVE-2026-28644 | high | 7.8 | No | In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible permission bypass due to a confused deputy. This could... | 2026-09-15 |
| CVE-2026-85014 | high | 7.5 | No | undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSoc... | 2026-09-15 |
| CVE-2026-28642 | high | 7.8 | No | In executeRequest of ActivityStarter.java, there is a possible background activity launch due to a logic error in the code. This could lead... | 2026-09-15 |
| CVE-2026-28639 | high | 7.8 | No | In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to a logic error in the code. This could lead to local es... | 2026-09-15 |
| CVE-2026-28630 | low | 3.3 | No | In onCreate of ContactsPickerActivity.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This could lead to local inf... | 2026-09-15 |
| CVE-2026-28627 | medium | 4.3 | No | In btm_sec_encrypt_change of btm_sec.cc, there is a possible downgrade attack due to a logic error in the code. This could lead to remote in... | 2026-09-15 |
| CVE-2026-28626 | high | 7.3 | No | In onCreate of SetupPassthroughActivity.java, there is a possible way to launch arbitrary activity due to Intent redirection . This could le... | 2026-09-15 |
| CVE-2026-28624 | high | 7.8 | No | In multiple locations, there is a possible read/write access to files without the proper permissions due to a confused deputy. This could le... | 2026-09-15 |
| CVE-2026-28623 | low | 3.3 | No | In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the Bluetooth MAC address due to a missing permission... | 2026-09-15 |
| CVE-2026-28622 | low | 3.3 | No | In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass. This co... | 2026-09-15 |
| CVE-2026-28660 | low | 3.3 | No | In getAllSessions of multiple files, there is a possible confused deputy due to a logic error in the code. This could lead to local informat... | 2026-09-15 |