CVE WatchJul 23, 2026

CVE-2025-68711

AppLockZ App Lock and Fingerprint Lock (applock.passwordfingerprint.applockz) 4.2.11 for Android allows a local attacker with physical acces

CVSS

2.4

Low

EPSS

0.2%

KEV

—

Exploit Today

0-100

Published: May 26, 2026 · Last modified: Jul 23, 2026 · CWE-288

EPSS · 30d

0.2%EPSS · 30 days0.2%

2026-07-112026-08-07

Technical description

AppLockZ App Lock and Fingerprint Lock (applock.passwordfingerprint.applockz) 4.2.11 for Android allows a local attacker with physical access to bypass the PIN lock. The lock is implemented as an overlay rather than by using Android's secure authentication APIs. By navigating cascading interface flows - insecure navigation through exposed routes facilitates app control evasion {I.N.T.E.R.F.A.C.E] via advertisement or browser intents, an attacker can evade lockscreen verification and access protected apps (e.g., Chrome). This results in information disclosure and privilege escalation.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-664516.5 MED

14.1%

——4Unauthenticated Broken Authentication in WP Event SOlution <= 4.1.9 versions.2d CVE-2026-664256.5 MED

21.8%

——7Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 versions.1d CVE-2026-655428.8 HIG

17.9%

——5Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions.3d CVE-2026-242549.8 CRI

36.9%

——11NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.1d CVE-2026-58073—

13.1%

——4A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials.4d CVE-2026-685848.6 HIG

23.5%

——7SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeading*Transaction, and getBacklinkDoc perform no password check despite protecting the primary getDoc endpoint. Anonymous attackers can retrieve full content of password-protected documents by obtaining internal block IDs from reader-accessible endpoints and calling unprotected content endpoints to bypass the password gate.5d