CVE-2026-92862
The Android application "Ticket Ryutsu Center" improperly handles custom URL schemes, allowing a malicious application to cause access to an
CVSS
3.3
Low
EPSS
0.1%
p1
KEV
—
Exploit Today
0
0-100
Published: Oct 8, 2026 · Last modified: Oct 8, 2026 · CWE-939
0.1%EPSS · 30 days0.1%
2026-10-082026-10-20
The Android application "Ticket Ryutsu Center" improperly handles custom URL schemes, allowing a malicious application to cause access to an arbitrary website via a crafted Intent.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1134116.3 MED—
——0A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWindow.js of the component Window Open Handler. The manipulation of the argument url results in improper authorization in handler for custom url scheme. The attack can be executed remotely. The exploit has been made public and could be used. Upgrading to version 2.3.3 can resolve this issue. The patch is identified as f4df21bbc290f6c1956d899cf4da9e963074a6e4. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.1dCVE-2026-966145.4 MED8.4%
——3"ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme. An attacker may be able to cause the application's in-app browser to access an arbitrary website, potentially leading to phishing attacks or disclosure of a service's session ID.6dCVE-2026-534188.1 HIG13.6%
——4Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escalation of privilege via network access.8dCVE-2026-733355.3 MED3.3%
——1Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939). A malicious application installed on the user's Android device may exploit the affected application's functionality through an Intent, potentially allowing arbitrary JavaScript to be executed within the affected application.54dCVE-2026-21075—41.2%
——12Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information.64dCVE-2026-210623.3 LOW0.6%
——0Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local attackers to access clipboard data.64d