CVE Watch11 oct 2026

CVE-2025-10184

The vulnerability allows any application installed on the device to read SMS/MMS data and metadata from the system-provided Telephony provid

CVSS

—

Sin CVSS

EPSS

5.1%

p92

KEV

—

Exploit Today

0-100

Publicado: 23 sept 2025 · Última mod.: 11 oct 2026 · CWE-89 · CWE-862

EPSS · 30d

3.8%EPSS · 30 días5.1%

2026-10-072026-11-04

Descripción técnica

The vulnerability allows any application installed on the device to read SMS/MMS data and metadata from the system-provided Telephony provider without permission, user interaction, or consent. The user is also not notified that SMS data is being accessed. This could lead to sensitive information disclosure and could effectively break the security provided by SMS-based Multi-Factor Authentication (MFA) checks. The root cause is a combination of missing permissions for write operations in several content providers (com.android.providers.telephony.PushMessageProvider, com.android.providers.telephony.PushShopProvider, com.android.providers.telephony.ServiceNumberProvider), and a blind SQL injection in the update method of those providers.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1221916.3 MED

—

——0A vulnerability was determined in itsourcecode Airline Reservation System 1.0. This affects an unknown function of the file /admin/manage_booked.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.11h CVE-2026-69002—

—

——0Incorrect authorization in Samsung framework services due to missing permission checks12h CVE-2026-1223207.7 ALT

—

——0Kyverno before 1.19.2 contains a missing authorization vulnerability that allows namespaced Policy authors to read resources in other namespaces by templating generate.clone or cloneList namespace values. Attackers can annotate a triggering ConfigMap so the background-controller copies a victim namespace's sensitive ConfigMap into the attacker's namespace, enabling cross-tenant data disclosure.12h CVE-2026-1223168.5 ALT

—

——0Kyverno from 1.17.0 before 1.19.2 contains a missing authorization vulnerability in the mutate-existing background processor that allows namespaced tenants to modify resources outside their namespace. Attackers can create a NamespacedMutatingPolicy targeting Namespace objects or victim-namespace resources via CEL expressions, making the background-controller ServiceAccount strip Pod Security labels cluster-wide.12h CVE-2026-1223039.9 CRÍ