CVE Watch23 jul 2026

CVE-2025-68711

AppLockZ App Lock and Fingerprint Lock (applock.passwordfingerprint.applockz) 4.2.11 for Android allows a local attacker with physical acces

CVSS

2.4

Bajo

EPSS

0.2%

KEV

—

Exploit Today

0-100

Publicado: 26 may 2026 · Última mod.: 23 jul 2026 · CWE-288

EPSS · 30d

0.2%EPSS · 30 días0.2%

2026-07-112026-08-07

Descripción técnica

AppLockZ App Lock and Fingerprint Lock (applock.passwordfingerprint.applockz) 4.2.11 for Android allows a local attacker with physical access to bypass the PIN lock. The lock is implemented as an overlay rather than by using Android's secure authentication APIs. By navigating cascading interface flows - insecure navigation through exposed routes facilitates app control evasion {I.N.T.E.R.F.A.C.E] via advertisement or browser intents, an attacker can evade lockscreen verification and access protected apps (e.g., Chrome). This results in information disclosure and privilege escalation.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-664516.5 MED

14.1%

——4Unauthenticated Broken Authentication in WP Event SOlution <= 4.1.9 versions.2d CVE-2026-664256.5 MED

21.8%

——7Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 versions.1d CVE-2026-655428.8 ALT

17.9%

——5Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions.3d CVE-2026-242549.8 CRÍ

36.9%

——11NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.1d CVE-2026-58073—

13.1%

——4A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials.4d CVE-2026-685848.6 ALT

23.5%

——7SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeading*Transaction, and getBacklinkDoc perform no password check despite protecting the primary getDoc endpoint. Anonymous attackers can retrieve full content of password-protected documents by obtaining internal block IDs from reader-accessible endpoints and calling unprotected content endpoints to bypass the password gate.5d