PULSEUnderground Intel

EN VIVO35señales / 24h

FEED

ransomvexy ransomware reclama a System Soft · BG · Technologyransomvexy ransomware reclama a JHAMF Group · BDransomemperador reclama a Punta Shopping · BR · Retail & E-Commerceransomnightspire reclama a **F*A *.Aransompayload reclama a Straze Garden Center · Retail & E-Commerceransompayload reclama a Kraft Lernen · DE · Educationransompayload reclama a SALEG (Sachsen-Anhaltische Landesentwicklungsgesellschaft mbH) · DE · Government & Defenseransomrhysida reclama a Phoenix Charter Academy · US · Educationransomauditteam reclama a Pe***CT · NLransomauditteam reclama a jl***om · SGransomauditteam reclama a hn***rgransomauditteam reclama a ro***upransomsarcoma reclama a Ivan Smith Furniture · PH · Retail & E-Commerceransomwhitearmor reclama a Gamdom V2 · Otherransomvexy ransomware reclama a System Soft · BG · Technologyransomvexy ransomware reclama a JHAMF Group · BDransomemperador reclama a Punta Shopping · BR · Retail & E-Commerceransomnightspire reclama a **F*A *.Aransompayload reclama a Straze Garden Center · Retail & E-Commerceransompayload reclama a Kraft Lernen · DE · Educationransompayload reclama a SALEG (Sachsen-Anhaltische Landesentwicklungsgesellschaft mbH) · DE · Government & Defenseransomrhysida reclama a Phoenix Charter Academy · US · Educationransomauditteam reclama a Pe***CT · NLransomauditteam reclama a jl***om · SGransomauditteam reclama a hn***rgransomauditteam reclama a ro***upransomsarcoma reclama a Ivan Smith Furniture · PH · Retail & E-Commerceransomwhitearmor reclama a Gamdom V2 · Other

← Todos los CVEs

CVE Watch23 sept 2026

CVE-2026-49887

In maybeRemoveInvalidInstallerPackageName of InstallRepository.kt, there is a possible unauthorized app update due to a permissions bypass.

CVSS

7.8

Alto

EPSS

0.1%

p0

KEV

—

Exploit Today

0

0-100

Publicado: 8 sept 2026 · Última mod.: 23 sept 2026 · CWE-288

EPSS · 30d

0.1%EPSS · 30 días0.1%

2026-10-032026-10-30

Descripción técnica

In maybeRemoveInvalidInstallerPackageName of InstallRepository.kt, there is a possible unauthorized app update due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Referencias oficiales

source.android.comhttps://source.android.com/docs/security/bulletin/2026/2026-09-01

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-115829—

——0In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successfully negotiating the second factor login step only.1d CVE-2026-1194208.8 ALT

——0Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim's email, accept with an arbitrary password, and receive a JWT to access the victim's organizations, billing data, API keys and payment integrations.1d CVE-2026-118582—

——2Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass. This issue affects CAPTCHA versions: from 0.0.0 to 1.18.0, from 2.0.0 to 2.0.11.1d CVE-2026-118572—

——2Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass. This issue affects OAuth Login - OAuth OIDC SSO versions: from 0.0.0 to 3.1.1.1d CVE-2026-118554—

——3Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1.1d CVE-2026-1145725.4 MED

——3Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Domain Login Restrict allows Authentication Bypass. This issue affects Domain Login Restrict versions: from 0.0.0 to 1.5.0.1d