CVE Watch2 de nov. de 2026

CVE-2026-107019

Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthorized attackers to cre

CVSS

8.8

Alta

EPSS

0.3%

p25

KEV

—

Exploit Today

0-100

Publicado: 29 de out. de 2026 · Última mod.: 2 de nov. de 2026 · CWE-926

EPSS · 30d

0.2%EPSS · 30 dias0.3%

2026-10-302026-11-07

Descrição técnica

Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthorized attackers to create forged holiday/work-time entries via crafted ICS imports.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-543768.2 ALT

1.6%

——0VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure custom URI scheme vulnerability that allows a malicious application to intercept Fitbit login tokens by registering the same callback scheme (vitafit://vtio.cn). Attackers can capture the 30-day Fitbit authorization token with weight scope delivered in the callback URL to read, create, and delete the victim's weight and body-fat records via the Fitbit Body API.3d CVE-2026-1070597.5 ALT

26.4%

——8An issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switch to an attacker controlled progile, bypassing authentication.5d CVE-2026-1070579.8 CRÍ

33.2%

——10An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip.6d CVE-2026-1070517.5 ALT

16.1%

——5Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified build) allows unauthorized attackers to arbitrarily manipulate another user's FHEM home-automation control configurations.6d CVE-2026-1070489.8 CRÍ

45.5%

——14An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted POST request.5d CVE-2026-1070465.3 MÉD

20.8%

——6A Server-Side Request Forgery (SSRF) in the url/title/author/coverUrl component of FocusPodcast versionCode 70allows attackers to scan internal resources via supplying a crafted URL.6d