CVE-2026-107040
Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitra
CVSS
9.1
Crítica
EPSS
0.3%
p28
KEV
—
Exploit Today
8
0-100
Publicado: 29 de out. de 2026 · Última mod.: 4 de nov. de 2026 · CWE-926
0.2%EPSS · 30 dias0.3%
2026-10-302026-11-07
Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow.
- f-droid.orghttps://f-droid.org/packages/net.basov.omngo.fdroid/
- github.comhttps://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107040.md
- github.comhttps://github.com/mvbasov/OMN-Go
- github.comhttps://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107040.md
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-543768.2 ALT1.6%
——0VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure custom URI scheme vulnerability that allows a malicious application to intercept Fitbit login tokens by registering the same callback scheme (vitafit://vtio.cn). Attackers can capture the 30-day Fitbit authorization token with weight scope delivered in the callback URL to read, create, and delete the victim's weight and body-fat records via the Fitbit Body API.3dCVE-2026-1070597.5 ALT26.4%
——8An issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switch to an attacker controlled progile, bypassing authentication.5dCVE-2026-1070579.8 CRÍ33.2%
——10An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip.6dCVE-2026-1070517.5 ALT16.1%
——5Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified build) allows unauthorized attackers to arbitrarily manipulate another user's FHEM home-automation control configurations.6dCVE-2026-1070489.8 CRÍ45.5%
——14An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted POST request.5dCVE-2026-1070465.3 MÉD20.8%
——6A Server-Side Request Forgery (SSRF) in the url/title/author/coverUrl component of FocusPodcast versionCode 70allows attackers to scan internal resources via supplying a crafted URL.6d