Home / CVEs
CVE Database
Published vulnerabilities with severity, known exploitation and official sources.
CVE-2026-96614
Medium · 5.4
CWE-939 Oct 15, 2026
"ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler…
"ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme. An attacker may be able to cause the application's in-app browser to access an arbitrary website, potentially leading to phishing attacks or disclosure of a service's session ID.
CVE-2026-53418
High · 8.1
CWE-939 Oct 13, 2026
Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android…
Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escalation of privilege via network access.
CVE-2026-92862
Low · 3.3
CWE-939 Oct 8, 2026
The Android application "Ticket Ryutsu Center" improperly handles custom URL schemes…
The Android application "Ticket Ryutsu Center" improperly handles custom URL schemes, allowing a malicious application to cause access to an arbitrary website via a crafted Intent.
CVE-2026-73335
Medium · 5.3
CWE-939 Aug 26, 2026
Android application "Myna Point" is vulnerable to Improper Authorization in Handler for…
Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939). A malicious application installed on the user's Android device may exploit the affected application's functionality through an Intent, potentially allowing arbitrary JavaScript to be executed within the affected application.
CVE-2026-21075
Medium · 5.3
CWE-939 Aug 10, 2026
Improper authorization in handler for custom URL scheme in My Galaxy prior to version…
Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information.
CVE-2026-21062
Low · 3.3
CWE-939 Aug 10, 2026
Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local…
Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local attackers to access clipboard data.
CVE-2026-53408
High · 8.1
CWE-939 Jun 12, 2026
Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version…
Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticated user to conduct an escalation of privilege via network access.
CVE-2026-53407
Critical · 9.8
CWE-939 Jun 12, 2026
Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version…
Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticated user to conduct an escalation of privilege via network access.
CVE-2026-6445
High · 8.7
CWE-939 Jun 9, 2026
A flaw exists in FlashArray Purity where insufficient filtering of certain data paths…
A flaw exists in FlashArray Purity where insufficient filtering of certain data paths could expose sensitive information to an authenticated user with low privileges.
CVE-2026-3471
Medium · 6.5
CWE-939 May 18, 2026
Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop App
Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows a malicious server owner to repeated crash the application via calling {{window.open('javascript:alert()');}}. Mattermost Advisory ID: MMSA-2026-00618
CVE-2026-35394
High · 8.8
CWE-939 Apr 6, 2026
Mobile Next has Arbitrary Android Intent Execution via mobile_open_url
Mobile Next is an MCP server for mobile development and automation. Prior to 0.0.50, the mobile_open_url tool in mobile-mcp passes user-supplied URLs directly to Android's intent system without any scheme validation, allowing execution of arbitrary Android intents, including USSD codes, phone calls, SMS messages, and content provider access. This vulnerability is fixed in 0.0.50.
CVE-2026-33335
High · 8.0
CWE-939 Mar 24, 2026
Vikunja Desktop allows arbitrary local application invocation via unvalidated shell.openExternal
Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper passes URLs from `window.open()` calls directly to `shell.openExternal()` without any validation or protocol allowlisting. An attacker who can place a link with `target="_blank"` (or that otherwise triggers `window.open`) in user-generated content can cause the victim's operating system to open arbitrary URI schemes, invoking local applications, opening local files, or triggering custom protocol handlers. Version 2.2.0 patches the issue.
CVE-2026-26123
Medium · 5.5
CWE-939 Mar 10, 2026
Microsoft Authenticator Information Disclosure Vulnerability
Cwe is not in rca categories in Microsoft Authenticator allows an unauthorized attacker to disclose information locally.
CVE-2026-1046
Medium · 6.5
CWE-939 Feb 16, 2026
Arbitrary application execution via unvalidated server-controlled URLs in Help menu
Mattermost Desktop App versions <=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost server to execute arbitrary executables on a user’s system via the user clicking on certain items in the Help menu Mattermost Advisory ID: MMSA-2026-00577
CVE-2025-67739
Low · 3.1
CWE-939 Dec 11, 2025
In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to…
In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure