Skip to content
BackEsc
Sign in

CWE-926 · weakness in Access Control

Improper Export of Android Application Components

152 CVEs

Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

Every one of the 152 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted POST request.CVE-2026-107048CVSS 9.8 · 0.5% likely
  2. KL-001-2026-01: yintibao Fun Print Mobile Unauthorized Access via Context HijackingCVE-2025-15464yintibao · CVSS 7.5 · 0.5% likely
  3. Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and con…CVE-2026-107032CVSS 9.1 · 0.5% likely
  4. Insecure permissions in the FeatureActionActivity component of Oasis Feng Island versionCode 51801 allows unauthorized attackers to arbitrarily force a freeze in the device, leadi…CVE-2026-107041CVSS 7.5 · 0.4% likely
  5. An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip.CVE-2026-107057CVSS 9.8 · 0.4% likely
  6. InstantBits Web Video Cast App com.instantbits.cast.webvideo AndroidManifest.xml improper export of android application componentsCVE-2025-7891InstantBits · CVSS 5.3 · 0.4% likely
  7. Element X Android vulnerable to loading malicious web pages via received intentCVE-2025-27599element-hq · CVSS 6.5 · 0.4% likely

    Element-Hq

  8. Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control o…CVE-2026-107038CVSS 9.1 · 0.4% likely
  9. Dunamu StockPlus App com.dunamu.stockplus AndroidManifest.xml improper export of android application componentsCVE-2025-7890Dunamu · CVSS 5.3 · 0.3% likely
  10. IDnow App de.idnow AndroidManifest.xml improper export of android application componentsCVE-2025-7892Idnow · CVSS 5.3 · 0.3% likely
  11. Foresight News App pro.foresightnews.appa AndroidManifest.xml improper export of android application componentsCVE-2025-7893Foresight · CVSS 5.3 · 0.3% likely
  12. Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow.CVE-2026-107040CVSS 9.1 · 0.3% likely
  13. Insecure permissions in craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) allows unauthorized attackers to trigger the OTP-clipboard (One-Time Password) mechanism, causing a…CVE-2026-107030CVSS 7.5 · 0.3% likely
  14. Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwritin…CVE-2026-107027CVSS 9.1 · 0.3% likely
  15. Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbitrarily read flashcards across…CVE-2026-107021CVSS 9.1 · 0.3% likely
  16. An issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switch to an attacker controlled progile, bypassing authenticatio…CVE-2026-107059CVSS 7.5 · 0.3% likely
  17. Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthorized attackers to create forged holiday/work-time entries vi…CVE-2026-107019CVSS 8.8 · 0.3% likely
  18. Insecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) allows unauthorized attackers to export the application's data.CVE-2026-107025CVSS 7.5 · 0.3% likely
  19. Verkehrsauskunft Österreich SmartRide/cleVVVer/BusBahnBim/Salzburg Verkehr AndroidManifest.xml improper export of android application componentsCVE-2025-9135Verkehrsauskunft Österreich · CVSS 5.3 · 0.3% likely
  20. AfterShip Package Tracker App com.aftership.AfterShip AndroidManifest.xml improper export of android application componentsCVE-2025-9134AfterShip · CVSS 5.3 · 0.3% likely
  21. Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's SMS-code-capture mechanism.CVE-2026-107043CVSS 9.1 · 0.3% likely
  22. Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read notes in another user's' note database.CVE-2026-107014CVSS 9.1 · 0.3% likely
  23. BuzzFeed App com.buzzfeed.android AndroidManifest.xml improper export of android application componentsCVE-2025-9093Buzzfeed · CVSS 5.3 · 0.3% likely
  24. In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conver…CVE-2026-47361Datadog · CVSS 6.4 · 0.3% likely

    DataDog

  25. Modo Legend of the Phoenix com.duige.hzw.multilingual AndroidManifest.xml improper export of android application componentsCVE-2025-9677Modo · CVSS 5.3 · 0.3% likely
  26. NCSOFT Universe App com.ncsoft.universeapp AndroidManifest.xml improper export of android application componentsCVE-2025-9676NCSOFT · CVSS 5.3 · 0.3% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in