Skip to content
BackEsc
Sign in

CWE-939 · weakness in Access Control

Improper Authorization in Handler for Custom URL Scheme

36 CVEs

Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

Every one of the 36 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Improper URL validation in GreenBrowserCVE-2020-11000luchua-bc · CVSS 5.7 · 1.2% likely
  2. Cisco AppDynamics Controller Authorization Bypass VulnerabilityCVE-2022-20736Cisco · CVSS 5.3 · 1.1% likely

    Cisco

  3. Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via network access.CVE-2023-43582Zoom Video Communications, Inc. · CVSS 5.5 · 0.7% likely

    Zoom Video Communications, Inc.

  4. Microsoft Authenticator Information Disclosure VulnerabilityCVE-2026-26123Microsoft · CVSS 5.5 · 0.7% likelycovered by CyberSIXT

    Microsoft

  5. Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information.CVE-2026-21075Samsung Mobile · CVSS 5.3 · 0.5% likely

    Samsung

  6. MicroDicom DICOM Viewer Improper Authorization in Handler for Custom URL SchemeCVE-2024-33606MicroDicom · CVSS 8.8 · 0.5% likely

    MicroDicom

  7. Mobile Next has Arbitrary Android Intent Execution via mobile_open_urlCVE-2026-35394mobile-next · CVSS 8.3 · 0.4% likely
  8. 'Rakuten Ichiba App' for Android 12.4.0 and earlier and 'Rakuten Ichiba App' for iOS 11.7.0 and earlier are vulnerable to improper authorization in handler for custom URL scheme.…CVE-2024-41918Rakuten Group, Inc. · CVSS 3.1 · 0.3% likely
  9. Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escalation of privilege…CVE-2026-53418Zoom Communications · CVSS 8.1 · 0.3% likelycovered by CyberSIXT

    Zoom Communications, Inc1 article

  10. Improper authorization in handler for custom URL scheme issue in "@cosme" App for Android versions prior 5.69.0 and "@cosme" App for iOS versions prior to 6.74.0 allows an attacke…CVE-2024-45203istyle Inc. · CVSS 4.3 · 0.3% likely
  11. Improper authorization in handler for custom URL scheme issue in 'ZOZOTOWN' App for Android versions prior to 7.39.6 allows an attacker to lead a user to access an arbitrary websi…CVE-2024-35298ZOZO, Inc. · CVSS 4.3 · 0.3% likely
  12. Nerimity Desktop Window Open mainWindow.js shell.openExternal improper authorization in handler for custom url schemeCVE-2026-113411Nerimity · CVSS 6.3 · 0.3% likely
  13. ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep link in a WebView that exposes the Android and Offerwall J…CVE-2026-106716CVSS 6.5 · 0.3% likely
  14. A flaw exists in FlashArray Purity where insufficient filtering of certain data paths could expose sensitive information to an authenticated user with low privileges.CVE-2026-6445Everpure · CVSS 8.7 · 0.3% likely
  15. Improper authorization in handler for custom URL scheme issue in "Yahoo! Shopping" App for Android versions prior to 14.15.0 allows a remote unauthenticated attacker may lead a us…CVE-2025-41408LY Corporation · CVSS 5.3 · 0.3% likely

    LY Corporation

  16. Arbitrary application execution via unvalidated server-controlled URLs in Help menuCVE-2026-1046Mattermost · CVSS 7.6 · 0.3% likely

    Mattermost

  17. Vikunja Desktop allows arbitrary local application invocation via unvalidated shell.openExternalCVE-2026-33335go-vikunja · CVSS 6.4 · 0.3% likely

    Go-Vikunja

  18. Dell Alienware Command Center (AWCC), version(s) Versions up to and including 6.14.20.0, contain(s) an Improper Authorization in Handler for Custom URL Scheme vulnerability. An un…CVE-2026-91900Dell · CVSS 5.8 · 0.3% likely

    Dell

  19. Links using non-HTTP schemes opened from other apps such as Safari could have allowed spoofing of website addressesCVE-2025-5020Mozilla · CVSS 4.3 · 0.2% likely

    Mozilla

  20. Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticated user to conduct an…CVE-2026-53407Zoom Communications · CVSS 8.1 · 0.2% likely

    Zoom Communications, Inc

  21. Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticated user to conduct an…CVE-2026-53408Zoom Communications · CVSS 8.1 · 0.2% likely

    Zoom Communications, Inc

  22. Apache OpenOffice: Remote document loaded without prompt, possibiy leaking environment variablesCVE-2026-90631Apache Software Foundation · CVSS 3.3 · 0.2% likely

    Apache

  23. Improper authorization in handler for custom URL scheme issue in 'Skylark' App for Android 6.2.13 and earlier and 'Skylark' App for iOS 6.2.13 and earlier allows an attacker to le…CVE-2024-54014SKYLARK HOLDINGS CO., LTD. · CVSS 3.6 · 0.2% likely
  24. NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin check. An attacker can supply such a page through the newsbrea…CVE-2026-106715CVSS 5.4 · 0.2% likely
  25. "ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme. An attacker may be able to cause the application's in-app browser t…CVE-2026-96614GEO CORPORATION · CVSS 5.1 · 0.2% likely
  26. Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop AppCVE-2026-3471Mattermost · CVSS 6.5 · 0.2% likely

    Mattermost

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in