CWE-926 · Access Control
Improper Export of Android Application Components
152CVEs
SortMost likely exploited
152 CVEs with CWE-926 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-107048An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted POST request.No vendor recorded · CVSS 9.8 · 2026-10-29 | 9.8 | 0.5% | 2026-10-29 |
| CVE-2025-15464KL-001-2026-01: yintibao Fun Print Mobile Unauthorized Access via Context Hijackingyintibao · Fun Print Mobile · CVSS 7.5 · 2026-01-08 | 7.5 | 0.5% | 2026-01-08 |
| CVE-2026-107032Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and con…No vendor recorded · CVSS 9.1 · 2026-10-29 | 9.1 | 0.5% | 2026-10-29 |
| CVE-2026-107041Insecure permissions in the FeatureActionActivity component of Oasis Feng Island versionCode 51801 allows unauthorized attackers to arbitrarily force a freeze in the device, leadi…No vendor recorded · CVSS 7.5 · 2026-10-29 | 7.5 | 0.4% | 2026-10-29 |
| CVE-2026-107057An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip.No vendor recorded · CVSS 9.8 · 2026-10-29 | 9.8 | 0.4% | 2026-10-29 |
| CVE-2025-7891InstantBits Web Video Cast App com.instantbits.cast.webvideo AndroidManifest.xml improper export of android application componentsInstantBits · Web Video Cast App · CVSS 5.3 · 2025-07-20 | 5.3 | 0.4% | 2025-07-20 |
| CVE-2025-27599Element X Android vulnerable to loading malicious web pages via received intentelement-hq · element-x-android · CVSS 6.5 · 2025-04-18 | 6.5 | 0.4% | 2025-04-18 |
| CVE-2026-107038Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control o…No vendor recorded · CVSS 9.1 · 2026-10-29 | 9.1 | 0.4% | 2026-10-29 |
| CVE-2025-7890Dunamu StockPlus App com.dunamu.stockplus AndroidManifest.xml improper export of android application componentsDunamu · StockPlus App · CVSS 5.3 · 2025-07-20 | 5.3 | 0.3% | 2025-07-20 |
| CVE-2025-7892IDnow App de.idnow AndroidManifest.xml improper export of android application componentsIdnow · IDnow App · CVSS 5.3 · 2025-07-20 | 5.3 | 0.3% | 2025-07-20 |
| CVE-2025-7893Foresight News App pro.foresightnews.appa AndroidManifest.xml improper export of android application componentsForesight · News App · CVSS 5.3 · 2025-07-20 | 5.3 | 0.3% | 2025-07-20 |
| CVE-2026-107040Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow.No vendor recorded · CVSS 9.1 · 2026-10-29 | 9.1 | 0.3% | 2026-10-29 |
| CVE-2026-107030Insecure permissions in craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) allows unauthorized attackers to trigger the OTP-clipboard (One-Time Password) mechanism, causing a…No vendor recorded · CVSS 7.5 · 2026-10-29 | 7.5 | 0.3% | 2026-10-29 |
| CVE-2026-107027Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwritin…No vendor recorded · CVSS 9.1 · 2026-10-29 | 9.1 | 0.3% | 2026-10-29 |
| CVE-2026-107021Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbitrarily read flashcards across…No vendor recorded · CVSS 9.1 · 2026-10-29 | 9.1 | 0.3% | 2026-10-29 |
| CVE-2026-107059An issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switch to an attacker controlled progile, bypassing authenticatio…No vendor recorded · CVSS 7.5 · 2026-10-29 | 7.5 | 0.3% | 2026-10-29 |
| CVE-2026-107019Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthorized attackers to create forged holiday/work-time entries vi…No vendor recorded · CVSS 8.8 · 2026-10-29 | 8.8 | 0.3% | 2026-10-29 |
| CVE-2026-107025Insecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) allows unauthorized attackers to export the application's data.No vendor recorded · CVSS 7.5 · 2026-10-29 | 7.5 | 0.3% | 2026-10-29 |
| CVE-2025-9135Verkehrsauskunft Österreich SmartRide/cleVVVer/BusBahnBim/Salzburg Verkehr AndroidManifest.xml improper export of android application componentsVerkehrsauskunft Österreich · SmartRide · CVSS 5.3 · 2025-08-19 | 5.3 | 0.3% | 2025-08-19 |
| CVE-2025-9134AfterShip Package Tracker App com.aftership.AfterShip AndroidManifest.xml improper export of android application componentsAfterShip · Package Tracker App · CVSS 5.3 · 2025-08-19 | 5.3 | 0.3% | 2025-08-19 |
| CVE-2026-107043Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's SMS-code-capture mechanism.No vendor recorded · CVSS 9.1 · 2026-10-29 | 9.1 | 0.3% | 2026-10-29 |
| CVE-2026-107014Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read notes in another user's' note database.No vendor recorded · CVSS 9.1 · 2026-10-29 | 9.1 | 0.3% | 2026-10-29 |
| CVE-2025-9093BuzzFeed App com.buzzfeed.android AndroidManifest.xml improper export of android application componentsBuzzfeed · BuzzFeed App · CVSS 5.3 · 2025-08-17 | 5.3 | 0.3% | 2025-08-17 |
| CVE-2026-47361In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conver…Datadog · Android App · CVSS 6.4 · 2026-08-07 | 6.4 | 0.3% | 2026-08-07 |
| CVE-2025-9677Modo Legend of the Phoenix com.duige.hzw.multilingual AndroidManifest.xml improper export of android application componentsModo · Legend of the Phoenix · CVSS 5.3 · 2025-08-29 | 5.3 | 0.3% | 2025-08-29 |
| CVE-2025-9676NCSOFT Universe App com.ncsoft.universeapp AndroidManifest.xml improper export of android application componentsNCSOFT · Universe App · CVSS 5.3 · 2025-08-29 | 5.3 | 0.3% | 2025-08-29 |
| CVE-2025-9674Transbyte Scooper News App com.hatsune.eagleee AndroidManifest.xml improper export of android application componentsTransbyte · Scooper News App · CVSS 5.3 · 2025-08-29 | 5.3 | 0.3% | 2025-08-29 |
| CVE-2025-9675Voice Changer App com.tuyangkeji.changevoice AndroidManifest.xml improper export of android application componentsVoice Changer Project · Voice Changer App · CVSS 5.3 · 2025-08-29 | 5.3 | 0.3% | 2025-08-29 |
| CVE-2025-68713An issue was discovered in Rakuten Send Anywhere (File Transfer) for Android (com.estmob.android.sendanywhere) 23.2.9. The vulnerability allows untrusted applications (with no per…No vendor recorded · CVSS 8 · 2026-06-15 | 8.0 | 0.3% | 2026-06-15 |
| CVE-2026-107046A Server-Side Request Forgery (SSRF) in the url/title/author/coverUrl component of FocusPodcast versionCode 70allows attackers to scan internal resources via supplying a crafted U…No vendor recorded · CVSS 5.3 · 2026-10-29 | 5.3 | 0.3% | 2026-10-29 |
| CVE-2025-7889CallApp Caller ID App caller.id.phone.number.block AndroidManifest.xml improper export of android application componentsCallApp · Caller ID App · CVSS 5.3 · 2025-07-20 | 5.3 | 0.3% | 2025-07-20 |
| CVE-2025-8745Weee RICEPO App com.ricepo.app AndroidManifest.xml improper export of android application componentsWeee · RICEPO App · CVSS 5.3 · 2025-08-09 | 5.3 | 0.3% | 2025-08-09 |
| CVE-2024-36437The com.enflick.android.TextNow (aka TextNow: Call + Text Unlimited) application 24.17.0.2 for Android enables any installed application (with no permissions) to place phone calls…No vendor recorded · CVSS 6.5 · 2025-02-03 | 6.5 | 0.3% | 2025-02-03 |
| CVE-2025-8210Yeelink Yeelight App com.yeelight.cherry AndroidManifest.xml improper export of android application componentsYeelink · Yeelight App · CVSS 5.3 · 2025-07-26 | 5.3 | 0.3% | 2025-07-26 |
| CVE-2025-8207Canara ai1 Mobile Banking App com.canarabank.mobility AndroidManifest.xml improper export of android application componentsCanara · ai1 Mobile Banking App · CVSS 5.3 · 2025-07-26 | 5.3 | 0.3% | 2025-07-26 |
| CVE-2026-47363In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session (including OAuth tokens) from I…Datadog · Android App · CVSS 6.3 · 2026-08-07 | 6.3 | 0.3% | 2026-08-07 |
| CVE-2025-8707Huuge Box App com.huuge.game.zjbox AndroidManifest.xml improper export of android application componentsHuuge · Box App · CVSS 5.3 · 2025-08-08 | 5.3 | 0.3% | 2025-08-08 |
| CVE-2021-4438kyivstarteam react-native-sms-user-consent SmsUserConsentModule.kt registerReceiver improper export of android application componentskyivstarteam · react-native-sms-user-consent · CVSS 5.3 · 2024-04-07 | 5.3 | 0.3% | 2024-04-07 |
| CVE-2025-14517Yalantis uCrop AndroidManifest.xml UCropActivity improper export of android application componentsYalantis · uCrop · CVSS 5.3 · 2025-12-11 | 5.3 | 0.3% | 2025-12-11 |
| CVE-2025-91021&1 Mail & Media mail.com App com.mail.mobile.android.mail AndroidManifest.xml improper export of android application components1&1 Mail & Media · mail.com App · CVSS 5.3 · 2025-08-18 | 5.3 | 0.3% | 2025-08-18 |
| CVE-2025-8258Cool Mo Maigcal Number App com.sdmagic.number AndroidManifest.xml improper export of android application componentsCool Mo · Maigcal Number App · CVSS 5.3 · 2025-07-28 | 5.3 | 0.3% | 2025-07-28 |
| CVE-2025-8257Lobby Universe Lobby App com.maverick.lobby AndroidManifest.xml improper export of android application componentsLobby Universe · Lobby App · CVSS 5.3 · 2025-07-28 | 5.3 | 0.3% | 2025-07-28 |
| CVE-2023-21486Improper export of android application components vulnerability in ImagePreviewActivity in Call Settings to SMR May-2023 Release 1 allows physical attackers to access some media d…Samsung Mobile · Samsung Mobile Devices · CVSS 5.3 · 2023-05-04 | 5.3 | 0.3% | 2023-05-04 |
| CVE-2023-21485Improper export of android application components vulnerability in VideoPreviewActivity in Call Settings to SMR May-2023 Release 1 allows physical attackers to access some media d…Samsung Mobile · Samsung Mobile Devices · CVSS 5.3 · 2023-05-04 | 5.3 | 0.3% | 2023-05-04 |
| CVE-2026-107051Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified build) allows unauthorized attackers to arbitrarily manipulate another user's FHEM home-automation con…No vendor recorded · CVSS 7.5 · 2026-10-29 | 7.5 | 0.2% | 2026-10-29 |
| CVE-2021-25400Intent redirection vulnerability in Samsung Internet prior to version 14.0.1.20 allows attacker to execute privileged action.Samsung Mobile · Samsug Internet · 2021-06-11 | – | 0.2% | 2021-06-11 |
| CVE-2021-25527Improper export of Android application components vulnerability in Samsung Pay (India only) prior to version 4.1.77 allows attacker to access Bill Pay and Recharge menu without au…Samsung Mobile · Samsung Pay · CVSS 3.8 · 2021-12-08 | 3.8 | 0.2% | 2021-12-08 |
| CVE-2025-9695GalleryVault Gallery Vault App com.thinkyeah.galleryvault AndroidManifest.xml improper export of android application componentsGalleryVault · Gallery Vault App · CVSS 5.3 · 2025-08-30 | 5.3 | 0.2% | 2025-08-30 |
| CVE-2021-25379Intent redirection vulnerability in Gallery prior to version 5.4.16.1 allows attacker to execute privileged action.Samsung Mobile · Gallery · CVSS 4 · 2021-04-09 | 4.0 | 0.2% | 2021-04-09 |
| CVE-2026-107033Insecure permissions in the MirakelInternalContentProvider component of Mirakel v3.0 (versionCode 60) allows unauthorized attackers to arbitrarily read and modify another user's t…No vendor recorded · CVSS 6.5 · 2026-10-29 | 6.5 | 0.2% | 2026-10-29 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.