2026

In hasImage of Notification.java, there is a possible way to reveal information across users due to a permissions bypass

In isRedactionNeededForOpenViaContentResolver of MediaProvider.java, there is a possible way to reveal the location of m

In createSessionInternal of PackageInstallerService.java, there is a possible way for an app to update its ownership due

In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permission bypass due to a c

In parsePermissionGroup of ParsedPermissionUtils.java, there is a possible way to bypass a consent dialog to obtain perm

In onChange of BiometricService.java, there is a possible way to enable fingerprint unlock due to a logic error in the c

In multiple locations of AppOpsService.java, there is a possible persistent denial of service due to improper input vali

In isPackageNullOrSystem of AppOpsService.java, there is a possible persistent denial of service due to improper input v

In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confuse

In setHideSensitive of ExpandableNotificationRow.java, there is a possible contact name leak due due to a logic error in

In enableSystemPackageLPw of Settings.java, there is a possible way to prevent location access from working due to a log

In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bounds check. This cou

In multiple functions of FaceEnroll.kt, there is a possible privilege escalation due to a confused deputy. This could le

In writeToParcel of WindowInfo.cpp, there is a possible way to trick a user into accepting a permission due to a tapjack

In multiple locations, there is a possible out of bounds read and write due to a heap buffer overflow. This could lead t

In onServiceDisconnected of KeyguardServiceDelegate.java, there is a possible partial bypass of app pinning allowing lim

In onStart of CompanionDeviceManagerService.java, there is a possible confused deputy due to a logic error in the code.

In loadDataAndPostValue of multiple files, there is a possible way to obscure permission usage due to a logic error in t

In multiple locations, there is a possible information disclosure due to SQL injection. This could lead to local escalat

In executeRequest of ActivityStarter.java, there is a possible launch anywhere due to a confused deputy. This could lead

In loadDescription of DeviceAdminInfo.java, there is a possible persistent package due to improper input validation. Thi

In multiple locations, there is a possible persistent denial of service due to improper input validation. This could lea

In jump_to_payload of payload.rs, there is a possible information disclosure due to a logic error in the code. This coul

In multiple functions of Nfc.h, there is a possible use after free due to a race condition. This could lead to local esc

In openFile of BugreportContentProvider.java, there is a possible way to read and write unauthorized files due to a path

In multiple functions of TaskFragmentOrganizerController.java, there is a possible activity token leak due to a logic er

In relayoutWindow of WindowManagerService.java, there is a possible tapjack attack due to a missing permission check. Th

In drawLayersInternal of SkiaRenderEngine.cpp, there is a possible way to access the GPU cache due to side channel infor

In multiple functions of ContentProvider.java, there is a possible way for an app with read-only access to truncate file

In VBMeta, there is a possible way to modify and resign VBMeta using a test key, assuming the original image was previou

In multiple functions of MmsProvider.java, there is a possible way to arbitrarily delete files which affect telephony, S

In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the co

In exitKeyguardAndFinishSurfaceBehindRemoteAnimation of KeyguardViewMediator.java, there is a possible lockscreen bypass

In multiple functions of ProfilingService.java, there is a possible persistent denial of service due to improper input v

In multiple functions of ProfilingService.java, there is a possible persistent denial of service due to improper input v

In multiple locations, there is a possible way to delete media without the MANAGE_EXTERNAL_STORAGE permission due to an

In multiple functions of MediaProvider.java, there is a possible external storage write permission bypass due to a confu

In multiple functions of MediaProvider.java, there is a possible way to bypass the WRITE_EXTERNAL_STORAGE permission due

In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a race condition. This

In validateAddingWindowLw of DisplayPolicy.java, there is a possible way for an app to intercept drag-and-drop events du

In multiple locations, there is a possible lockscreen bypass due to a race condition. This could lead to local escalatio

In multiple locations, there is a possible bypass of a file path filter designed to prevent access to sensitive director

In UsageEvents of UsageEvents.java, there is a possible out of bounds write due to an incorrect bounds check. This could

In multiple functions of btm_ble_sec.cc, there is a possible unencrypted communication due to Invalid error handling. Th

In broadcastIntentLockedTraced of BroadcastController.java, there is a possible way to launch arbitrary activities from

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to blind

The Master Addons for Elementor Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up t

sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_supplier.php.

sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_receipt.php.

sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_product.php.