Threats affecting pkg:generic/osquery

A vulnerability in AndBible versionCode 1111 allows attackers to execute arbitrary code by uploading a specially crafted module zip file. This could enable unauthorized code execution within the affected application.

A vulnerability in Shelter versionCode 445 allows attackers to register their own authentication key, enabling them to take over another user's binder service API and preference state. This issue could lead to unauthorized control over user-specific services within the affected application.

An insecure permissions vulnerability in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN configurations and preferences.

An insecure permissions vulnerability in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write and truncate files in a shared storage space outside the app's sandbox.

A vulnerability in Forkyz versionCode 8500000 allows attackers to arbitrarily change another user's storage settings by supplying a crafted URI string. This issue enables unauthorized modification of user storage configurations.

A vulnerability in libretro RetroArch version 1.22.2 allows an attacker to force another user to load attacker-supplied code under their user ID, resulting in arbitrary code execution.

An insecure permission configuration in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attackers to read arbitrary files outside the sandbox by providing an absolute path.

An insecure permissions vulnerability in klassm AndFHEM v2.4.1 (versionCode 241) allows unauthorized attackers to manipulate other users' FHEM home-automation control configurations.

Mendhak GPSLogger versionCode 137 has insecure permissions that allow unauthorized attackers to manipulate the app's logging mechanism and log data.

A vulnerability exists in the WebView rendering path component of MotionCreative Motion UI versionCode 101 that allows attackers to execute arbitrary code by sending a crafted POST request.

IBM Langflow OSS versions 1.0.0 through 1.12.8 contain a vulnerability that allows a remote attacker to bypass security restrictions due to improper authentication. This flaw could lead to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability is rated critical with a CVSS score of 9.8.

CVE-2025-12523 is a vulnerability involving broken object level authorization in a users configuration endpoint, which allows an authenticated user to disclose information they should not access. The flaw impacts confidentiality but does not affect integrity or availability. The vulnerability has a CVSS 3.1 score of 6.5, indicating a medium severity level.

A use-after-free vulnerability in Chromium-based Microsoft Edge allows an unauthorized attacker to elevate privileges over a network. The flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system. The vulnerability is rated high severity with a CVSS score of 8.8.

FocusPodcast versionCode 70 contains a Server-Side Request Forgery (SSRF) vulnerability in its url/title/author/coverUrl component. This flaw allows attackers to supply crafted URLs to scan internal resources. No CVSS score or patch information is available.

A use-after-free vulnerability in Microsoft Edge for iOS allows an unauthorized attacker to execute code remotely over a network. This vulnerability could lead to complete compromise of confidentiality, integrity, and availability of the affected system. The issue is identified as CVE-2026-96192 and has a high severity score of 8.8.

A heap-based buffer overflow vulnerability exists in the Chromium-based Microsoft Edge browser. This flaw allows an unauthorized attacker to execute code remotely over a network, potentially leading to full compromise of the affected system. The vulnerability has a high severity rating with a CVSS score of 8.8.

Citrine v3.1.0 (versionCode 62) contains insecure permissions in its CitrineContentProvider component, which allows unauthorized attackers to read another user's Nostr event database.

A type confusion vulnerability in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. This flaw involves accessing a resource using an incompatible type, leading to potential information leakage.

Code Catcher versionCode 131 contains insecure permissions that allow unauthorized attackers to manipulate the app's SMS-code-capture mechanism.

CVE-2026-96196 is a high-severity vulnerability in the Chromium-based Microsoft Edge browser caused by an incomplete list of disallowed inputs. This flaw allows an unauthorized attacker to bypass a security feature remotely over a network, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS score of 8.8, indicating a serious risk. No specific affected versions or patch information are provided.