CVE-2026-53418 is a high-severity vulnerability in Zoom Workplace for Android before version 7.2.1. It involves improper authorization in the handler for a custom URL scheme, which may allow an unauthenticated user to escalate privileges via network access. The vulnerability has a CVSS score of 8.1, indicating a significant impact on confidentiality and integrity without requiring user interaction. No known exploits are reported in the wild. The issue is fixed in version 7.2.1.
CVE-2026-21075 is a medium severity vulnerability in Samsung Mobile's My Galaxy application prior to version 6.3. It involves improper authorization in the handler for a custom URL scheme, which allows remote attackers to access sensitive information. No specific affected versions or patches have been confirmed. The vulnerability does not require privileges or user interaction for exploitation but has low impact on confidentiality and no impact on integrity or availability.
CVE-2026-21062 is an authorization bypass vulnerability in the SemClipboardService component of Samsung Mobile Devices prior to the SMR August 2026 Release 1. This flaw allows local attackers with limited privileges to access clipboard data without proper authorization. The vulnerability has a medium severity rating with a CVSS score of 4.8. No official patch or remediation guidance has been provided yet. There are no known exploits in the wild at this time.
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the destination hostname. Because no screen in the invitation or onboarding flow shows the parsed server URL before onboarding commits to it, a victim has no way to distinguish a legitimate invite from a malicious one. An attacker can craft an invite so that a single tap on the legitimate-looking "Connect to my Home Assistant server" button opens their /auth/authorize endpoint in the URL-less onboarding WebView, presenting a look-alike login page that captures the victim's credentials. Since invitations are intended to onboard brand-new users, targets are especially unlikely to notice the substitution. This issue is fixed in version 2026.6.1.
Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticated user to conduct an escalation of privilege via network access.
A flaw exists in FlashArray Purity where insufficient filtering of certain data paths could expose sensitive information to an authenticated user with low privileges.
CVE-2026-35394 is a high-severity vulnerability in the mobile-next mobile-mcp product prior to version 0.0.50. The mobile_open_url tool improperly authorizes user-supplied URLs by passing them directly to Android's intent system without validating the URL scheme. This allows attackers to execute arbitrary Android intents, potentially triggering USSD codes, phone calls, SMS messages, or accessing content providers. The vulnerability is fixed in version 0.0.50.
CVE-2026-33335 is a medium-severity vulnerability in the Vikunja Desktop Electron wrapper versions from 0.21.0 up to but not including 2.2.0. The issue arises because URLs passed to window.open() are forwarded directly to shell.openExternal() without validation or protocol allowlisting. This allows an attacker who can embed links with target="_blank" or trigger window.open in user-generated content to cause the victim's OS to open arbitrary URI schemes.