Android Help Center
Android Help Center
2026-10-02 归档
今日共收录 1399 条安全情报，包含 504 个 CVE，518 篇安全通告，以及 100 篇研究论文。
← 返回归档列表www.android.com
www.android.com
Google Mobile Services
Google Mobile Services
Firewall for AI
Firewall for AI
Kiteworks patches max severity code injection vulnerability
Secure file-sharing software company Kiteworks has released security updates to address 126 vulnerabilities, including a
Google Rolls Out Gemini 4 Argon to Trusted Cyber Defenders, Plans Guardrail-Free Version
Google on Wednesday announced its latest frontier artificial intelligence (AI) model, Gemini 4 Argon, that it said is be
An API key is hardcoded and retrievable from the application package. Since Android applications...
CVE-2026-103097
An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineer
API key is hardcoded and retrievable from the application package. Since Android applications can...
CVE-2026-103096
API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered,
Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession...
CVE-2026-103764
Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allow
A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered...
CVE-2026-86345
A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection w
Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP...
CVE-2026-103765
Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata hand
langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code...
CVE-2026-51886
langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The componen
RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the LSS protocol is used to...
CVE-2026-82357
RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the LSS protocol is used to configure the device. An ob
Joyland AI app explicitly permits cleartext HTTP traffic on Android 9+ where the default is to...
CVE-2026-102670
Joyland AI app explicitly permits cleartext HTTP traffic on Android 9+ where the default is to block it.
The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG...
CVE-2026-102628
The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in
vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process
CVE-2026-92957
## Summary NodeVM normalizes `node:`-prefixed builtin specifiers during `require()` resolution, but it does not normali
vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor
CVE-2026-92949
### Summary Untrusted JavaScript running inside `new VM().run()` / `new NodeVM().run()` can bypass `vm.freeze()` / `vm.r
vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE
CVE-2026-92935
## Summary The `NodeVM` constructor computes `hasRealRequireConfig` using `typeof requireOpts === 'object' && requireOp
vm2 allows a sandboxed plugin to execute native code through `node:sqlite`
CVE-2026-92938
### Summary vm2 3.11.6 exposes Node.js's host `node:sqlite` module to `NodeVM` code when that builtin is allowed explic
vm2 crypto builtin loads attacker native code through setEngine
CVE-2026-92939
Summary vm2 3.11.6 exposes the host `crypto` module to a `NodeVM` when that single builtin is allowed. The module is pr