By weakness (CWE)

CWE-693: related vulnerabilities

CVEs classified under CWE-693. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

10 published vulnerabilities

• CVE-2026-0097HIGH 8.0

  A logic error in Android's Bluetooth Low Energy (LE) pairing mechanism allows an attacker within wireless range to pair a device without requiring user approval or interaction. An attacker with local access to a Bluetooth-enabled Android device can escalate privileges by circumventing the normal pairing consent flow, potentially gaining full read, write, and execution access on the target device. This is particularly dangerous because it requires no user action to exploit.

• CVE-2025-48649HIGH 7.8

  CVE-2025-48649 is a local privilege escalation vulnerability affecting Google Android in which an attacker with limited user privileges can reset user-selected permission settings, effectively bypassing the permissions model that Android uses to protect sensitive device capabilities. Because no additional privileges are needed and user interaction is not required, any application with basic local access can trigger this issue to gain unauthorized access to protected device functions—a significant departure from Android's intended permission architecture.

• CVE-2025-48652HIGH 7.8

  A logic flaw in Android's application installation validation code allows a local attacker to bypass Mobile Device Management (MDM) security policies. An attacker with local access to the device can exploit this vulnerability to gain elevated privileges without requiring additional permissions or user interaction. MDM policies are a key security control for organizations managing corporate Android devices, making this bypass a significant concern for enterprise environments.

• CVE-2026-0045HIGH 7.8

  A logic error in Android's Bluetooth RFCOMM connection handling allows a local attacker to bypass the bonding requirement for secure connections. An attacker with local access can escalate privileges without needing special permissions or user interaction, potentially gaining full control over sensitive device functions protected by Bluetooth pairing.

• CVE-2026-0077HIGH 7.8

  CVE-2026-0077 is a privilege escalation vulnerability in Android's ActivityRecord component that allows a local attacker with limited user privileges to launch background applications and gain elevated system access. The flaw stems from a logic error in the resumeConfigurationDispatch function that fails to properly validate or constrain application launch permissions. No special privileges or user interaction are required for exploitation, making this a straightforward attack vector for any app running on an affected device.

• CVE-2026-0087HIGH 7.8

  A logic error in Android's domain verification service allows a local attacker to hijack app links associated with arbitrary applications. By exploiting this flaw, an attacker can redirect app links to malicious apps, potentially intercepting sensitive user actions or data. The vulnerability requires local access but no special permissions or user interaction, making it a meaningful escalation path on compromised or personally-owned devices.

• CVE-2026-10944MEDIUM 6.5

  A flaw in Google Chrome's autofill feature on iOS could allow an attacker to trick a user into visiting a malicious webpage that extracts sensitive information you've saved in your browser—such as payment details, addresses, or credentials—from other websites you use. The vulnerability requires user interaction (visiting the malicious page) but does not require special system permissions or unusual browser configurations to exploit.

• CVE-2026-10950MEDIUM 6.5

  Google Chrome on iOS has a flaw in how it enforces security policies for the autofill feature. An attacker can trick a user into visiting a specially crafted webpage that leaks sensitive data from other websites the user has visited or logged into. The vulnerability requires user interaction (clicking or visiting a malicious link) but doesn't require any special browser configuration or authentication bypass. It affects Chrome versions before 149.0.7827.53 on iOS devices.

• CVE-2026-10174MEDIUM 6.3

  Aider-AI's Aider version 0.86.3 contains a flaw in how it processes pre-commit hook arguments. An attacker with valid credentials can manipulate the git-commit-verify argument to bypass security protections that normally prevent unauthorized code commits. The vulnerability requires network access and prior authentication, making it a concern primarily for development teams using Aider in shared or untrusted environments. Public exploit code exists, increasing the practical risk.

• CVE-2025-52609LOW 3.7

  HCL iControl is missing HTTP security headers that would instruct modern web browsers to block cross-site scripting (XSS) attacks. Without these headers—such as Content-Security-Policy or X-XSS-Protection—the application relies on older browser XSS filters that are inconsistently implemented and increasingly deprecated. An attacker could craft malicious input that, when processed by iControl, gets reflected in responses without proper sanitization, potentially allowing script execution in users' browsers.