First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-107021

CriticalCVSS 9.1/10Last modified Nov 3, 2026

Description

Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbitrarily read flashcards across the user's entire memorization database.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

Timeline

Published: Oct 29, 2026
Last modified: Nov 3, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1070236.5Insecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 allows unauthorized attackers to arbitrarily read another user CVE-2026-1070247.5Insecure permissions in Share 2 Archive Today versionCode 61 allows unauthorized attackers to arbitrarily overwrite another user's clipboard CVE-2026-1070257.5Insecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) allows unauthorized attackers to export the application's dat CVE-2026-1070267.5Insecure permissions in Share to Clipboard v1.14.1 (versionCode 32) allows unauthorized attackers to arbitrarily overwrite another user's cl CVE-2026-1070279.1Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading CVE-2026-1070289.1Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows unauthorized attackers to invoke an exported component, leadin CVE-2026-1070299.1Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading to arbitrary data acce CVE-2026-107036.3A security vulnerability has been detected in EIPStackGroup OpENer up to 2.3.0. Affected is the function CreateMessageRouterRequestStructure CVE-2026-1070307.5Insecure permissions in craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) allows unauthorized attackers to trigger the OTP-clipboard (O CVE-2026-1070329.1Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, l CVE-2026-1070336.5Insecure permissions in the MirakelInternalContentProvider component of Mirakel v3.0 (versionCode 60) allows unauthorized attackers to arbit CVE-2026-1070349.1Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauthorized attackers to arbitrarily read another user's note dat

CVE-2026-107021: Critical severity, CVSS 9.1 | Vulnix