CVE-2026-107052

HighCVSS 7.5/10Last modified Oct 30, 2026

Description

Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attackers to arbitrarily reead files outside of the sandbox via providing an absolute path.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

Timeline

Published: Oct 29, 2026
Last modified: Oct 30, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1070539.1Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write and truncate files in CVE-2026-1070557.5Insecure permissions in the autosave component of AppML neutriNote CE versionCode 1387 allows unauthorized attackers to write arbitrary file CVE-2026-1070569.1Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject CVE-2026-1070579.8An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip.CVE-2026-1070589.8An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service CVE-2026-1070597.5An issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switch to an attacker cont CVE-2026-107067.5In Adalo’s no-code app builder, (Versions 1 and 2) the attackers may extract full user records and correlate user behavior across multiple a CVE-2026-1070609.1Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN config CVE-2026-1070676.2An issue in Shirt Pocket's SuperDuper! 4.0.9 and earlier allow a local attacker to obtain sensitive information CVE-2026-1070794.3An issue in Systrome Validation & Certification 1.0 allows an attacker to cause a denial of service via the t URL parameter in the qrcode_au CVE-2026-107087.5This vulnerability enables large‑scale data harvesting without requiring app‑specific secrets. A single request to a minimal leaderboard com CVE-2026-1070806.5OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dwt_encode_and_deinter