CVE-2026-28576

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Jun 17, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-285777.8In addWindow of WindowManagerService.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local CVE-2026-285785.5In multiple functions of DevicePolicyManagerService.java, there is a possible desync from persistence due to improper input validation. This CVE-2026-28587.1A vulnerability was identified in wren-lang wren up to 0.4.0. This affects the function peekChar of the file src/vm/wren_compiler.c of the c CVE-2026-285807.8In multiple functions, there is a possible desync in persistence due to an incorrect bounds check. This could lead to local escalation of pr CVE-2026-285814.0In fixInitiatingUserIfNecessary of CallIntentProcessor.java, there is a possible way to make an emergency call due to a logic error in the c CVE-2026-285823.3In onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unauthorized access to and modification of device credentials due t CVE-2026-285837.8In validate_camera_metadata_structure of camera_metadata.c, there is a possible out of bounds write due to a logical error in the code. This CVE-2026-285845.5In createSessionInternal of PackageInstallerService.java, there is a possible way to permanently DoS the device due to a logic error in the CVE-2026-285863.3In multiple functions of AppOpsService.java, there is a possible missing permission check due to a permissions bypass. This could lead to lo CVE-2026-285875.5In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive information due to a missing permission check. This CVE-2026-28594.3Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and 2.2.0 (EOL) allows unauthenticated use CVE-2026-285907.8In multiple locations, there is a possible improper encryption key validation due to a logic error in the code. This could lead to local esc