🕵️ RESEARCH & DEEP DIVES
- OnePlus 15 OxygenOS flaws let zero-permission apps gain root access Two OxygenOS flaws could let zero-permission Android apps execute code as root on OnePlus devices.
- Affects OnePlus devices including the OnePlus 15 running the latest OxygenOS build; OnePlus says the vulnerable components may be shared across all OPPO terminal products.
- Two flaws in privileged OxygenOS services exposed to installed apps could allow attacker-controlled code execution as root.
- A malicious app with no Android permissions could send crafted requests to services lacking caller identity checks, signature-level permissions, or input validation.
- Root access would let an attacker access protected data, modify security settings, install persistent components, and disable security tools.
- Researcher Rasmus Moorats disclosed the findings; OnePlus confirmed and scheduled remediation but asked that technical details not be published. 📎 Coverage: cryptika.com · 👁 via cryptika.com (discovered)
🔓 CVEs & KEV
CVE-2026-97064 — yzcheng90 X-SpringBoot — CVSS 9.3 — X-SpringBoot Hardcoded Master Code Enables Unauthenticated User Impersonation
CVE-2026-91765 — PHP Group PHP — CVSS 7.5 — SOAP: Unbounded Recursion in Server-Side cleanup_xml_nodecleanup_xml_node() i...
CVE-2026-100377 — Wikimedia Foundation Mediawiki - WikiLambda Extension — CVSS 6.9 — Revision-deleted pages can be viewed through WikiLambda's action=edit and Spe...
CVE-2026-91767 — PHP Group PHP — CVSS 6.5 — Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server c...
CVE-2025-14181 — PHP Group PHP — CVSS 6.5 — Integer overflow to buffer overflow in soap HTTP parsingThe SOAP HTTP client ...