Skip to content
Noroxi

CWE-939 · 25 records

Improper Authorization in Handler for Custom URL Scheme

CVEs in this class

25 records

  • CVE-2026-53407
    39Monitor

    Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allo

    CriticalCVSS 9.8No exploitEPSS 0%

    zoom · workplaceJun 12, 2026

  • CVE-2023-43582
    35Monitor

    Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via network access.

    HighCVSS 8.8No exploitEPSS 0%

    zoom · meetingsNov 14, 2023

  • CVE-2026-35394
    35Monitor

    Mobile Next has Arbitrary Android Intent Execution via mobile_open_url

    HighCVSS 8.8No exploitEPSS 0%

    mobilenexthq · mobile mcpApr 6, 2026

  • CVE-2024-33606
    34Monitor

    MicroDicom DICOM Viewer Improper Authorization in Handler for Custom URL Scheme

    HighCVSS 8.6No exploitEPSS 0%

    microdicom · dicom viewerJun 11, 2024

  • CVE-2026-6445
    34Monitor

    A flaw exists in FlashArray Purity where insufficient filtering of certain data paths could expose sensitive information to an authenticated

    HighCVSS 8.7No exploitEPSS 0%

    everpure · flasharrayJun 9, 2026

  • CVE-2026-53408
    32Monitor

    Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allo

    HighCVSS 8.1No exploitEPSS 0%

    zoom · meeting software development kitJun 12, 2026

  • CVE-2026-53418
    32Monitor

    Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user

    HighCVSS 8.1No exploitEPSS 0%

    zoom communications · zoom workplace3 days ago

  • CVE-2020-11000
    26Monitor

    Improper URL validation in GreenBrowser

    MediumCVSS 6.5No exploitEPSS 1%

    greenbrowser project · greenbrowserApr 8, 2020

  • CVE-2026-3471
    26Monitor

    Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop App

    MediumCVSS 6.5No exploitEPSS 0%

    mattermost · mattermost desktopMay 18, 2026

  • CVE-2026-1046
    26Monitor

    Arbitrary application execution via unvalidated server-controlled URLs in Help menu

    MediumCVSS 6.5No exploitEPSS 0%

    mattermost · mattermost desktopFeb 16, 2026

  • CVE-2026-33335
    25Monitor

    Vikunja Desktop allows arbitrary local application invocation via unvalidated shell.openExternal

    MediumCVSS 6.4No exploitEPSS 0%

    vikunja · vikunjaMar 24, 2026

  • CVE-2026-26123
    22Monitor

    Microsoft Authenticator Information Disclosure Vulnerability

    MediumCVSS 5.5No exploitEPSS 0%

    microsoft · authenticatorMar 10, 2026

  • CVE-2022-20736
    21Monitor

    Cisco AppDynamics Controller Authorization Bypass Vulnerability

    MediumCVSS 5.3No exploitEPSS 1%

    cisco · appdynamics controllerJun 15, 2022

  • CVE-2026-21075
    21Monitor

    Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive inform

    MediumCVSS 5.3No exploitEPSS 0%

    samsung mobile · my galaxyAug 10, 2026

  • CVE-2025-41408
    21Monitor

    Improper authorization in handler for custom URL scheme issue in "Yahoo! Shopping" App for Android versions prior to 14.15.0 allows a remote

    MediumCVSS 5.3No exploitEPSS 0%

    ly corporation · "yahoo! shopping" app for androidSep 5, 2025

  • CVE-2026-96614
    20Monitor

    "ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme.

    MediumCVSS 5.1No exploitEPSS 0%

    geo corporation · "ゲオアプリ" for android2 days ago

  • CVE-2026-21062
    19Monitor

    Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local attackers to access clipboard data.

    MediumCVSS 4.8No exploitEPSS 0%

    samsung · androidAug 10, 2026

  • CVE-2026-73335
    18Monitor

    Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939).

    MediumCVSS 4.6No exploitEPSS 0%

    digital agency · android app "myna point"Aug 26, 2026

  • CVE-2026-92862
    18Monitor

    The Android application "Ticket Ryutsu Center" improperly handles custom URL schemes, allowing a malicious application to cause access to an

    MediumCVSS 4.6No exploitEPSS 0%

    wavedash co., ltd. · ticket ryutsu centerOct 8, 2026

  • CVE-2024-45203
    17Monitor

    Improper authorization in handler for custom URL scheme issue in "@cosme" App for Android versions prior 5.69.0 and "@cosme" App for iOS ver

    MediumCVSS 4.3No exploitEPSS 0%

    istyle · \@cosmeSep 9, 2024

  • CVE-2024-35298
    17Monitor

    Improper authorization in handler for custom URL scheme issue in 'ZOZOTOWN' App for Android versions prior to 7.39.6 allows an attacker to l

    MediumCVSS 4.3No exploitEPSS 0%

    zozo, inc. · 'zozotown' app for androidJun 19, 2024

  • CVE-2025-5020
    17Monitor

    Links using non-HTTP schemes opened from other apps such as Safari could have allowed spoofing of website addresses

    MediumCVSS 4.3No exploitEPSS 0%

    mozilla · firefoxMay 21, 2025

  • CVE-2024-54014
    14Monitor

    Improper authorization in handler for custom URL scheme issue in 'Skylark' App for Android 6.2.13 and earlier and 'Skylark' App for iOS 6.2.

    LowCVSS 3.6No exploitEPSS 0%

    skylark holdings co., ltd. · 'skylark' app for androidDec 4, 2024

  • CVE-2024-54125
    13Monitor

    Improper authorization in handler for custom URL scheme issue in "Shonen Jump+" App for Android versions prior to 4.0.0 allows an attacker t

    LowCVSS 3.3No exploitEPSS 0%

    shueisha inc. · "shonen jump+" app for androidDec 17, 2024

  • CVE-2025-67739
    12Monitor

    In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure

    LowCVSS 3.1No exploitEPSS 0%

    jetbrains · teamcityDec 11, 2025

All vulnerability classes