CVE Tools
Track your stack

Mobile Apps

23,470 CVEs tracked since 1999. In the last 12 months, 1,468, −29% on the 12 before.

Mobile Apps by subsector, Oct 2026 so far

Oct 2026 so far: 27 CVEs across 2 subsectors. Area is each subsector's share; inside are the products it counted most. Point at one to read it.
  • Android apps2074% · 7 vendors
  • Not yet sub-classified7The tagger has not placed these yet

Month by month

Every monthly snapshot of Mobile Apps. A column is the CVEs published that month.

Oct 2021 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Mobile Apps CVEs per month
MonthCVEs
2021-10236
2021-11146
2021-12309
2022-01168
2022-02231
2022-03246
2022-04174
2022-05202
2022-06173
2022-07239
2022-08263
2022-09333
2022-10165
2022-11259
2022-12368
2023-01122
2023-02222
2023-030
2023-04126
2023-05272
2023-06297
2023-07275
2023-08232
2023-09319
2023-10286
2023-11138
2023-12306
2024-01186
2024-02141
2024-03202
2024-04138
2024-05151
2024-06177
2024-07214
2024-08114
2024-09209
2024-10179
2024-11190
2024-12202
2025-01252
2025-0287
2025-03237
2025-0492
2025-05157
2025-0670
2025-07172
2025-08129
2025-09314
2025-1073
2025-11235
2025-12244
2026-01100
2026-02152
2026-03319
2026-04225
2026-0521
2026-0624
2026-0710
2026-0819
2026-0946
2026-1027

Vendors

Who shipped the most Mobile Apps CVEs in Oct 2026 so far, with their rank across all vendors.

  1. Google699#4
  2. Apple47#26

Weaknesses

The weakness classes behind Mobile Apps CVEs in Oct 2026 so far.

  1. CWE-862 Missing Authorization4
  2. CWE-306 Missing Auth for Critical Function4
  3. CWE-863 Incorrect Authorization2
  4. CWE-22 Path Traversal2
  5. CWE-79 XSS2
  6. CWE-200 Information Exposure1

Latest CVEs

The 15 most recently published vulnerabilities in Mobile Apps.

  1. CVE-2026-115522Cross-Application Artifact Namespace Isolation in Google Agent Development Kit (ADK) for Python—
  2. CVE-2026-116116Yoosee GM8135S Camera Secure Boot signature verification8.2
  3. CVE-2026-116115Yoosee GM8135S Camera WiFi Configuration wpa_supplicantX.conf initialization3.1
  4. CVE-2026-116114Yoosee GM8135S Camera Live UDP H.264 Video Stream npc cleartext transmission3.7
  5. CVE-2026-107858Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development Server—
  6. CVE-2026-111497Out-of-Bounds Write in Google Brotli Decoder9.8
  7. CVE-2026-103090Unauthenticated Biscuit Credential Disclosure via GET /enroll/status in Google OSS Agent Mesh (SAM)—
  8. CVE-2026-105772Arbitrary file read and write in Google ADK TypeScript (@google/adk) FileArtifactService via path traversal in userId and sessionId—
  9. CVE-2026-113612SparkyFitness before 0.17.0 Missing Authorization via food-variants DELETE Endpoint5.4
  10. CVE-2026-103091Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)—
  11. CVE-2026-102503Missing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM)—
  12. CVE-2026-111601Hippoo Mobile App for WooCommerce <= 1.12.0 - Reflected Cross-Site Scripting via 'token_id' Parameter6.1
  13. CVE-2026-102923SparkyFitness: SSRF via unvalidated custom_url in AI service settings5.4
  14. CVE-2026-92263SparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/restore7.2
  15. CVE-2026-96425Incorrect Permission Assignment for Critical Resource in lomiri-download-manager5.5

The record

Busiest month
Dec 2022, 368 CVEs
Oct 2026 so far
27 CVEs from 10 vendors
Deployment
On-prem, 100%
Monthly snapshots
283 since 1999
All 15 sectors on one map

Is your business exposed to threats like these?

Discuss a security assessment of your internet-facing systems. Scope, price and timing agreed before testing.

Request an assessment