CVE-2026-107857

Publié : 9 octobre 2026

Modifié : 9 octobre 2026

Score CVSS

4.4

MEDIUM

Description détaillée

Mindwtr is a free offline-first task management application for desktop and mobile. Prior to 1.1.5, the mobile application writes the Cloud sync bearer token and WebDAV password to unencrypted AsyncStorage under @mindwtr_cloud_token and @mindwtr_webdav_password. A party with access to the application database or an exposed device backup can recover these credentials and use them to access the user's synchronized tasks and attachments. This issue is fixed in version 1.1.5.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Références et Patchs

https://github.com/dongdongbh/Mindwtr/commit/b30f568aab753c13d11943452b32f5520712aedb https://github.com/dongdongbh/Mindwtr/releases/tag/v1.1.5 https://github.com/dongdongbh/Mindwtr/security/advisories/GHSA-8x25-76x5-jgmr

Dernières Vulnérabilités

CVE-2026-22061

Trident versions v25.02.1 through v26.06.1 are susceptible to a vulnerability that could allow an authenticated attacker with access to debug logs to view LUKS passphrases or SMB Active Directory credentials.

VOIR DÉTAILS

CVE-2026-18524

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

VOIR DÉTAILS

CVE-2026-16681

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

VOIR DÉTAILS