Unscored severity · published Oct 29, 2026
CVE-2026-107021
Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbitrarily read flashcards across…
New
–
CVSS
–
EPSS
No
On KEV
Description
Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbitrarily read flashcards across the user's entire memorization database.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-107021
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-107021
f-droid.org
https://f-droid.org/packages/org.liberty.android.fantastischmemo/
github.com
https://github.com/helloworld1/AnyMemo
github.com
https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107021.md