Unscored severity · published Oct 29, 2026
CVE-2026-107028
Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows unauthorized attackers to invoke an exported component, leading to manipulation of the shopping-list…
New
–
CVSS
–
EPSS
No
On KEV
Description
Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows unauthorized attackers to invoke an exported component, leading to manipulation of the shopping-list data.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-107028
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-107028
f-droid.org
https://f-droid.org/packages/com.wbpxre150.shoppinglist/
github.com
https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107028.md
github.com
https://github.com/wbpxre150/android-shoppinglist