← Vulnerability Intelligence

CVE-2026-107056

Not yet rated

Not yet rated — under the NVD policy in effect since April 2026, most CVEs are no longer analyzed immediately. The EPSS score (if available) is still shown.

Description

Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject crafted tracking data into the victim's location database via a crafted SEND message.

Metrics

EPSS — exploit probability
0% (percentile: 5) as of 2 November 2026

References