Vulnerabilities

TI-2026-75362 CVE-2026-96425 · GHSA-xrrp-gpj2-96j9

Incorrect DBus policy in lomiri-download-manager allows root access

LOW 24

Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00105 Published 2026-10-16 Fixed in 0.3.3 CWE-732

TI-2026-75361 CVE-2026-96424 · GHSA-cw8r-ph9g-gwmc

Incorrect Permission Assignment for Critical Resource in lomiri-download-manager

LOW 35

Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows arbitrary user to read arbitrary file as root over DBus

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00106 Published 2026-10-16 Fixed in 0.3.3 CWE-732

TI-2022-19135 CVE-2022-40297 · GHSA-qjwx-hqg3-vv75

UBports Ubuntu Touch 16.04 allows the screen-unlock passcode to be used for a privileged…

HIGH 67

UBports Ubuntu Touch 16.04 allows the screen-unlock passcode to be used for a privileged shell via Sudo.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.0047 Published 2022-09-08 No fix listed CWE-269

TI-2014-01101 CVE-2014-1423 · GHSA-393q-7g3p-mp9v

Online Accounts Signon daemon gives out all oauth tokens to any app

LOW 28

signond before 8.57+15.04.20141127.1-0ubuntu1, as used in Ubuntu Touch, did not properly restrict applications from querying oath tokens due to incorrect checks and the missing installation of the signon-apparmor-extensi…

CVSS 3.1MEDIUM 5.9 Local Low privileges User interaction EPSS 0.00844 Published 2020-05-07 Fixed in 8.57+15.04.20141127.1-0ubuntu1 CWE-522

TI-2015-06612 CVE-2015-7946 · GHSA-8x99-rqcq-6fvg

MTP service exposed during emergency dialer

LOW 32

Information Exposure vulnerability in Unity8 as used on the Ubuntu phone and possibly also in Unity8 shipped elsewhere.

CVSS 3.1HIGH 7.3 Physical No auth No interaction EPSS 0.00366 Published 2020-05-07 Fixed in 8.11+16.04.20160111.1-0ubuntu1 CWE-200

TI-2016-01434 CVE-2016-1573 · GHSA-x98q-xccc-62q7

Using a specially crafted fallback art property, scopes can execute arbitrary QML code in context of unity8-dash

LOW 34

Versions of Unity8 before 8.11+16.04.20160122-0ubuntu1 file plugins/Dash/CardCreator.js will execute any code found in place of a fallback image supplied by a scope.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00425 Published 2019-04-22 Fixed in 8.11+16.04.20160122-0ubuntu1 CWE-416