CVE-2026-107857

Mindwtr is a free offline-first task management application for desktop and mobile. Prior to 1.1.5, the mobile application writes the Cloud sync bearer token and WebDAV password to unencrypted AsyncStorage under @mindwtr_cloud_token and @mindwtr_webdav_password. A party with access to the application database or an exposed device backup can recover these credentials and use them to access the user's synchronized tasks and attachments. This issue is fixed in version 1.1.5.

• CWE-312
• CWE-522

• https://github.com/dongdongbh/Mindwtr/commit/b30f568aab753c13d11943452b32f5520712aedb
• https://github.com/dongdongbh/Mindwtr/releases/tag/v1.1.5
• https://github.com/dongdongbh/Mindwtr/security/advisories/GHSA-8x25-76x5-jgmr

Published

Oct 9, 2026

Last Modified

Oct 9, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107848Contao is an Open Source CMS. From version 4.0.0 until 5.3.5…3.5
• CVE-2026-107850Contao is an Open Source CMS. From version 5.7.1 until 5.7.1…4.3
• CVE-2026-107851Contao is an Open Source CMS. From version 5.7.0 until 5.7.1…4.3
• CVE-2026-107852Jexactyl is a customisable game management panel and billing…7.1
• CVE-2026-107854Jexactyl is a customisable game management panel and billing…5.4
• CVE-2026-107856CiviForm simplifies applications for government benefits pro…4.5
• CVE-2026-10786Improper access control in the ticketing integration setting…6.5
• CVE-2026-10787Missing authorization in the deleted user groups API in Devo…4.3
• CVE-2026-107885OpenPrinting CUPS through 2.4.20 contains a resource-exhaust…3.3
• CVE-2026-107886OpenPrinting CUPS before 2.4.20 contains a double-free in pr…2.3
• CVE-2026-107888OpenPrinting CUPS before 2.4.20 contains a NULL pointer dere…5.1
• CVE-2026-107889A flaw was found in the login theme rendering component of K…5.5