CVE-2026-12190

A vulnerability has been found in Genspark AI Workspace App 2.8.4 on Android. This vulnerability affects unknown code of the component ai.mainfunc.genspark. The manipulation leads to improper authorization in handler for custom url scheme. The attack can only be performed from a local environment. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-285
• CWE-939

• https://github.com/actuator/ai.mainfunc.genspark
• https://vuldb.com/cve/CVE-2026-12190
• https://vuldb.com/submit/825558
• https://vuldb.com/vuln/370836
• https://vuldb.com/vuln/370836/cti

Published

Jun 14, 2026

Last Modified

Jul 24, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12185In Bouncy Castle for Java before 1.85, BKS/UBER keystore all…7.1
• CVE-2026-12186A weakness has been identified in GL.iNet GL-MT3000 up to 4.…8.8
• CVE-2026-12187A security vulnerability has been detected in GL.iNet GL-MT3…8.8
• CVE-2026-12188A vulnerability was detected in Grit42 Grit up to 0.11.0. Af…6.3
• CVE-2026-12189A flaw has been found in Moovit Bus & Public Transit App 1.1…5.3
• CVE-2026-1219The MP3 Audio Player – Music Player, Podcast Player & Radio …5.3
• CVE-2026-12191A vulnerability was found in Comma AI Openpilot 0.11. This i…7.8
• CVE-2026-12192A vulnerability was determined in GALAYOU Y4 1.0.0. Impacted…8.8
• CVE-2026-12193A vulnerability was identified in VS Revo RevoUninstaller 2.…7.8
• CVE-2026-12194PHPIPAM is affected by an authenticated local file inclusion…2.3
• CVE-2026-12195myVesta is affected by an authenticated remote code executio…8.5
• CVE-2026-12196HestiaCP panel cronjob feature is affected by a broken acces…8.3