TL;DR A maximum-severity SQL injection flaw sits in the Android Contacts Provider. Tracked as CVE-2026-28576 with a CVSS score of 10, it lets a permission-less app read every contact. A public proof-of-concept exploit is available. Why this Android SQL injection matters Contacts hold names, phone numbers, emails, and private notes. This Android SQL injection exposes all of it. An app needs no permissions and no READ_CONTACTS grant.

Memory Corruption Vectors in Redis Streams and RedisBloom Even an applied security patch does not invariably seal a legacy vulnerability. A newly published suite of proof-of-concept demonstrations has exposed remote code execution capabilities within Redis versions 6.2.22, 7.4.9, 8.6.4, 8.8.0, and 8.8.1. Notably, portions of this code bypass previously issued remediations for CVE-2026-25243 and CVE-2026-25589, both of which carry a CVSS 3.1 severity rating of 8.8.