OPPO

Latest CVEs · RSS

• CVE-2026-22072 2026-08-17 · CVSS 8.3
  Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens.
• CVE-2026-22078 2026-06-29 · CVSS 7.3
  Because O+ Connect's IPC service does not authenticate clients, external applications can escalate privileges and perform sensitive actions through the IPC chan
• CVE-2026-22070 2026-04-30 · CVSS 7.1
  ColorOS Assistant has an unauthenticated start-download channel, leading to file path traversal.
• CVE-2026-22077 2026-04-27 · CVSS 5.6
  OPPO Wallet APP contains a trusted domain validation flaw that allows attackers to bypass protected interface access restrictions, which may lead to account tok
• CVE-2025-27389 2025-12-05 · CVSS 5.1
  A flaw exists in the verification of application installation sources within ColorOS. Under specific conditions, this issue may cause the risk detection mechani
• CVE-2025-27388 2025-08-14 · CVSS 8.3
  Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens.
• CVE-2025-27387 2025-06-23 · CVSS 7.4
  OPPO Clone Phone uses a weak password WiFi hotspot to transfer files, resulting in Information disclosure.
• CVE-2024-1609 2024-12-25 · CVSS 8.7
  In OPPOStore iOS App, there's a possible escalation of privilege due to improper input validation.
• CVE-2024-1610 2024-12-18 · CVSS 8.7
  In OPPO Store APP, there's a possible escalation of privilege due to improper input validation.
• CVE-2024-1608 2024-02-20 · CVSS 9.1
  In OPPO Usercenter Credit SDK, there's a possible escalation of privilege due to loose permission check, This could lead to application internal information lea
• CVE-2023-26311 2023-08-10 · CVSS 7.4
  A remote code execution vulnerability in the webview component of OPPO Store app.
• CVE-2023-26309 2023-08-10 · CVSS 7.4
  A remote code execution vulnerability in the webview component of OnePlus Store app.
• CVE-2023-26310 2023-08-09 · CVSS 7.4
  There is a command injection problem in the old version of the mobile phone backup app.
• CVE-2021-23247 2022-04-01
  A command injection vulerability found in quick game engine allows arbitrary remote code in quick app. Allows remote attacke0rs to gain arbitrary code execution
• CVE-2021-23246 2022-03-11
  In ACE2 ColorOS11, the attacker can obtain the foreground package name through permission promotion, resulting in user information disclosure.
• CVE-2021-23244 2021-12-27
  ColorOS pregrant dangerous permissions to apps which are listed in a whitelist xml named default-grant-permissions.But some apps in whitelist is not installed,
• CVE-2021-23243 2021-09-27
  In Oppo's battery application, the third-party SDK provides the function of loading a third-party Provider, which can be used.
• CVE-2020-11836 2021-02-05
  OPPO Android Phone with MTK chipset and Android 8.1/9/10/11 versions have an information leak vulnerability. The “adb shell getprop ro.vendor.aee.enforcing” or
• CVE-2020-11835 2020-12-31
  In /SM8250_Q_Master/android/vendor/oppo_charger/oppo/charger_ic/oppo_da9313.c, failure to check the parameter buf in the function proc_work_mode_write in proc_w
• CVE-2020-11834 2020-12-31
  In /SM8250_Q_Master/android/vendor/oppo_charger/oppo/oppo_vooc.c, the function proc_fastchg_fw_update_write in proc_fastchg_fw_update_write does not check the p
• CVE-2020-11833 2020-12-31
  In /SM8250_Q_Master/android/vendor/oppo_charger/oppo/charger_ic/oppo_mp2650.c, the function mp2650_data_log_write in mp2650_data_log_write does not check the pa
• CVE-2020-11832 2020-12-31
  In functions charging_limit_current_write and charging_limit_time_write in /SM8250_Q_Master/android/vendor/oppo_charger/oppo/oppo_charger.c have not checked the
• CVE-2020-11831 2020-11-19
  OvoiceManager has system permission to write vulnerability reports for arbitrary files, affected product is com.oppo.ovoicemanager V2.0.1.
• CVE-2020-11830 2020-11-19
  QualityProtect has a vulnerability to execute arbitrary system commands, affected product is com.oppo.qualityprotect V2.0.
• CVE-2020-11829 2020-11-19
  Dynamic loading of services in the backup and restore SDK leads to elevated privileges, affected product is com.coloros.codebook V2.0.0_5493e40_200722.