CVE-2026-0015
published 2026-03-02CVE-2026-0015: In multiple locations of AppOpsService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial…
PriorityP424medium6.2CVSS 3.1
AVLACLPRNUINSUCNINAH
EPSS
0.10%
0.7th percentile
In multiple locations of AppOpsService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| platform | frameworks_base | >= 14:0 < 14:2026-03-01 | 14:2026-03-01 |
| platform | frameworks_base | >= 15:0 < 15:2026-03-01 | 15:2026-03-01 |
| platform | frameworks_base | >= 16-qpr2-next:0 < 16-qpr2-next:2026-03-01 | 16-qpr2-next:2026-03-01 |
| platform | frameworks_base | >= 16-qpr2:0 < 16-qpr2:2026-03-01 | 16-qpr2:2026-03-01 |
| platform | frameworks_base | >= 16:0 < 16:2026-03-01 | 16:2026-03-01 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-fgf9-qpxp-j8pf: In multiple locations of AppOpsService
ghsa_unreviewed·2026-03-02
CVE-2026-0015 [MEDIUM] CWE-20 GHSA-fgf9-qpxp-j8pf: In multiple locations of AppOpsService
In multiple locations of AppOpsService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
OSV
CVE-2026-0015: In multiple locations of AppOpsService
osv·2026-03-01
CVE-2026-0015 CVE-2026-0015: In multiple locations of AppOpsService
In multiple locations of AppOpsService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-0015 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.2
CVE-2026-0015 [MEDIUM] CVE-2026-0015 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-0015 :
NixOS vulnerability analysis and mitigation
In multiple locations of AppOpsService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Source : NVD
## 6.2
Score
Published March 2, 2026
Severity MEDIUM
CNA Score 6.2
Affected Technologies
NixOS
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 0.1
Exploitation Probability (EPSS) N/A
Affected packages and libraries
android
Sources
NVD
Nix Severity MEDIUM No Fix Added at: Mar 04, 2026
## Get a CVE risk assessment
Get a prioritized view of
Bugzilla
CVE-2026-58334 moodle: RCE risk via admin presets import [fedora-all]
bugzilla·2026-07-28
CVE-2026-58334 [MEDIUM] CVE-2026-58334 moodle: RCE risk via admin presets import [fedora-all]
CVE-2026-58334 moodle: RCE risk via admin presets import [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
MSA-26-0015: RCE risk via admin presets import
Description: A remote code execution risk was identified in the admin
presets import feature. Note: This feature is only
available to site administrators.
Issue summary: RCE risk via admin presets import
Severity/Risk: Serious
Versions affected: 5.2, 5.1 to 5.1.4, 5.0 to 5.0.7, 4.5 to 4.5.11 and earlier
unsupported versions
Versions fixed: 5.2.1, 5.1.5, 5.0.8 and 4.5.12
Reported by: LoWeST
Issue no.: MDL-88735
Bugzilla
CVE-2026-58334 moodle: RCE risk via admin presets import
bugzilla·2026-06-30
CVE-2026-58334 [MEDIUM] CVE-2026-58334 moodle: RCE risk via admin presets import
CVE-2026-58334 moodle: RCE risk via admin presets import
MSA-26-0015: RCE risk via admin presets import
Description: A remote code execution risk was identified in the admin
presets import feature. Note: This feature is only
available to site administrators.
Issue summary: RCE risk via admin presets import
Severity/Risk: Serious
Versions affected: 5.2, 5.1 to 5.1.4, 5.0 to 5.0.7, 4.5 to 4.5.11 and earlier
unsupported versions
Versions fixed: 5.2.1, 5.1.5, 5.0.8 and 4.5.12
Reported by: LoWeST
Issue no.: MDL-88735
2026-03-02
Published