CVE-2026-105793

Published 6 October 2026 · tracked since 7 October 2026

Description

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the press_key tool in ufo/client/mcp/http_servers/mobile_mcp_server.py accepts a free-form key_code parameter and passes it to `adb shell input keyevent`. The adb client joins the argum

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-106241 CRITICAL 9.6
• CVE-2026-106233 HIGH 8.3
• CVE-2026-106234 CRITICAL 9.6
• CVE-2026-106235 HIGH 8.8
• CVE-2026-106238 HIGH 8.3
• CVE-2026-106239 CRITICAL 9.6
• CVE-2026-106240 HIGH 8.8
• CVE-2026-106225 HIGH 8.8
• CVE-2026-106227 CRITICAL 9.6
• CVE-2026-106228 HIGH 8.3

→ Open the live CVE board · all tools