https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-13T07:14:25.415765+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-32710 EUVD-2026-32710 2026-10-13T07:14:25.460181+00:00 EUVD-2026-32710 https://cve.radiocsirt.org/vuln/fkie_cve-2021-43849 fkie_cve-2021-43849 2026-10-13T07:14:25.460211+00:00

cordova-plugin-fingerprint-aio is a plugin provides a single and simple interface for accessing fingerprint APIs on both Android 6+ and iOS. In versions prior to 5.0.1 The exported activity `de.niklasmerz.cordova.biometric.BiometricActivity` can cause the app to crash. This vulnerability occurred because the activity didn't handle the case where it is requested with invalid or empty data which results in a crash. Any third party app can constantly call this activity with no permission. A 3rd party app/attacker using event listener can continually stop the app from working and make the victim unable to open it. Version 5.0.1 of the cordova-plugin-fingerprint-aio doesn't export the activity anymore and is no longer vulnerable. If you want to fix older versions change the attribute android:exported in plugin.xml to false. Please upgrade to version 5.0.1 as soon as possible.

 https://cve.radiocsirt.org/vuln/ghsa-7vfx-hfvm-rhr8 GHSA-7vfx-hfvm-rhr8 — cordova-plugin-fingerprint-aio DoS vulnerability 2026-10-13T07:14:25.460246+00:00

Affected: npm: cordova-plugin-fingerprint-aio

## Summary:

Sending a specially crafted intent with an invalid/empty extras `de.niklasmerz.cordova.biometric.BiometricActivity` can cause the app to crash. sending the intent repeatedly can prevent the app using this plugin from working, resulting in a denial of service (DoS) condition.

## Impact

A 3rd party app/remote attacker can exploit this vulnerability by sending a malicious intent to the target device, causing the app using this plugin from working to crash or become unresponsive, resulting in a denial of service (DoS) condition.

## Mitigation

Version 5.0.1 of the cordova-plugin-fingerprint-aio doesn't export the activity anymore and is no longer vulnerable.

If you want to fix older versions change the attribute `android:exported` of this code snippet in plugin.xml to `false`:

```xml <config-file target="AndroidManifest.xml" parent="application"> <activity android:name="de.niklasmerz.cordova.biometric.BiometricActivity" android:theme="@style/TransparentTheme" android:exported="false"/> </config-file> ```

## Patches

Please upgrade to version 5.0.1 as soon as possible.

Please check out the release on [GitHub](https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio/releases/tag/v5.0.1).

## For more information If you have any questions or comments about this advisory please go to the discussion on [GitHub](https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio/discussions/394).

 https://cve.radiocsirt.org/vuln/gsd-2021-43849 gsd-2021-43849 2026-10-13T07:14:25.460287+00:00 gsd-2021-43849