The mobile vulnerabilities we've found — in the apps you've heard of
Every CVE listed here has been discovered and responsibly disclosed by Oversecured. They show our ongoing work to find real security issues and help make mobile apps safer. Every entry is verifiable in the National Vulnerability Database.
186
CVEs disclosed
165
Brands rewarded us
9
Vendor CVE programs
9
Android ecosystems
186 CVEs.
Every one public in NVD.
Each link below resolves to the National Vulnerability Database. Click any CVE to independently verify the disclosure, severity score, and affected vendor. We don't ask you to trust us — we ask you to check.
For media / press:
These CVEs were discovered by Oversecured's mobile-specific taint analysis engine, running autonomously against production Android applications. Every entry is independently verifiable in the National Vulnerability Database.
Behind our security research
Inspired by the best transparency practices in security research, we share our scope openly, document our process, and welcome feedback
What a CVE means
Each CVE listed was:
Discovered by Oversecured's mobile-specific engine
Reported to the affected vendor through their disclosure process
Accepted, patched, and assigned a CVE ID by the vendor or MITRE
Publicly available in the NVD after coordinated disclosure.
What a bug bounty brand means
Each company listed:
Operated a bug bounty program that accepted mobile app reports
Accepted a vulnerability report submitted by Oversecured
Validated the finding as real and actionable
Paid a monetary reward for the disclosure
What this page doesn't include
The scope of the research:
Private findings disclosed under NDA are not counted here
Customer scans performed on behalf of our enterprise customers are not included
Duplicate or informational bounty reports are not counted
We don't claim CVE discovery for bugs found by other researchers
How we update this page
This is how our team reviews this page:
New CVEs added within one week of public NVD availability
New bug bounty brands added as vendors permit disclosure
The page is versioned in git — historic counts are reproducible
Press inquiries: press@oversecured.com
Every one of these bugs was found by an automated scanner, not by a human pentester
If Oversecured found these issues in production apps from some of the world’s biggest brands, it can find similar issues in yours.