# mobsf (PyPI) vulnerabilities Source: https://junglewise.ai/threats/technologies/mobsf Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/mobsf.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 22 vulnerabilities in mobsf (PyPI): 0 in the last 7 days and 4 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-68922, was published on 18 August 2026. Nothing was published in the last eight weeks. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 4 - All time: 22 (0 critical, 0 exploited in the wild) ## About mobsf (PyPI) Mobile Security Framework is a security testing framework for analyzing Android and iOS mobile applications. ## Latest mobsf (PyPI) vulnerabilities - [CVE-2026-68922: MobSF path traversal in icon analysis](https://junglewise.ai/threats/cve-2026-68922-mobsf-path-traversal-in-icon-analysis) (medium, CVSS 5.5, published 18 Aug 2026) - [CVE-2026-68923: MobSF CSRF protection bypass after Django migration](https://junglewise.ai/threats/cve-2026-68923-mobsf-csrf-protection-bypass-after-django-migration) (medium, CVSS 6.5, published 18 Aug 2026) - [CVE-2026-68927: MobSF SSRF port restriction bypass in assetlinks_check](https://junglewise.ai/threats/cve-2026-68927-mobsf-ssrf-port-restriction-bypass-in-assetlinks-check) (low, CVSS 3.1, published 18 Aug 2026) - [CVE-2026-68924: MobSF ZIP/APK extraction denial of service via per-file size limit bypass](https://junglewise.ai/threats/cve-2026-68924-mobsf-zip-apk-extraction-denial-of-service-via-per-file-size) (medium, CVSS 4.9, published 18 Aug 2026) - [CVE-2026-33545: PYSEC-2026-2662 - MobSF has SQL Injection in its SQLite Database Viewer Utils](https://junglewise.ai/threats/cve-2026-33545-mobsf-has-sql-injection-in-its-sqlite-database-viewer-utils) (low, CVSS 3.1, published 13 Jul 2026) - [CVE-2026-24490: PYSEC-2026-1668 - MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field](https://junglewise.ai/threats/cve-2026-24490-mobsf-has-stored-xss-via-manifest-analysis-dialer-code-host-field) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2025-58161: PYSEC-2026-1672 - MobSF Path Traversal in GET /download/ using absolute filenames](https://junglewise.ai/threats/cve-2025-58161-mobsf-path-traversal-in-get-download-filename-using-absolute) (medium, CVSS 4, published 7 Jul 2026) - [CVE-2025-58162: PYSEC-2026-1670 - MobSF Vulnerable to Arbitrary File Write (AR-Slip) via Absolute Path in .a Extraction](https://junglewise.ai/threats/cve-2025-58162-mobsf-vulnerable-to-arbitrary-file-write-ar-slip-via-absolute) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2025-46730: PYSEC-2026-1671 - Mobile Security Framework (MobSF) Allows Web Server Resource Exhaustion via ZIP of Death Attack](https://junglewise.ai/threats/cve-2025-46730-mobile-security-framework-mobsf-allows-web-server-resource) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2025-46335: PYSEC-2026-1675 - Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload](https://junglewise.ai/threats/cve-2025-46335-mobile-security-framework-mobsf-allows-stored-cross-site) (medium, CVSS 4, published 7 Jul 2026) - [CVE-2025-24805: PYSEC-2026-1667 - MobSF Local Privilege Escalation](https://junglewise.ai/threats/cve-2025-24805-mobsf-local-privilege-escalation) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2025-24804: PYSEC-2026-1674 - MobSF Partial Denial of Service (DoS)](https://junglewise.ai/threats/cve-2025-24804-mobsf-partial-denial-of-service-dos) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2025-24803: PYSEC-2026-1673 - MobSF Stored Cross-Site Scripting (XSS)](https://junglewise.ai/threats/cve-2025-24803-mobsf-stored-cross-site-scripting-xss) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2024-53999: PYSEC-2026-1666 - Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare"…](https://junglewise.ai/threats/cve-2024-53999-mobile-security-framework-mobsf-stored-cross-site-scripting) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2024-43399: PYSEC-2026-1665 - Mobile Security Framework (MobSF) has a Zip Slip Vulnerability in .a Static Library Files](https://junglewise.ai/threats/cve-2024-43399-mobile-security-framework-mobsf-has-a-zip-slip-vulnerability-in-a) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2024-41955: PYSEC-2026-1669 - MobSF vulnerable to Open Redirect in Login Redirect](https://junglewise.ai/threats/cve-2024-41955-mobsf-vulnerable-to-open-redirect-in-login-redirect) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2024-31215: PYSEC-2026-1676 - Mobile Security Framework (MobSF) vulnerable to SSRF in firebase database check](https://junglewise.ai/threats/cve-2024-31215-mobile-security-framework-mobsf-vulnerable-to-ssrf-in-firebase) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2024-29190: PYSEC-2026-1677 - SSRF Vulnerability on assetlinks_check(act_name, well_knowns)](https://junglewise.ai/threats/cve-2024-29190-ssrf-vulnerability-on-assetlinks-check-act-name-well-knowns) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2022-41547: PYSEC-2026-848 - MobSF allows attackers to read arbitrary files via a crafted HTTP request](https://junglewise.ai/threats/cve-2022-41547-mobsf-allows-attackers-to-read-arbitrary-files-via-a-crafted-http) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2025-31116: Mobile Security Framework (MobSF) has a SSRF Vulnerability fix bypass on assetlinks_check with DNS Rebinding](https://junglewise.ai/threats/cve-2025-31116-mobile-security-framework-mobsf-has-a-ssrf-vulnerability-fix) (low, CVSS 3.1, published 31 Mar 2025) - [CVE-2024-54000: MobSF vulnerability allows SSRF due to the allow_redirects=True parameter](https://junglewise.ai/threats/cve-2024-54000-mobsf-vulnerability-allows-ssrf-due-to-the-allow-redirects-true) (low, CVSS 3.1, published 3 Dec 2024) - [CVE-2023-42261: Withdrawn Advisory: Mobile Security Framework (MobSF) Vulnerable to Insecure Permissions](https://junglewise.ai/threats/cve-2023-42261-withdrawn-advisory-mobile-security-framework-mobsf-vulnerable-to) (low, CVSS 3.1, published 21 Sep 2023) ## Most severe mobsf (PyPI) vulnerabilities - [CVE-2026-68923: MobSF CSRF protection bypass after Django migration](https://junglewise.ai/threats/cve-2026-68923-mobsf-csrf-protection-bypass-after-django-migration) (medium, CVSS 6.5, published 18 Aug 2026) - [CVE-2026-68922: MobSF path traversal in icon analysis](https://junglewise.ai/threats/cve-2026-68922-mobsf-path-traversal-in-icon-analysis) (medium, CVSS 5.5, published 18 Aug 2026) - [CVE-2026-68924: MobSF ZIP/APK extraction denial of service via per-file size limit bypass](https://junglewise.ai/threats/cve-2026-68924-mobsf-zip-apk-extraction-denial-of-service-via-per-file-size) (medium, CVSS 4.9, published 18 Aug 2026) - [CVE-2025-58161: PYSEC-2026-1672 - MobSF Path Traversal in GET /download/ using absolute filenames](https://junglewise.ai/threats/cve-2025-58161-mobsf-path-traversal-in-get-download-filename-using-absolute) (medium, CVSS 4, published 7 Jul 2026) - [CVE-2025-46335: PYSEC-2026-1675 - Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload](https://junglewise.ai/threats/cve-2025-46335-mobile-security-framework-mobsf-allows-stored-cross-site) (medium, CVSS 4, published 7 Jul 2026) - [CVE-2022-41547: PYSEC-2026-848 - MobSF allows attackers to read arbitrary files via a crafted HTTP request](https://junglewise.ai/threats/cve-2022-41547-mobsf-allows-attackers-to-read-arbitrary-files-via-a-crafted-http) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2024-41955: PYSEC-2026-1669 - MobSF vulnerable to Open Redirect in Login Redirect](https://junglewise.ai/threats/cve-2024-41955-mobsf-vulnerable-to-open-redirect-in-login-redirect) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2024-43399: PYSEC-2026-1665 - Mobile Security Framework (MobSF) has a Zip Slip Vulnerability in .a Static Library Files](https://junglewise.ai/threats/cve-2024-43399-mobile-security-framework-mobsf-has-a-zip-slip-vulnerability-in-a) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2023-42261: Withdrawn Advisory: Mobile Security Framework (MobSF) Vulnerable to Insecure Permissions](https://junglewise.ai/threats/cve-2023-42261-withdrawn-advisory-mobile-security-framework-mobsf-vulnerable-to) (low, CVSS 3.1, published 21 Sep 2023) - [CVE-2024-29190: PYSEC-2026-1677 - SSRF Vulnerability on assetlinks_check(act_name, well_knowns)](https://junglewise.ai/threats/cve-2024-29190-ssrf-vulnerability-on-assetlinks-check-act-name-well-knowns) (low, CVSS 3.1, published 7 Jul 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 4 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other PyPI technologies - [tensorflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-tensorflow): 435 vulnerabilities - [tensorflow-cpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-cpu): 430 vulnerabilities - [tensorflow-gpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-gpu): 427 vulnerabilities - [open-webui (PyPI)](https://junglewise.ai/threats/technologies/open-webui): 177 vulnerabilities - [Django (PyPI)](https://junglewise.ai/threats/technologies/django): 173 vulnerabilities - [apache-airflow (PyPI)](https://junglewise.ai/threats/technologies/apache-airflow): 159 vulnerabilities - [pillow (PyPI)](https://junglewise.ai/threats/technologies/pillow): 125 vulnerabilities - [praisonai (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonai): 120 vulnerabilities - [vllm (PyPI)](https://junglewise.ai/threats/technologies/pypi-vllm): 117 vulnerabilities - [plone (PyPI)](https://junglewise.ai/threats/technologies/pypi-plone): 101 vulnerabilities - [mlflow (PyPI)](https://junglewise.ai/threats/technologies/mlflow): 88 vulnerabilities - [picklescan (PyPI)](https://junglewise.ai/threats/technologies/picklescan): 86 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "mobsf (PyPI) vulnerabilities", https://junglewise.ai/threats/technologies/mobsf, 13 November 2026.