What’s Vulnerable › Vulnerabilities

CVE-2026-72528

• Severity: medium (CVSS 5.1 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-15 · updated 2026-10-15
• Weakness: CWE-601

Description

"Handmade Marketplace App - Creema" provided by CREEMA LTD. contains an open redirect vulnerability. When accessing a specially crafted URL, a website set up by the attacker may be displayed within the app's screen of a user. As a result, the user may become a victim of a phishing attack.

Affected products

• CREEMA LTD. "Creema - Handmade Marketplace App" for iOS: before 2.432.0 — fixed in 2.432.0
• CREEMA LTD. "Handmade Marketplace App - Creema" for Android: before 2.436.0 — fixed in 2.436.0

How to fix

Upgrade to a fixed version: CREEMA LTD. "Creema - Handmade Marketplace App" for iOS 2.432.0; CREEMA LTD. "Handmade Marketplace App - Creema" for Android 2.436.0. Check the vendor advisory for mitigations.

References

• https://apps.apple.com/jp/app/id916614208
• https://jvn.jp/en/jp/JVN48627289/
• https://play.google.com/store/apps/details?id=jp.creema.creema_android&hl=ja

Get alerted when CVE-2026-72528 or the next vulnerability affects your stack