Vulnerability · Published Oct 15, 2026 · Assigned by jpcert
CVE-2026-72528
Medium 4.3
In plain English
A medium-severity open redirect in "Creema - Handmade Marketplace App" for iOS from CREEMA LTD.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Severity (CVSS 3.0)4.3Medium
Exploit odds (30 days)0.2%top 88.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
"Handmade Marketplace App - Creema" provided by CREEMA LTD. contains an open redirect vulnerability. When accessing a specially crafted URL, a website set up by the attacker may be displayed within the app's screen of a user. As a result, the user may become a victim of a phishing attack.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CREEMA LTD. | "Handmade Marketplace App - Creema" for Android | 0 – before 2.436.0 |
| CREEMA LTD. | "Creema - Handmade Marketplace App" for iOS | 0 – before 2.432.0 |
Weakness: CWE-601 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N