Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| Medium | 6.9 | CVE-2026-116106 |
A security vulnerability has been detected in HeyCyan App 1.0.103 on Android
HeyCyan, AgoraHeyCyan App
|
NVD | |||
|
CVE-2026-116106A security vulnerability has been detected in HeyCyan App 1.0.103 on Android
Executive summaryThe advisory covers the HeyCyan companion app for Glass Studio smart glasses, version 1.0.103 on Android. The author reports 21 vulnerabilities, 3 rated critical, and calls the overall risk critical, with an aggregate CVSS of 9.1 for a chain that combines network interception and WebView code execution. The recommended response is a prioritized fix list, starting with removing cleartext HTTP traffic, fixing the file provider root path, and removing the JavaScript bridge. The source is a partial reconstruction from search cache, so parts of the original report are missing. Technical summaryThe report describes cleartext HTTP allowed globally, a FileProvider exposing the application root path, a WebView with a JavaScript interface that can lead to code execution, exported components, unencrypted SQLite user data, missing certificate pinning, mutable PendingIntents, and world-readable SharedPreferences. The main chain needs an attacker on the same WiFi network to perform a man-in-the-middle attack and inject JavaScript, while the file provider issue is described as reachable by any app on the device. The affected version is stated as 1.0.103 (build code 103), and no fixed version is stated. The advisory gives remediation steps such as removing usesCleartextTraffic, removing the root-path provider entry, removing addJavascriptInterface, adding FLAG_IMMUTABLE, and adding SQLCipher, but it does not describe a vendor patch or a workaround that is confirmed as effective. Detection guidance is not stated, and exploitation in the wild is not stated. The author performed static analysis only and no dynamic testing. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: VideoLAN VLC Summarized from github.com/ohackercego/heycyan-vulnerabilitys Impact if exploitedConfidentialityLow IntegrityLow AvailabilityLow
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 6.3 | CVE-2026-116105 |
A weakness has been identified in HeyCyan App 1.0.103 on Android
HeyCyan, Agora, VLCHeyCyan App, HeyCyan, VLC libvlc, Agora RTC/RTM
|
NVD | |||
|
CVE-2026-116105A weakness has been identified in HeyCyan App 1.0.103 on Android
Executive summaryA partial, reconstructed report from a GitHub repository describes 21 security weaknesses in the HeyCyan Android companion app (version 1.0.103) for Glass Studio smart glasses. The report rates the overall risk as critical, mainly because a chain of issues involving unencrypted network traffic and a WebView JavaScript bridge could allow remote code execution and theft of user data. The advisory does not state a fixed version, and its recommendations are to remove cleartext traffic, fix the file provider and WebView bridge, and secure the other listed weaknesses. Technical summaryThe report lists three critical findings: HTTP cleartext traffic allowed globally (V1, CVSS 9.1), a FileProvider exposing the root path (V2, CVSS 8.4), and an insecure WebView with a JavaScript bridge (V3, CVSS 8.8). The main chain requires an attacker on the same WiFi network to perform a man-in-the-middle attack, inject JavaScript into an HTTP response, call @JavascriptInterface methods, and read local files through file://, with a local FileProvider reading path also listed. Other weaknesses include missing certificate pinning, mutable PendingIntents, world-readable SharedPreferences, an unencrypted Room database, exported components, and an unverified OTA firmware channel. The advisory does not state affected version ranges beyond 1.0.103, fixed versions, or any exploitation in the wild, and it gives no vendor-issued patch. Workarounds are given only as recommended fixes in the report's roadmap, such as removing usesCleartextTraffic, removing addJavascriptInterface, adding FLAG_IMMUTABLE, and using SQLCipher. The report provides no specific detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ohackercego/heycyan-vulnerabilitys Impact if exploitedConfidentialityLow IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||