Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 08:05 UTC

Critical in the last 24 hours

1601 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

181-70% vs 7-day avg of 598

2 critical, 65 high, 73 medium, 31 low

Expand	Severity	Score	Advisory	Title	Source	Flags	Published
	Medium	6.3	CVE-2026-116105	A weakness has been identified in HeyCyan App 1.0.103 on Android HeyCyan, Agora, VLCHeyCyan App, HeyCyan, VLC libvlc, Agora RTC/RTM	NVD		Oct 26 02:17 UTC
CVE-2026-116105A weakness has been identified in HeyCyan App 1.0.103 on Android Executive summary A partial, reconstructed report from a GitHub repository describes 21 security weaknesses in the HeyCyan Android companion app (version 1.0.103) for Glass Studio smart glasses. The report rates the overall risk as critical, mainly because a chain of issues involving unencrypted network traffic and a WebView JavaScript bridge could allow remote code execution and theft of user data. The advisory does not state a fixed version, and its recommendations are to remove cleartext traffic, fix the file provider and WebView bridge, and secure the other listed weaknesses. Technical summary The report lists three critical findings: HTTP cleartext traffic allowed globally (V1, CVSS 9.1), a FileProvider exposing the root path (V2, CVSS 8.4), and an insecure WebView with a JavaScript bridge (V3, CVSS 8.8). The main chain requires an attacker on the same WiFi network to perform a man-in-the-middle attack, inject JavaScript into an HTTP response, call @JavascriptInterface methods, and read local files through file://, with a local FileProvider reading path also listed. Other weaknesses include missing certificate pinning, mutable PendingIntents, world-readable SharedPreferences, an unencrypted Room database, exported components, and an unverified OTA firmware channel. The advisory does not state affected version ranges beyond 1.0.103, fixed versions, or any exploitation in the wild, and it gives no vendor-issued patch. Workarounds are given only as recommended fixes in the report's roadmap, such as removing usesCleartextTraffic, removing addJavascriptInterface, adding FLAG_IMMUTABLE, and using SQLCipher. The report provides no specific detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ohackercego/heycyan-vulnerabilitys Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects HeyCyan Agora VLC HeyCyan App HeyCyan VLC libvlc Agora RTC/RTM NIST National Vulnerability DatabasePublished Oct 26, 2026 02:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Search syntax

Welcome to CVEsee.org

What is CVEsee.org?

Disclaimer

You are leaving CVEsee.org

Install CVEsee