Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 730 | 0,2 % |
| ≥50 % | 3.213 | 0,9 % |
| ≥10 % | 22.093 | 5,9 % |
| <10 % | 347.769 | 93,0 % |
CVE-2026-5985 | code-projects Simple IT Discussion Forum 1.0 /crud.php user_Id sql injection
A vulnerability classified as critical was found in code-projects Simple IT Discussion Forum 1.0. The affected element is an unknown function of the file /crud.php. The manipulation of the argument user_Id results in sql injection. This vul
CVE-2026-5973 | FoundationAgents MetaGPT up to 0.8.1 metagpt/utils/common.py get_mime_type os command injection (Issue 1930)
A vulnerability, which was classified as critical, was found in FoundationAgents MetaGPT up to 0.8.1. Impacted is the function get_mime_type of the file metagpt/utils/common.py. The manipulation results in os command injection. This vulnera
CVE-2026-5961 | code-projects Simple IT Discussion Forum 1.0 /topic-details.php post_id sql injection
A vulnerability has been found in code-projects Simple IT Discussion Forum 1.0 and classified as critical. This vulnerability affects unknown code of the file /topic-details.php. The manipulation of the argument post_id leads to sql injecti
CVE-2026-40093 | nimiq core-rs-albatross up to 1.3.0 Block blockchain/src/reward.rs Policy::supply_at improper validation of specified quantity in input (GHSA-49xc-52mp-cc9j)
A vulnerability identified as problematic has been detected in nimiq core-rs-albatross up to 1.3.0. This affects the function Policy::supply_at of the file blockchain/src/reward.rs of the component Block Handler. The manipulation leads to i
CVE-2026-40088 | MervinPraison PraisonAI up to 4.5.120 execute_command os command injection
A vulnerability has been found in MervinPraison PraisonAI up to 4.5.120 and classified as critical. The affected element is the function execute_command. The manipulation leads to os command injection. This vulnerability is documented as CV
CVE-2026-40069 | sgbett bsv-ruby-sdk up to 0.8.1 Transaction BSV::Network txStatus unusual condition
A vulnerability was found in sgbett bsv-ruby-sdk up to 0.8.1. It has been declared as problematic. Affected by this vulnerability is the function BSV::Network of the component Transaction Handler. Such manipulation of the argument txStatus
CVE-2026-40046 | Apache ActiveMQ/ActiveMQ MQTT up to 6.2.3 MQTT Control Packet length integer overflow
A vulnerability was found in Apache ActiveMQ and ActiveMQ MQTT up to 6.2.3. It has been classified as critical. This vulnerability affects unknown code of the component MQTT Control Packet Handler. This manipulation of the argument length c
CVE-2026-39843 | makeplane up to 1.2.x fetch_and_encode_favicon server-side request forgery
A vulnerability has been found in makeplane plane up to 1.2.x and classified as critical. This affects the function fetch_and_encode_favicon. This manipulation causes server-side request forgery. This vulnerability is handled as CVE-2026-39
CVE-2026-5848 | jeecgboot JimuReport up to 2.3.0 Data Source testConnection DriverManager.getConnection dbUrl code injection (Issue 4587)
A vulnerability has been found in jeecgboot JimuReport up to 2.3.0 and classified as critical. The affected element is the function DriverManager.getConnection of the file /drag/onlDragDataSource/testConnection of the component Data Source
CVE-2026-5379 | runZero Platform up to 2.x/3.0 Organization authorization
A vulnerability was found in runZero Platform up to 2.x/3.0. It has been classified as problematic. The affected element is an unknown function of the component Organization Handler. This manipulation causes incorrect authorization. This vu
CVE-2026-39319 | ChurchCRM up to 7.0.x Endpoint /FundRaiserEditor.php iCurrentFundraiser sql injection (GHSA-vg4m-hc29-jgqj)
A vulnerability classified as critical was found in ChurchCRM up to 7.0.x. This affects an unknown part of the file /FundRaiserEditor.php of the component Endpoint. Executing a manipulation of the argument iCurrentFundraiser can lead to sql
CVE-2026-35487 | oobabooga text-generation-webui up to 4.2 API Response load_prompt path traversal
A vulnerability, which was classified as critical, was found in oobabooga text-generation-webui up to 4.2. Affected by this vulnerability is the function load_prompt of the component API Response Handler. Such manipulation leads to path tra
CVE-2026-5670 | Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f upload.php move_uploaded_file unrestricted upload
A vulnerability has been found in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f and classified as critical. This issue affects the function move_uploaded_file of the file /AssignmentSection/submission/up
CVE-2026-35052 | man-group dtale up to 3.21.x cross site scripting (GHSA-436g-fhfc-9g5w)
A vulnerability was found in man-group dtale up to 3.21.x. It has been rated as problematic. This affects an unknown part. This manipulation causes cross site scripting. This vulnerability is handled as CVE-2026-35052. The attack can be ini
CVE-2026-35050 | oobabooga text-generation-webui up to 4.1.0 Setting download-model.py path traversal (GHSA-jg96-p5p6-q3cv)
A vulnerability was found in oobabooga text-generation-webui up to 4.1.0. It has been classified as critical. Affected by this vulnerability is an unknown functionality of the file download-model.py of the component Setting Handler. The man
CVE-2026-35047 | Ajax30 BraveCMS up to 2.0.5 CKEditor Endpoint unrestricted upload (GHSA-9rcc-w59j-965v)
A vulnerability, which was classified as critical, has been found in Ajax30 BraveCMS up to 2.0.5. Affected is an unknown function of the component CKEditor Endpoint. Performing a manipulation results in unrestricted upload. This vulnerabili
CVE-2026-35046 | TandoorRecipes recipes up to 2.6.3 bleach.clean cross site scripting (GHSA-9hhh-g2fc-r8x2)
A vulnerability, which was classified as problematic, was found in TandoorRecipes recipes up to 2.6.3. Affected by this vulnerability is the function bleach.clean. Executing a manipulation can lead to cross site scripting. This vulnerabilit
CVE-2026-30613 | AZIOT 1.1.9 UART Interface information disclosure
A vulnerability was found in AZIOT 1.1.9. It has been declared as problematic. This issue affects some unknown processing of the component UART Interface. Such manipulation leads to information disclosure. This vulnerability is traded as CV
CVE-2025-61166 | SigningHub User 10.0 URL redirect
A vulnerability identified as problematic has been detected in SigningHub User 10.0. The impacted element is an unknown function of the component URL Handler. The manipulation leads to open redirect. This vulnerability is uniquely identifie
CVE-2025-59440 | Samsung Mobile Processor/Wearable Processor/Modem Exynos up to 9110 USIM denial of service
A vulnerability marked as problematic has been reported in Samsung Mobile Processor, Wearable Processor and Modem Exynos up to 9110. The affected element is an unknown function of the component USIM. The manipulation leads to denial of serv
Microsoft Authenticator für Android: Sicherheitslücke lieferte Zugriffsschlüssel ohne App-Berechtigungen
Sicherheitsforscher haben im Microsoft Authenticator unter Android eine Schwachstelle namens AuthMask aufgedeckt. Das Problem daran: Eine ganz gewöhnliche App auf dem Smartphone, die nicht einmal besondere...Zum Beitrag: Microsoft Authentic
Das iPhone Duo hat eine gewaltige Schwachstelle
(Bildquelle: Apple und Bildbearbeitung GIGA)Apples erstes Falt-Handy ist da. Ein YouTube-Experte spricht jedoch eine deutliche Warnung aus.Tech-Experte Zack Nelson nimmt sich das iPhone Duo vor. Auf seinem YouTube-Kanal JerryRigEverything u
CVE-2026-5669 | Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f Parameter /login.php password sql injection (Issue 240)
A vulnerability, which was classified as critical, was found in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This vulnerability affects unknown code of the file /login.php of the component Parameter Ha
CVE-2026-5668 | Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f add%20notice.php $_SERVER['PHP_SELF'] cross site scripting (Issue 239)
A vulnerability, which was classified as problematic, has been found in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This affects an unknown part of the file /admin/Add%20notice/add%20notice.php. This
CVE-2026-5665 | code-projects Online FIR System 1.0 Login /Login/checklogin.php email/password sql injection
A vulnerability classified as critical has been found in code-projects Online FIR System 1.0. Affected by this vulnerability is an unknown functionality of the file /Login/checklogin.php of the component Login. The manipulation of the argum
CVE-2026-35042 | nearform fast-jwt crit Header Extension data authenticity
A vulnerability described as problematic has been identified in nearform fast-jwt. This impacts an unknown function of the component crit Header Extension. Executing a manipulation can lead to insufficient verification of data authenticity.
CVE-2026-35039 | nearform fast-jwt up to 6.0.x data authenticity (GHSA-rp9m-7r4c-75qg)
A vulnerability marked as critical has been reported in nearform fast-jwt up to 6.0.x. This vulnerability affects unknown code. Performing a manipulation results in insufficient verification of data authenticity. This vulnerability is ident
CVE-2026-35037 | lin-snow Ech0 up to 4.2.7 Endpoint /api/website/title website_url server-side request forgery (GHSA-cqgf-f4x7-g6wc)
A vulnerability classified as critical was found in lin-snow Ech0 up to 4.2.7. The affected element is an unknown function of the file /api/website/title of the component Endpoint. The manipulation of the argument website_url results in ser
CVE-2026-35035 | ci4-cms-erp ci4ms 0.28.5.0/0.31.0.0 Setting cross site scripting (GHSA-5ghq-42rg-769x)
A vulnerability classified as problematic has been found in ci4-cms-erp ci4ms 0.28.5.0/0.31.0.0. Impacted is an unknown function of the component Setting Handler. The manipulation leads to cross site scripting. This vulnerability is listed
CVE-2026-34989 | ci4-cms-erp ci4ms 0.28.5.0/0.31.0.0 cross site scripting
A vulnerability has been found in ci4-cms-erp ci4ms 0.28.5.0/0.31.0.0 and classified as problematic. The affected element is an unknown function. This manipulation causes cross site scripting. This vulnerability appears as CVE-2026-34989. T
CVE-2026-34969 | Nhost up to 0.47.x information disclosure (GHSA-g2qj-prgh-4g9r)
A vulnerability was found in Nhost up to 0.47.x. It has been classified as problematic. This issue affects some unknown processing. The manipulation leads to information disclosure. This vulnerability is referenced as CVE-2026-34969. Remote
CVE-2026-28736 | Mattermost Focalboard up to 8.0 authorization
A vulnerability was found in Mattermost Focalboard up to 8.0. It has been classified as problematic. Affected is an unknown function. Performing a manipulation results in authorization bypass. This vulnerability only affects products that a
CVE-2022-48021 | Zammad 5.3.0 Message privilege escalation (EUVD-2022-50735)
A vulnerability identified as critical has been detected in Zammad 5.3.0. Affected by this issue is some unknown functionality of the component Message Handler. Performing a manipulation results in privilege escalation. This vulnerability i
CVE-2022-48020 | Vinteo VCC 2.36.4 conference cross site scripting (EUVD-2022-50734)
A vulnerability has been found in Vinteo VCC 2.36.4 and classified as problematic. Affected is an unknown function. This manipulation of the argument conference causes cross site scripting. This vulnerability is handled as CVE-2022-48020. T
CVE-2022-48013 | Opencats 0.9.7 index.php?m=calendar Description/Title cross site scripting (EUVD-2022-50727)
A vulnerability, which was classified as problematic, was found in Opencats 0.9.7. Affected by this vulnerability is an unknown functionality of the file /opencats/index.php?m=calendar. The manipulation of the argument Description/Title res
CVE-2022-48012 | Opencats 0.9.7 index.php?m=settings&a=ajax_tags_upd cross site scripting (EUVD-2022-50726)
A vulnerability was found in Opencats 0.9.7. It has been declared as problematic. This issue affects some unknown processing of the file /opencats/index.php?m=settings&amp;a=ajax_tags_upd. Executing a manipulation can lead to cross site
CVE-2022-48011 | Opencats 0.9.7 Import viewerrors importID sql injection (EUVD-2022-50725)
A vulnerability, which was classified as critical, has been found in Opencats 0.9.7. This affects an unknown part of the component Import viewerrors Handler. This manipulation of the argument importID causes sql injection. This vulnerabilit
CVE-2022-48008 | LimeSurvey 5.4.15 Plugin Manager unrestricted upload (EUVD-2022-50722)
A vulnerability was found in LimeSurvey 5.4.15. It has been classified as problematic. This vulnerability affects unknown code of the component Plugin Manager. Performing a manipulation results in unrestricted upload. This vulnerability is
CVE-2022-48007 | Piwigo 13.4.0 identification.php User-Agent cross site scripting (Issue 1835 / EUVD-2022-50721)
A vulnerability has been found in Piwigo 13.4.0 and classified as problematic. Affected by this issue is some unknown functionality of the file identification.php. This manipulation of the argument User-Agent causes cross site scripting. Th
PHP2Shell security flaws now sucessfully exploited in the wild
Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild. [...] Weiterlesen
PHP Publishes Mitigation Advice for New RCE Flaw
PHP warns of critical RCE vulnerability CVE-2026-115560, but says limited exploit conditions mean most deployments are unlikely to be affected Weiterlesen
CVE-2026-116123 | A weakness has been identified in NocoDB up to 2026.07.0. The affected element is the function validatePassword of the file /auth/user/signup. Executing a manipulation can lead to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The vendor documents this as intentional. The vendor deleted the GitHub issue for
A weakness has been identified in NocoDB up to 2026.07.0. The affected element is the function validatePassword of the file /auth/user/signup. Executing a manipulation can lead to improper restriction of excessive authentication attempts. I
CVE-2026-116122 | A security flaw has been discovered in NocoDB up to 2026.07.0. Impacted is the function AuthService.validateUser of the component Sign-in Endpoint. Performing a manipulation of the argument salt results in information disclosure. It is possible to initiate the attack remotely. The attack's complexity is rated as high. The exploitability is considered difficult. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the
A security flaw has been discovered in NocoDB up to 2026.07.0. Impacted is the function AuthService.validateUser of the component Sign-in Endpoint. Performing a manipulation of the argument salt results in information disclosure. It is poss
CVE-2026-116121 | A vulnerability was identified in NocoDB up to 2026.08.0. This issue affects some unknown processing of the file users.service.ts of the component Registration. Such manipulation leads to race condition. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is assessed as difficult. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted earl
A vulnerability was identified in NocoDB up to 2026.08.0. This issue affects some unknown processing of the file users.service.ts of the component Registration. Such manipulation leads to race condition. The attack may be performed from rem
CVE-2026-116120 | A vulnerability was determined in NocoDB up to 2026.07.0. This vulnerability affects the function UserRefreshToken.deleteAllUserToken of the file /auth/user/signup of the component PublicApiLimiterGuard. This manipulation causes allocation of resources. The attack is possible to be carried out remotely. The attack is considered to have high complexity. It is stated that the exploitability is difficult. Code-verified absence of in-app rate limiting on the una
A vulnerability was determined in NocoDB up to 2026.07.0. This vulnerability affects the function UserRefreshToken.deleteAllUserToken of the file /auth/user/signup of the component PublicApiLimiterGuard. This manipulation causes allocation
CVE-2026-116119 | A vulnerability was found in NocoDB up to 2026.08.0. This affects an unknown part of the file packages/nocodb/src/services/users/users.service.ts of the component Password-Reset Flow. The manipulation results in race condition. The attack can be executed remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.
A vulnerability was found in NocoDB up to 2026.08.0. This affects an unknown part of the file packages/nocodb/src/services/users/users.service.ts of the component Password-Reset Flow. The manipulation results in race condition. The attack c
CVE-2026-113345 | Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission vulnerability. Files in the installation folder of the application may be tampered with, resulting in arbitrary code execution.
Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission vulnerability. Files in the installation folder of the application ma
CVE-2026-116118 | A vulnerability has been found in Z.ai Zcode up to 3.14.3/3.15.1. Affected by this issue is some unknown functionality of the component Sed Command Filter. The manipulation leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
A vulnerability has been found in Z.ai Zcode up to 3.14.3/3.15.1. Affected by this issue is some unknown functionality of the component Sed Command Filter. The manipulation leads to os command injection. Remote exploitation of the attack is
CVE-2026-116117 | A flaw has been found in halo-dev halo up to 2.27.0-beta.1. Affected by this vulnerability is the function run.halo.app.theme.DefaultViewNameResolver.resolveViewNameOrDefault of the file application/src/main/java/run/halo/app/theme/DefaultViewNameResolver.java of the component View Name Resolver. Executing a manipulation of the argument template can lead to path traversal. The attack may be launched remotely. The exploit has been published and may be used. T
A flaw has been found in halo-dev halo up to 2.27.0-beta.1. Affected by this vulnerability is the function run.halo.app.theme.DefaultViewNameResolver.resolveViewNameOrDefault of the file application/src/main/java/run/halo/app/theme/DefaultV
CVE-2026-116116 | A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown function of the component Secure Boot. Performing a manipulation results in improper verification of cryptographic signature. The attack needs to be approached locally. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown function of the component Secure Boot. Performing a manipulation results in improper verification of cryptographic signature. The attack needs to be a
CVE-2026-116115 | A security vulnerability has been detected in Yoosee GM8135S Camera 21.00.01.36. This impacts an unknown function of the file wpa_supplicantX.conf of the component WiFi Configuration. Such manipulation leads to improper initialization. The attack can only be initiated within the local network. This attack is characterized by high complexity. The exploitability is said to be difficult. The exploit has been disclosed publicly and may be used. The vendor was co
A security vulnerability has been detected in Yoosee GM8135S Camera 21.00.01.36. This impacts an unknown function of the file wpa_supplicantX.conf of the component WiFi Configuration. Such manipulation leads to improper initialization. The
CVE-2026-116114 | A weakness has been identified in Yoosee GM8135S Camera 21.00.01.36. This affects an unknown function of the file /npc/npc of the component Live UDP H.264 Video Stream Handler. This manipulation causes cleartext transmission of sensitive information. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The exploit has been made available to the public and could be used for attacks. The v
A weakness has been identified in Yoosee GM8135S Camera 21.00.01.36. This affects an unknown function of the file /npc/npc of the component Live UDP H.264 Video Stream Handler. This manipulation causes cleartext transmission of sensitive in
CVE-2026-116113 | A security flaw has been discovered in GouGuOA up to 6.1.2. The impacted element is the function chunkUpload of the file app/disk/controller/Api.php. The manipulation of the argument file_extension results in unrestricted upload. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
A security flaw has been discovered in GouGuOA up to 6.1.2. The impacted element is the function chunkUpload of the file app/disk/controller/Api.php. The manipulation of the argument file_extension results in unrestricted upload. It is poss
CVE-2026-116112 | A vulnerability was identified in HashenUdara edoc-doctor-appointment-system up to cc258425b915d1af9e298777ccd26d160493e68d. The affected element is an unknown function of the file admin/add-new.php. The manipulation of the argument spec leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. This product is using a rolling release to provide continious delivery. Therefore, no version detai
A vulnerability was identified in HashenUdara edoc-doctor-appointment-system up to cc258425b915d1af9e298777ccd26d160493e68d. The affected element is an unknown function of the file admin/add-new.php. The manipulation of the argument spec le
CVE-2026-116111 | A vulnerability was determined in 2K Games Civilization V 1.0.3.144. Impacted is the function loadstring of the component Lua Sandbox. Executing a manipulation can lead to type confusion. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was determined in 2K Games Civilization V 1.0.3.144. Impacted is the function loadstring of the component Lua Sandbox. Executing a manipulation can lead to type confusion. The attack may be performed from remote. The exploit
CVE-2026-116110 | A vulnerability was found in GiantappMan LiveWallPaper 2.6.8.0 on Windows. This issue affects some unknown processing of the file /LiveWallpaper/UploadFile of the component SignalR Hub. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The patch is named b62f878899adbfc2968e3345442f3a3df91b774d. It is suggested to install a patch to address this
A vulnerability was found in GiantappMan LiveWallPaper 2.6.8.0 on Windows. This issue affects some unknown processing of the file /LiveWallpaper/UploadFile of the component SignalR Hub. Performing a manipulation results in missing authentic
CVE-2026-116109 | A vulnerability has been found in continuedev Continue 2.0.0. This vulnerability affects the function MCPManagerSingleton.setConnections of the file core/config/ConfigHandler.ts of the component MCP Server Transport. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability has been found in continuedev Continue 2.0.0. This vulnerability affects the function MCPManagerSingleton.setConnections of the file core/config/ConfigHandler.ts of the component MCP Server Transport. Such manipulation leads
CVE-2026-116108 | A flaw has been found in openbq-org OpenBB up to 4.7.2/5.0.0. This affects an unknown part of the file openbb_platform/core/openbb_core/app/model/api_settings.py of the component Local API Server. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A flaw has been found in openbq-org OpenBB up to 4.7.2/5.0.0. This affects an unknown part of the file openbb_platform/core/openbb_core/app/model/api_settings.py of the component Local API Server. This manipulation causes improper access co
CVE-2026-116107 | A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress. Affected by this issue is the function dfrps_ajax_delete_saved_search of the file functions/ajax.php of the component AJAX Handlers. The manipulation results in missing authorization. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version 1.3.25 can resolve this issue. Upgrading the affected component is advised. The vendor w
A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress. Affected by this issue is the function dfrps_ajax_delete_saved_search of the file functions/ajax.php of the component AJAX Handlers. The manipulation r
CVE-2026-116106 | A security vulnerability has been detected in HeyCyan App 1.0.103 on Android. Affected by this vulnerability is an unknown functionality of the component FileProvider. The manipulation leads to improper access controls. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
A security vulnerability has been detected in HeyCyan App 1.0.103 on Android. Affected by this vulnerability is an unknown functionality of the component FileProvider. The manipulation leads to improper access controls. The attack may be in