47 matches found
CVE-2024-34463
CVE-2024-34463 Betroffene Geräte : BPL Smart Weighing Scale PWS-01-BT https://www.bplmedicaltechnologies.com/product-details/weighing-scales/personal-weighing-scale-pws-01bt/ Sicherheitslücke : Unzureichende Sicherheit in der Bluetooth-Kommunikation zwischen der digitalen Waage und der zugehörige...
CVE-2026-76258
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who does not hold the "admin" or "power" Splunk roles could register an arbitrary companion app and cause Splunk Secure Gateway to forward mobile us...
CVE-2026-76258 Use of Hard-coded Cryptographic Key through Companion App Registration in Splunk Secure Gateway
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who does not hold the "admin" or "power" Splunk roles could register an arbitrary companion app and cause Splunk Secure Gateway to forward mobile us...
CVE-2026-76258
Splunk Secure Gateway's companion app registration handler uses a hard-coded cryptographic key, allowing non-admin/power users to register arbitrary callback URLs and redirect mobile user tokens to attacker-controlled endpoints. Splunk fixed this in Secure Gateway 3.8.71, 3.9.24, and 3.10.10; Ent...
PT-2026-78730
Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Splunk Secure Gateway versions prior to 3.10.10 Splunk Secure Gateway...
CVE-2026-66061 Home Assistant: iOS Companion app forwards NFC/QR tag scans without confirmation, enabling silent automation execution
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.0, the iOS Companion app treats tag links NFC or QR delivered through an OS-level routing mechanism such as iOS universal links as if they were physically scanned, without validating the...
CVE-2026-59717
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the...
CVE-2026-9220
The CVE-2026-9220 entry describes a vulnerability in Setracker2 Android Companion App (package com.tgelec.setracker) affecting versions 3.1.5 and earlier. The underlying issue is that requests between the wearable and backend are encrypted with static, hardcoded AES keys and initialization vector...
CVE-2026-44698
Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.4.1 for iOS and 2026.4.4 for Android, he Home Assistant Companion apps for Android and iOS expose a JavaScript bridge to the in-app WebView window.externalApp on Android and...
CVE-2026-7978
Inappropriate implementation in Companion in Google Chrome on Mac prior to 148.0.7778.96 allowed a remote attacker to perform OS-level privilege escalation via malicious network traffic. Chromium security severity: Medium...
CVE-2026-7978
Inappropriate implementation in Companion in Google Chrome on Mac prior to 148.0.7778.96 allowed a remote attacker to perform OS-level privilege escalation via malicious network traffic. Chromium security severity: Medium...
CVE-2026-31993
OpenClaw versions prior to 2026.2.22 contain an allowlist parsing mismatch vulnerability in the macOS companion app that allows authenticated operators to bypass exec approval checks. Attackers with operator.write privileges and a paired macOS beta node can craft shell-chain payloads that pass...
EUVD-2026-13025
OpenClaw versions prior to 2026.2.22 contain an allowlist parsing mismatch vulnerability in the macOS companion app that allows authenticated operators to bypass exec approval checks. Attackers with operator.write privileges and a paired macOS beta node can craft shell-chain payloads that pass...
CVE-2026-31993 OpenClaw < 2026.2.22 - Allowlist Parsing Mismatch in system.run Shell Chains
OpenClaw versions prior to 2026.2.22 contain an allowlist parsing mismatch vulnerability in the macOS companion app that allows authenticated operators to bypass exec approval checks. Attackers with operator.write privileges and a paired macOS beta node can craft shell-chain payloads that pass...
NordicTrackExploit
QZCompanionNordictrackTreadmill Companion App of QZ for Nordic...
CVE-2025-48594
In onUidImportance of DisassociationProcessor.java, there is a possible way to retain companion application privileges after disassociation due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed...
CVE-2025-48594
Technical details for CVE-2025-48594 are not publicly available in the provided documents. No specifics on affected products, versions, root cause, or fixes are disclosed here. Monitor for updates from connected sources.
CVE-2025-48594
In onUidImportance of DisassociationProcessor.java, there is a possible way to retain companion application privileges after disassociation due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed...