CVE-2025-56400

Cross-Site Request Forgery CSRF vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smart and Smartlife mobile applications, as well as other third-party applications that integrate the SDK, allows an attacker to link their own Amazon Alexa accoun...

MAL-2025-191331 Malicious code in @voiceflow/alexa-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2a57c4900c522a4ebbd888c0fac2f59b4f5078a7fd20a124d4b46f6329b5161 The package @voiceflow/alexa-types was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199431

Malicious code in @voiceflow/alexa-types npm...

Malicious code in @voiceflow/alexa-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2a57c4900c522a4ebbd888c0fac2f59b4f5078a7fd20a124d4b46f6329b5161 The package @voiceflow/alexa-types was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-198984

Cross-Site Request Forgery CSRF vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smart and Smartlife mobile applications, as well as other third-party applications that integrate the SDK, allows an attacker to link their own Amazon Alexa accoun...

CVE-2025-56400

Cross-Site Request Forgery CSRF vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smart and Smartlife mobile applications, as well as other third-party applications that integrate the SDK, allows an attacker to link their own Amazon Alexa accoun...

CVE-2025-56400

Cross-Site Request Forgery CSRF vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smart and Smartlife mobile applications, as well as other third-party applications that integrate the SDK, allows an attacker to link their own Amazon Alexa accoun...

CVE-2025-56400: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smart and Smartlife mobile applications, as well as other third-party applications that integrate the SDK, allows an attacker to link their own Amazon Alexa accoun...

CVE-2025-56400

A Cross-Site Request Forgery (CSRF) vulnerability exists in the OAuth implementation of the Tuya SDK version 6.5.0 for Android and iOS. This affects the Tuya Smart and Smartlife mobile applications, along with other third-party applications integrating the SDK. The root cause is a failure to vali...

CVE-2025-56400

Cross-Site Request Forgery CSRF vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smart and Smartlife mobile applications, as well as other third-party applications that integrate the SDK, allows an attacker to link their own Amazon Alexa accoun...

CVE-2025-56400

Cross-Site Request Forgery CSRF vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smart and Smartlife mobile applications, as well as other third-party applications that integrate the SDK, allows an attacker to link their own Amazon Alexa accoun...

PT-2025-47957

Name of the Vulnerable Software and Affected Versions Tuya SDK version 6.5.0 Tuya Smart application Smartlife application Description A Cross-Site Request Forgery CSRF issue exists in the OAuth implementation of the Tuya SDK. This affects the Tuya Smart and Smartlife mobile applications, as well ...

django-alexa (0.0.9), katka-core (>=0.5.0, <=0.8.0) +2 more potentially affected by CVE-2025-64459 via django (2.1.5)

django PYPI version 2.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-alexa 0.0.9 - katka-core =0.5.0, =1.0.0rc9, =1.0.0 Source cves: CVE-2025-64459 Source advisory: OSV:GHSA-FRMV-PR5F-9MCR...

django-alexa (0.0.9), katka-core (>=0.5.0, <=0.8.0) +2 more potentially affected by CVE-2025-64458 via django (2.1.5)

django PYPI version 2.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-alexa 0.0.9 - katka-core =0.5.0, =1.0.0rc9, =1.0.0 Source cves: CVE-2025-64458 Source advisory: OSV:GHSA-QW25-V68C-QJF3...

EUVD-2022-30449

Malicious code in bioql PyPI...

EUVD-2023-37416

Malicious code in bioql PyPI...

CVE-2025-55625

An open redirect vulnerability in Reolink v4.54.0.4.20250526 allows attackers to redirect users to a malicious site via a crafted URL. NOTE: this is disputed by the Supplier because it is intentional behavior that supports redirection to Alexa URLs, which are not guaranteed to remain at the same...

aioboto3 (6.0.0), ais-dom (>=0.72.9, <=0.80.4) +228 more potentially affected by CVE-2025-50181 via urllib3 (1.23.0)

urllib3 PYPI version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on urllib3 and may be impacted: - aioboto3 6.0.0 - ais-dom =0.72.9, =1.0.0, =0.1.0, =0.0.57, =0.4.0, =1.16.0, =0.18.0, =0.0.1, =0.3.0, =0.1.74, =0.1.80, =1.0.15 and more Source...

django-alexa (0.0.9), katka-core (>=0.5.0, <=0.8.0) +2 more potentially affected by CVE-2025-48432 via django (2.1.5)

django PYPI version 2.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-alexa 0.0.9 - katka-core =0.5.0, =1.0.0rc9, =1.0.0 Source cves: CVE-2025-48432 Source advisory: OSV:GHSA-7XR5-9HCQ-CHF9...

CVE-2023-33248

Amazon Alexa software version 8960323972 on Echo Dot 2nd generation and 3rd generation devices potentially allows attackers to deliver security-relevant commands via an audio signal between 16 and 22 kHz often outside the range of human adult hearing. Commands at these frequencies are essentially...