deep-C

Deep-C Deep-C is an Android Deep Link Exploitation Framework that automatically decompiles APKs, identifies exposed and insecure deep link entry points, validates exploitability using static analysis and optional AI verification , and generates executable adb Proof-of-Concepts PoCs. Deep-C is...

CVE-2026-26897-EcoOnline-DeepLink

EcoOnline EHS Android — ディープリンク検証バイパス → WebView オープンリダイレクト CVE-2026-26897 EcoOnline EHS Android アプリケーション com.airsweb.v10 におけるディープリンク検証バイパス CVE-2026-26897 に関する公開開示 / アドバイザリ。細工された ehs-app:// ディープリンクは https:// に書き換えられ、アプリが他のすべてのナビゲーションパスに適用しているホスト許可リストチェックなしで アプリのメイン WebView...

viber-desktop-html-injection

Viber Desktop — HTML インジェクション CVE-2025-55996 CVE: CVE-2025-55996 発見者: Thaw Khant Cycbake 製品: Viber Desktop 影響を受けるバージョン: Viber Desktop 25.6.0 およびそれ以前の可能性あり 概要 Viber Desktop のディープリンクハンドラー viber://forward?text= は、メッセージ作成/転送インターフェース内で text パラメーターに指定された未サニタイズの HTML...

CVE-2023-41898_Lab

CVE-2023-41898 Unvalidated Deep Link Lab Home Assistant Companion for Androidの公開脆弱性レポートGHSL-2023-142と脆弱バージョン 2023.8.2 のオープンソース構造に基づいて作成した、教育用の縮小再現Labです。 実際のHome Assistantサーバー・アカウント・トークンは使用しません。LABTOKENCVE202341898NOTREAL という固定の仮想トークンのみを公開します。 脆弱性の概要 対象: Home Assistant Companion for Android 影響バージョ...

CVE-2026-95815

OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persistent bearer keys to unified logs as public diagnostic data. Attackers who obtain diagnostic archives can recover unrotated keys and replay them in forged deep links to submit agent requests without local confirmation...

EUVD-2026-84862

OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persistent bearer keys to unified logs as public diagnostic data. Attackers who obtain diagnostic archives can recover unrotated keys and replay them in forged deep links to submit agent requests without local confirmation...

CVE-2026-95815

Versions of OpenClaw iOS prior to 2026.8.11 are vulnerable to credential exposure due to the application logging complete agent deep-link URLs to unified logs as public diagnostic data. These logs contain persistent bearer keys , which an attacker can recover from diagnostic archives to replay in...

CVE-2026-95815 OpenClaw iOS before 2026.8.11 Credential Exposure via Deep-Link URL Logging

OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persistent bearer keys to unified logs as public diagnostic data. Attackers who obtain diagnostic archives can recover unrotated keys and replay them in forged deep links to submit agent requests without local confirmation...

CVE-2026-95815 OpenClaw iOS before 2026.8.11 Credential Exposure via Deep-Link URL Logging

OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persistent bearer keys to unified logs as public diagnostic data. Attackers who obtain diagnostic archives can recover unrotated keys and replay them in forged deep links to submit agent requests without local confirmation...

CVE-2026-95815 OpenClaw iOS before 2026.8.11 Credential Exposure via Deep-Link URL Logging

OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persistent bearer keys to unified logs as public diagnostic data. Attackers who obtain diagnostic archives can recover unrotated keys and replay them in forged deep links to submit agent requests without local confirmation...

PT-2026-97056

Name of the Vulnerable Software and Affected Versions OpenClaw iOS versions prior to 2026.8.11 Description The application logs complete agent deep-link URLs, which include persistent bearer keys, to unified logs as public diagnostic data. Bearer keys are security tokens that grant access to a...

CVE-2026-95815: Insertion of Sensitive Information into Log File

OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persistent bearer keys to unified logs as public diagnostic data. Attackers who obtain diagnostic archives can recover unrotated keys and replay them in forged deep links to submit agent requests without local confirmation...

Security Bulletin: MaaS360 mobile apps (iOS and Android) are able to bypass authentication by using deep link from the browser.

Summary MaaS360 mobile apps iOS and Android are able to bypass authentication by using deep link from the browser. Vulnerability Details CVEID:CVE-2023-42021 DESCRIPTION: The MaaS360 iOS application could allow an attacker to bypass authentication mechanisms by exploiting the password reset...

Exploit for Code Injection in Home-Assistant Home_Assistant_Companion

CVE-2023-41898 Unvalidated Deep Link Lab Home Assistant Compa...

CVE-2026-59717 Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the...

CVE-2026-59717 Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the...

CVE-2026-66395 SiYuan Desktop before v3.7.2 Reflected XSS to RCE via siyuan Protocol

SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with...

CVE-2026-66395

SiYuan Desktop before v3.7.2 is affected by a reflected XSS in the bazaar plugin readme handler that enables RCE via a crafted siyuan:// deep link. An attacker can inject HTML payloads through the plugin name parameter, which render with insertAdjacentHTML in an insecure Electron renderer and gra...

EUVD-2026-49328

SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with...

CVE-2026-66395: Improper Neutralization of Input During Web Page Generation

SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with...