109 matches found
Meta glasses caught recording conversations without wake phrase
Meta says it has resolved an issue after some Ray-Ban Meta owners reported that their glasses recorded conversations without the “Hey Meta” wake phrase. Users reported finding recordings and transcripts of conversations they did not knowingly save. Recording without anyone realizing raises privac...
Basecamp: Ordinary HEY user can make HEY originate authenticated mail from attacker-selected @hey.com addresses
A vulnerability was discovered in HEY's email service that allowed ordinary users to send authenticated emails from arbitrary HEY addresses without authorization. An attacker could create a temporary external account claiming any target HEY address using unrelated SMTP credentials, enqueue a...
Malicious code in hey-message-content (npm)
Source: ossf-package-analysis 82160038204459189291779030b0cd92dbe157e779d3b1cae48e25a84053ee9a The OpenSSF Package Analysis project identified 'hey-message-content' @ 8.99.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...
Basecamp: Open redirect on app.hey.com bypasses HEY desktop's internal-origin allowlist and loads attacker content inside a HEY BrowserWindow
A case-sensitive URL scheme comparison flaw in the proxy image endpoint allowed open redirects on the mail service's web domain. The endpoint failed to recognize uppercase HTTPS scheme variants and redirected users to unproxied URLs instead of properly proxying them. When combined with the deskto...
CVE-2026-33818 vulnerabilities
Vulnerabilities for packages: nri-nginx, argocd-image-updater, crane, crossplane-provider-family-aws, grafana-rollout-operator, knative-eventing, kapp-controller, crossplane-provider-keycloak, docker-credential-ecr-login, crossplane-provider-azure-sql, crossplane-provider-aws-s3,...
CVE-2026-56862 vulnerabilities
Vulnerabilities for packages: nri-nginx, argocd-image-updater, crane, crossplane-provider-family-aws, grafana-rollout-operator, knative-eventing, kapp-controller, crossplane-provider-keycloak, docker-credential-ecr-login, crossplane-provider-azure-sql, crossplane-provider-aws-s3,...
GO-2026-5972 vulnerabilities
Vulnerabilities for packages: nri-nginx, argocd-image-updater, crane, crossplane-provider-family-aws, grafana-rollout-operator, knative-eventing, kapp-controller, crossplane-provider-keycloak, docker-credential-ecr-login, crossplane-provider-azure-sql, crossplane-provider-aws-s3,...
GO-2026-6090 vulnerabilities
Vulnerabilities for packages: nri-nginx, argocd-image-updater, crane, crossplane-provider-family-aws, grafana-rollout-operator, knative-eventing, kapp-controller, crossplane-provider-keycloak, docker-credential-ecr-login, crossplane-provider-azure-sql, crossplane-provider-aws-s3,...
GO-2021-0238 vulnerabilities
Vulnerabilities for packages: k3d, grpcurl, hey, terraform-provider-sendgrid-fips, terraform-provider-sendgrid...
GO-2022-0236 vulnerabilities
Vulnerabilities for packages: k3d, grpcurl, hey, terraform-provider-sendgrid-fips, terraform-provider-sendgrid...
GO-2022-0197 vulnerabilities
Vulnerabilities for packages: hey...
GO-2022-0536 vulnerabilities
Vulnerabilities for packages: k3d, hey...
GO-2021-0113 vulnerabilities
Vulnerabilities for packages: k3d, hey, dynamic-localpv-provisioner-fips, gitleaks, vt-cli, dynamic-localpv-provisioner, terraform-provider-sendgrid-fips, terraform-provider-sendgrid...
GO-2022-0536 vulnerabilities
Vulnerabilities for packages: hey, k3d...
GO-2022-0197 vulnerabilities
Vulnerabilities for packages: hey...
GO-2021-0238 vulnerabilities
Vulnerabilities for packages: hey, k3d, terraform-provider-sendgrid, grpcurl...
GO-2022-0236 vulnerabilities
Vulnerabilities for packages: hey, k3d, terraform-provider-sendgrid, grpcurl...
GO-2022-1059 vulnerabilities
Vulnerabilities for packages: terraform-provider-sendgrid, k3d, php-fpmexporter, grpcurl, gitleaks, dynamic-localpv-provisioner, vt-cli, hey, kubeflow...