Tuya App vulnerabilities

• octo-sts app Octo STS discloses trust policy contents to unauthorized callers via Exchange error messages CVE-2026-105770 5.3 MediumNovember 3, 2026
• topluyo app Topluyo Desktop for Linux has an OS Command Injection issue CVE-2026-115904 Public exploit 9.6 CriticalOctober 28, 2026
• @tinacms app, tinacms +1 more TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment CVE-2026-108261 Fix available 9.3 CriticalOctober 9, 2026
• redwoodjs sdk, tuya app +1 more Tuya App/SDK JSON Data Point denial of service CVE-2026-3465 Disputed 2.3 LowMarch 3, 2026
• octo-sts app Octo-STS Vulnerable to Unauthenticated SSRF with HTTP Response Reflection in OIDC Flow CVE-2025-52477 Fix available 8.6 HighJune 26, 2025
• signal app, signal +1 more Signal App Biometric Authentication missing critical step in authentication CVE-2025-5715 1.0 LowJune 6, 2025
• blackvue app BlackVue App API deviceDelete get request method with sensitive query strings CVE-2025-2356 6.3 MediumMarch 17, 2025
• blackvue app BlackVue App API Endpoint credentials storage CVE-2025-2355 4.8 MediumMarch 17, 2025
• octo-sts app octo-sts allows unauthenticated attackers to cause unbounded CPU and memory usage CVE-2024-34079 Fix available 3.7 LowMay 10, 2024
• klapp app Klapp App JSON Web Token improper authentication CVE-2020-36533 3.7 LowJune 3, 2022
• klapp app Klapp App Authorization Credentials information disclosure CVE-2020-36532 4.3 MediumJune 3, 2022