{"id":"CVE-2026-116105","title":"HeyCyan App Network Security Configuration AndroidManifest.xml cleartext transmission","summary":"A weakness has been identified in HeyCyan App 1.0.103 on Android. Affected is an unknown function of the file AndroidManifest.xml of the component Network Security Configuration. Executing a manipulation can lead to cleartext transmissio…","severity":"low","cvss":3.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:C","cvssSource":"cna","cwe":["CWE-319","CWE-310"],"product":"HeyCyan App","affected":["heycyan_app 1.0.103"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-26T15:38:25.014146Z"},"exploitAvailable":true,"published":"2026-10-26","updated":"2026-10-26","sourceUpdated":"2026-10-26T16:37:38.696Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116105","references":[{"url":"https://vuldb.com/vuln/426173","label":"VDB-426173 | HeyCyan App Network Security Configuration AndroidManifest.xml cleartext transmission"},{"url":"https://vuldb.com/vuln/426173/cti","label":"VDB-426173 | CTI Indicators (IOB, IOC, TTP, IOA)"},{"url":"https://vuldb.com/cve/CVE-2026-116105","label":"CVE-2026-116105 | CVE Analysis and Report"},{"url":"https://vuldb.com/submit/1002850","label":"Submit #1002850 | HeyCyan HeyCyan Android application 1.0.103 Cleartext Transmission of Sensitive Information"},{"url":"https://github.com/ohackercego/heycyan-vulnerabilitys"},{"url":"https://github.com/azurejoga/heycyan-vulnerabilitys"}],"tags":["cve.org","exploit-available"],"epss":0.0027,"epssPercentile":0.1908,"exploits":{"github":1,"githubRepos":["https://github.com/ohackercego/CVE-2026-116105"],"checkedAt":"2026-10-27T16:59:05.276Z"},"ingestedAt":"2026-10-26T02:13:26.479Z","slug":"CVE-2026-116105","body":"## Overview\n\nA weakness has been identified in HeyCyan App 1.0.103 on Android. Affected is an unknown function of the file AndroidManifest.xml of the component Network Security Configuration. Executing a manipulation can lead to cleartext transmission of sensitive information. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.\n\n## Affected\n\n- `heycyan_app 1.0.103`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":32,"depthScoreParts":{"impact":20.4,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":229192,"id":"CVE-2026-116105","ts":1792999281673,"field":"exploit_available","old":"false","new":"true"}]}