"Piccoma" App for Android and iOS versions prior to 6.20.0 uses a hard-coded API key for an external service, which may allow a local attacker to obtain the API key.
CVSS 3.1MEDIUM 4.0·Local·No auth·No interaction·EPSS 0.00169·Published 2024-07-01·Fixed in 6.20.0CWE-798