Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: Joyland Clear all filters
TI-2026-65461 CVE-2026-102671 · GHSA-vgxg-97fh-vqcv

Joyland AI WebView accepts invalid SSL certificates

Priority LOW 35

The Joyland AI app accepts invalid SSL certificates in the invisible advertisement WebView by default.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00129 Published 2026-10-01 No fix listed CWE-295
TI-2026-65460 CVE-2026-102670 · GHSA-ccrc-wwj2-gmgv

Joyland AI enables HTTP

Priority LOW 23

Joyland AI app explicitly permits cleartext HTTP traffic on Android 9+ where the default is to block it.

CVSS 4.0MEDIUM 5.3 Adjacent network No auth No interaction EPSS 0.00106 Published 2026-10-01 No fix listed CWE-319
TI-2026-65459 CVE-2026-102669 · GHSA-3v5q-8wpg-2hx4

Joyland AI hostname checking disabled

Priority LOW 36

Joyland AI app does not verify hostnames, allowing a malicious host to connect or intercept chat messages.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00183 Published 2026-10-01 No fix listed CWE-297
TI-2026-65457 CVE-2026-102667 · GHSA-9jq9-g952-299j

Joyland AI WebView command injection

Priority MEDIUM 40

Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView.

CVSS 4.0CRITICAL 9.0 Adjacent network No auth No interaction EPSS 0.00187 Published 2026-10-01 No fix listed CWE-749
TI-2026-65456 CVE-2026-102666 · GHSA-pqc3-2xg8-vj54

Joyland AI hard-coded credentials for push notifications

Priority LOW 36

The Joyland AI app contains hard-coded credentials for the GeTui push notification service, allowing an attacker to access the GeTui REST API and send push notifications containing arbitrary content to any user, group of…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00166 Published 2026-10-01 No fix listed CWE-798