Account takeover via insecure intent handling Analysed #2516732 Valid Deserialization and Object Injection Medium 2024-05-30 – 136 Any installed app can force immediate logout and persistent DOS of authenticated Basecamp sessions via unprotected exported StartActivity Analysed #3764217 Valid Access Control Medium 2026-07-04 – 104 stored XSS in hey.com message content Analysed #988272 Valid Cross-site Scripting Medium 2020-10-31 – 80 Subdomain Takeover due to ████████ NS records at us-east4.37signals.com Analysed #1342422 Valid Information Disclosure Medium 2021-09-17 – 77 Path traversal in deeplink query parameter can expose any user's private info to a public directory (one click) Analysed #2553411 Valid File and Path Handling Medium 2024-07-09 – 65 Link unfurling calls out to arbitrary URLs and the private-network guard misses link-local addresses Analysed #3445890 Valid Server-Side Request Forgery Medium 2025-12-22 – 62 DNS Setup allows sending mail on behalf of other customers Analysed #981824 Valid Misconfiguration and Insecure Design Medium 2021-02-21 – 58 Bypass of image rewriting / tracking blocker via srcset Analysed #1021885 Valid Information Disclosure Medium 2020-12-03 $1,000 56 Critical Data Breach - Big Data for all domains Analysed #2686225 Valid No weakness recorded Medium 2025-01-14 – 53 Premium Email Address Check Bypass - Hey Analysed #963774 Valid Input Validation and Logic Medium 2020-12-15 – 53 Open redirect on app.hey.com bypasses HEY desktop's internal-origin allowlist and loads attacker content inside a HEY BrowserWindow #3972760 Valid Open Redirect Medium 2026-10-15 – 33 Navgraph confusion allows any 3p app to send and read requests from the server at app.hey.com Analysed #2552879 Valid Deserialization and Object Injection Medium 2024-07-09 – 31 Lack of quarantine macOS attribute(com.apple.quarantine) leads multiple issues including RCE Analysed #1019389 Valid No weakness recorded Medium 2021-04-22 $250 29 Improper Authentication via previous backup code login #1485788 Valid Authentication Medium 2022-03-24 – 24 Bypass Tracking Blocker Protection Using Slashes Without Protocol On The Image Source. #1050656 Valid No weakness recorded Medium 2020-12-17 – 17 SSL expired subdomain leads to API swap with main and flagged cookies. Unable to log device ids and certain session tokens. #1024880 Valid Authentication Medium 2020-12-03 – 15