{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/canvoki-versioncode-14/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:canvoki:canvoki:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-107017"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["canvoki (versionCode 14)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["canvoki"],"content_html":"\u003cp\u003eCVE-2026-107017 identifies an insecure permission vulnerability in the ShortcutDispatchActivity component of canvoki versionCode 14. This flaw allows unauthorized attackers to arbitrarily trigger automated actions configured by other users. The vulnerability has a CVSS v3.1 base score of 9.1.\u003c/p\u003e\n","date_modified":"2026-10-30T19:37:04Z","date_published":"2026-10-30T19:37:04Z","id":"https://feed.craftedsignal.io/briefs/2026-10-canvoki-insecure-permissions/","summary":"An insecure permission vulnerability in the ShortcutDispatchActivity component of canvoki version 14 allows unauthorized attackers to arbitrarily trigger another user's configured automated actions.","title":"canvoki: Unauthorized automated action triggering (CVE-2026-107017)","url":"https://feed.craftedsignal.io/briefs/2026-10-canvoki-insecure-permissions/"}],"language":"en","title":"CraftedSignal Threat Feed - Canvoki (VersionCode 14)","version":"https://jsonfeed.org/version/1.1"}