LY Corporation vulnerabilities
Published CVEs affecting LY Corporation products: 8 record(s), with severity, exploitation and fixes.
CVE-2026-11751
Critical · 9.1
Aug 18, 2026
A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS…
A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabled, allowing man-in-the-middle attacks against xDS-managed upstream connections.
CVE-2026-13133
High · 8.4
CWE-427 Aug 10, 2026
Uncontrolled Search Path Element in LY Corporation LINE for Windows
A vulnerability has been identified in LineInst.exe (LINE for Windows) prior to version 26.4.0, where Msftedit.dll is loaded via a relative path without a secure DLL search path, allowing a malicious DLL placed in the installer's directory to be loaded ahead of the legitimate System32 copy.
CVE-2026-16881
High · 8.7
Aug 4, 2026
A code injection vulnerability exists in the LINE Android app prior to version 26.7.2…
A code injection vulnerability exists in the LINE Android app prior to version 26.7.2.
The profile rendering component does not adequately validate or sandbox externally supplied script content embedded in profile templates.
As a result, an attacker who is able to place crafted content in a profile could cause unintended code to execute with the application's privileges when a victim views that profile.
A server-side mitigation has been deployed that also protects existing Android clients that have not been updated to version 26.7.2.
CVE-2026-11748
Medium · 6.9
CWE-90 Jun 22, 2026
LDAP Injection in LY Corporation Central Dogma
A vulnerability has been identified in centraldogma-server-auth-shiro versions prior to 0.84.0, where the SearchFirstActiveDirectoryRealm substitutes the login username into an LDAP search filter without neutralizing LDAP filter metacharacters, allowing an unauthenticated attacker to manipulate the filter to cause authentication confusion and enumerate the directory structure.
CVE-2026-11746
Critical · 9.4
CWE-798 Jun 22, 2026
centraldogma-server hard-coded default secret in ZooKeeper replication (CVE-2026-11746)
A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where enabling ZooKeeper replication without setting replication.secret causes the server to silently fall back to a hard-coded, publicly known secret. This default credential authenticates the embedded ZooKeeper ensemble, allowing an attacker with network access to read the full replication log or join the quorum and execute arbitrary replicated commands across the cluster.
CVE-2026-11745
High · 8.8
CWE-322 Jun 22, 2026
A vulnerability has been identified in centraldogma-server-mirror-git versions prior to…
A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections, allowing an on-path attacker to perform man-in-the-middle attacks and compromise mirrored repositories.
CVE-2026-11752
Medium · 5.9
Jun 19, 2026
A vulnerability has been identified in armeria-xds versions 1.38.0 through 1.39.0, where…
A vulnerability has been identified in armeria-xds versions 1.38.0 through 1.39.0, where DataSourceStream in the xDS module can resolve control-plane-supplied filenames and environment variables without restriction, allowing a compromised or semi-trusted xDS control plane to read arbitrary local files and environment variables on the xDS client host.
CVE-2026-3861
Medium · 6.5
CWE-451 Apr 16, 2026
LINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app…
LINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app browser where opening a crafted web page can repeatedly trigger OS-level dialogs due to insufficient safeguards when handling arbitrary URL schemes, potentially causing the iOS device to become temporarily inoperable.