CVE-2026-66832

Mira Hormone Monitor, Mira Android App Use of GET request method with sensitive query strings

When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web properties, referrer logs, and any JavaScript running in the WebView context.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Quanovate Tech

Products

Mira Android App Mira Firmware

CVE-2026-64934

Mira Hormone Monitor, Mira Android App Reliance on untrusted inputs in a security decision

The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version from the device itself. An authenticated attacker could submit arbitrary firmware version strings for their own device, allowing them to evade vendor-side vulnerable-fleet analytics, suppress security update prompts to the user, and misrepresent patch-adoption metrics.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Quanovate Tech

Products

Mira Android App Mira Firmware

CVE-2026-66340

Mira Hormone Monitor, Mira Android App Improper restriction of excessive authentication attempts

The Mira cloud authentication endpoints do not enforce per-account rate limiting, per-IP throttling, or account lockout after repeated failed login attempts. An attacker can use brute-force methods to obtain gain access to user accounts.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Quanovate Tech

Products

Mira Android App Mira Firmware

CVE-2026-68067

Mira Hormone Monitor, Mira Android App Weak Authentication

The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and access hormone record information and account settings.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Quanovate Tech

Products

Mira Android App Mira Firmware

CVE-2026-67568

Mira Hormone Monitor, Mira Android App Use of Hard-coded Credentials

The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Quanovate Tech

Products

Mira Android App Mira Firmware

CVE-2026-67558

Mira Hormone Monitor, Mira Android App Authentication bypass by spoofing

The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token information and inject forged hormone measurements into the victim's cloud record and clinical trend view.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Quanovate Tech

Products

Mira Android App Mira Firmware

CVE-2026-66098

Mira Hormone Monitor, Mira Android App Missing authentication for critical function

The Mira hormone monitor device firmware accepts a 0x01 write from any BLE central without authentication, causing the device to reboot into bootloader mode. An attacker could cause a denial-of-service condition or disrupt ovulation tracking and fertility monitoring workflow.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Quanovate Tech

Products

Mira Android App Mira Firmware

CVE-2026-66875

Mira Hormone Monitor, Mira Android App Missing authentication for critical function

In the Mira hormone monitor device firmware v1.7.1.47 build 01070147, a remote unauthenticated attacker within BLE range (approximately 10–30 meters) can silently rebind the device to an attacker-controlled account, extract stored hormone measurements in cleartext, cause a denial-of-service via malformed or undocumented command opcodes, and passively track the user via a static random BLE address that never rotates.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Quanovate Tech

Products

Mira Android App Mira Firmware

CVE-2026-6484

Lack of verified boot to certain FV may cause arbitrary code execution

In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Insyde

Products

Insydeh2o

CVE-2026-9318

tablib versions prior to 3.10.0 Stored XSS via HTML Export Dataset Title

tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML output via the export_book method in the _html.py format handler. Attackers can rename worksheet sheets in imported files such as XLSX, ODS, XLS, or YAML with script payloads that are assigned to the Dataset title attribute and rendered unescaped inside an HTML h3 tag, leading to session hijacking, unauthorized administrative actions, and sensitive data exposure when the output is rendered in a browser.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Jazzband

Products

Tablib

CVE-2026-18961

Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect <= 1.4.3 - Unauthenticated Authentication Bypass via Spotify OAuth Callback

The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unverified Provider Email in all versions up to, and including, 1.4.3. This is due to the plugin trusting the unverified email field returned by Spotify's /v1/me endpoint as proof of mailbox ownership — Generic::normalize_common() copies this value into the normalized profile without requiring an email_verified assertion, and User_Links::link_or_login_user() subsequently passes it directly to get_user_by('email', $email) and issues a persistent authentication cookie via wp_set_auth_cookie() without a provider-specific verified-email gate, a local mailbox challenge, or a logged-in approval step. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including Administrators, by supplying a known target email address through a controlled Spotify OAuth flow, gaining full administrative access to the site.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Fahdaslam Wordpress

Products

Social Login, Passkeys, Magic Link & Email Otp – Passwordless Login By Ventraconnect Wordpress

CVE-2026-19426

FitSoft｜POS Sytstem - Missing Authentication

POS System developed by FitSoft has a Missing Authentication vulnerability. Unauthenticated remote attackers can directly access and operate the system.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Fitsoft

Products

Pos System

CVE-2026-67283

Joomla Extension - tabaoca.org - Improper ACL implementation allows allow file operations in Cotton Cloud < 2.0.2

Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud < 2.0.2 - Unauthenticated users could perform various file-related operations (read, delete, overwrite, re-assign permissions) on every file managed within the extension.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Tabaoca.org

Products

Cotton Cloud Extension For Joomla

CVE-2026-67284

Joomla Extension - tabaoca.org - Improper ACL checks allow file operations in Cotton Cloud < 2.0.2

Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud < 2.0.3 - Authenticated users could perform various file-related operations (read, delete, overwrite, re-assign permissions) on files owned by other users.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tabaoca.org

Products

Cotton Cloud Extension For Joomla

CVE-2026-11325

cloudflare/pages-action is deprecated — migration required by September 18th, 2026

Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in `src/index.ts` reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as CLOUDFLARE_API_TOKEN and GITHUB_TOKEN to an attacker. Because this repository has been deprecated since 2024, Cloudflare will not be issuing patches. To remediate this issue, we recommend migrating to `cloudflare/wrangler-action` immediately. Consumers who have already migrated are not affected. Sunset Date The cloudflare/pages-action repository will be removed on 2026-09-18. Consumers must complete migration before 18th September to avoid CI disruption. Affected Versions All published versions of cloudflare/pages-action, including consumers pinned to the v1 moving tag. Patched Versions None. This repository will not receive further updates, including security patches. Resolution / Migration Path Migrate all workflows using cloudflare/pages-action to `cloudflare/wrangler-action` before 2026-09-18. Refer to the wrangler-action README for the equivalent step configuration and migration guidance. Credit Thanks to @agentka99 and @beg1nn3r for reporting their findings via Cloudflare's HackerOne program that informe

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Cloudflare

Products

Pages-action

CVE-2026-16999

XXE in Ministry of Justice's UYAP Document Editor

Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking. This issue affects UYAP Document Editor: from 4.5.17 before 5.4.17.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ministry Of Justice

Products

Uyap Document Editor

CVE-2026-49262

Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy

In the Aimeos Pagible content management system prior to version 0.10.4, the administrative proxy route (`cmsproxy`) is vulnerable to a Server-Side Request Forgery (SSRF) attack via DNS Rebinding. A Time-of-Check to Time-of-Use (TOCTOU) race condition exists between the URL validation phase and the actual HTTP request phase, allowing attackers to access internal network resources and cloud metadata endpoints. Version 0.10.4 fixes the issue.

CVSS 3.1 · 3 Low EPSS < 1% KEV · Not listed

Vendors

Aimeos

Products

Pagible

CVE-2026-73374

Stored Cross-Site Scripting (XSS) via Unescaped CNA Reference Tags in vulnerability-lookup

A stored cross-site scripting (XSS) vulnerability existed in Vulnerability-Lookup in the render_tag_badges Jinja filter used to display reference tags associated with vulnerability records. Values from containers.cna.references[].tags[] were directly interpolated into HTML badge elements and the resulting string was wrapped in markupsafe.Markup. Because Markup marks the generated content as safe, Jinja's automatic HTML escaping was bypassed. An authenticated user with permissions to create or modify vulnerability records, such as a user holding the vulnerability:create or vulnerability:modify permission, could submit a crafted reference tag through the CNA API containing arbitrary HTML or JavaScript-capable markup. The malicious value would subsequently be stored as part of the vulnerability record. When another user visited the corresponding public /cve/<id> or /vuln/<id> page, the crafted tag would be rendered as HTML in the viewer's browser. This could result in JavaScript execution in the security context of the Vulnerability-Lookup application. Successful exploitation could allow an attacker to perform actions in the context of a victim, access information available to the victim's browser session, or modify page content. As the affected vulnerability pages can be accessed publicly, exploitation may affect users who are not authenticated. The issue was corrected by applying markupsafe.escape() to each reference tag before inserting it into the HTML badge markup, while retaining Markup only for the static HTML scaffolding.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Circl

Products

Vulnerability-lookup

CVE-2026-73405

Authorization Bypass in SSE Pub/Sub Allows Unconfirmed Accounts to Access Stream Events in vulnerability-lookup

An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accounts to subscribe to Server-Sent Events (SSE) streams through the /pubsub/subscribe/<topic> endpoint. The token_required decorator used by the Pub/Sub interface authenticated requests solely by matching the X-API-KEY header against an existing user API key. Unlike the REST API authentication mechanism, it did not verify the account's is_active and is_confirmed state. Because the self-registration process issues an API key before account confirmation is completed, an attacker could create an account and immediately use the resulting API key to access Pub/Sub topics that should only be available to active, confirmed users. This could expose stream events that would otherwise be inaccessible through the REST API, including newly submitted or not-yet-moderated data such as comments. The vulnerability results from inconsistent authorization enforcement between the REST API and the SSE streaming interface. The patch corrects the issue by requiring accounts to be both active and confirmed before permitting access to Pub/Sub streams, bringing the SSE authorization boundary in line with the REST API.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Circl

Products

Vulnerability-lookup

CVE-2026-73431

Reusable Account Activation and Recovery Tokens Allow Repeated Account Takeover in vulnerability-lookup

Vulnerability-Lookup contains an authentication weakness in its account activation and password-recovery mechanism. Activation and recovery links were generated using stateless signed tokens containing only the user's login. Although the token signature and age were validated, the application did not track whether a token had already been successfully used. As a result, a captured activation or password-recovery link remained valid for the entire configured TOKEN_VALIDITY_PERIOD, even after the associated password had been changed. An attacker who obtains a valid activation or recovery token could therefore replay it multiple times during its validity period to set a new password and repeatedly take control of the affected account. In addition, tokens were not bound to a specific purpose, allowing the same token mechanism to be used across activation and recovery workflows. The patch introduces purpose-bound tokens and a random nonce whose SHA-256 digest is stored with the user account. The nonce is invalidated after a successful password change, making tokens single-use, while issuing a new token invalidates any previously issued token. The password-setting operation now explicitly consumes the token before committing the account change. Successful exploitation requires the attacker to obtain a currently valid activation or recovery link, but does not require knowledge of the victim's existing password or an authenticated session.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Circl

Products

Vulnerability-lookup