Search vulnerabilities

Expected end of text, found '–' (at char 43), (line:1, col:44)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,461

CVE-2026-50082

Aqara Developer Portal insecure authentication token

The Aqara Cloud Developer Portal (developer.aqara.com) issued a developer token to any email address supplied by the attacker. This is an instance of "CWE-306: Missing Authentication for Critical Function" with an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (6.5 Medium). When combined with CVE-2026-50083, CVE-2026-50084, and CVE-2026-50085, any otherwise-unauthenticated attacker could execute a full takeover of affected devices.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Aqara
Products
Cloud Developer Portal
CVE-2026-50083

Aqara hardcoded OAuth client credentials

The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, which is an instance of "CWE-798: Use of Hard-coded Credentials." This issue has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 Critical). When combined with CVE-2026-50082, CVE-50084, and CVE-50085, this can lead to a fully unauthenticated, remote takeover of affected devices.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Aqara
Products
Aquara Iam/sso Gateway Iam\/sso Gateway
CVE-2026-50084

Aqara API cross-account access

The Aqara Cloud Production API (open-cn.aqara.com/v3.0/open/api) would authorize any valid developer token for access to any account. This is an instance of "CWE-862: Missing Authorization" with an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N (9.6 Critical). When combined with CVE-2026-50082, CVE-50083, and CVE-50085, this can lead to a fully unauthenticated, remote takeover of affected devices.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Aqara
Products
Cloud Production Api
CVE-2026-50085

Aqara Board IoT insecure debug API

The Aqara Board service (op-test.aqara.com) accepts arbitrary MQTT command payloads, and forwards them to the platfom's HiveMQ broker without authentication. This is an instance of "CWE-306: Missing Authentication for Critical Function" and has an estimated CVSS ofCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L (8.6 High). When combined with CVE-2026-50082, CVE-50083, and CVE-50084, this can lead to a fully unauthenticated, remote takeover of affected devices.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Aqara
Products
Board Service
CVE-2026-50086

Aqara unauthenticated AES oracle

The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes bidirectional AES round-trups against the platform's signing key without authentication. This is an instance of "CWE-306: Missing Authentication for Critical Function" and "CWE-327: Use of a Broken or Risky Cryptographic Algorithm," and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High).

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Aqara
Products
Aqara Iam/sso Gateway Iam\/sso Gateway
CVE-2026-50087

Aqara IAM/SSO Gateway cross-origin resource sharing

The Aqara IAM/SSO gateway (gw-builder.aqara.com) exhibits a cross-origin request sharing vulnerability, which is an instance of "CWE-942: Permissive Cross-domain Policy with Untrusted Domains," and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N (8.2 High).

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Aqara
Products
Aqara Iam/sso Gateway Iam\/sso Gateway
CVE-2026-50088

Aqara Developer Portal cross-origin resource sharing

The Aqara Developer Portal (developer.aqara.com) and shared test environments (developer-test.aqara.com, aiot-test.aqara.com) exhibit cross-origin request sharing, which is an instance of "CWE-942: Permissive Cross-domain Policy with Untrusted Domains," and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N (8.2 High).

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Aqara
Products
Aqara Developer Portal Aqara Developer Test Portal Developer Portal
CVE-2026-50089

Aqara IAM/SSO Gateway open redirect

The Aqara IAM/SSO Gateway (gw-builder.aqara.com) provides an open redirect, which is an instance of "CWE-601: URL Redirection to Untrusted Site," with an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (6.1 Medium), which can be used to set up a phishing attack.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Aqara
Products
Aqara Iam/sso Gateway Iam\/sso Gateway
CVE-2026-50090

Aqara OAuth redirect_uri validation bypass

The Aqara Cloud OAuth Authorization Endpoint (open-cn.aqara.com/oauth/authorize) is vulnerable to a redirect bypass due to lax controls on domain matching, which is an instance of "CWE-1289: Improper Validation of Unsafe Equivalence in Input" and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N (9.3 Critical).

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Aqara
Products
Cloud Oauth Authorization Endpoint
CVE-2026-50091

Aqara Home Android SDK hardcoded keys

Aqara Home Android (com.lumiunited.aqarahome) 6.0.0 (and white-label clients embedding the same liblumidevsdk.so) uses hard-coded cryptographic keys, which is an instance of "CWE-321: Use of Hard-coded Cryptographic Key" and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 Critical).

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Aqara
Products
Com.lumiunited.aqarahome Home
CVE-2026-53981

Cap-go < v12.128.2 Account Takeover via Unauthenticated Email Change Mechanism

Cap-go prior to 12.128.2 contains an account takeover vulnerability in its email change mechanism that allows an attacker with temporary authenticated session access to change the registered email address without re-authentication such as password or MFA verification. Attackers can redirect verification to an attacker-controlled email address and subsequently perform a password reset to permanently take over the victim's account.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Cap-go
Products
Cap-go
CVE-2026-3840

Path Traversal in kedro-org/kedro

A vulnerability in Kedro version 1.2.0 allows an attacker to exploit path traversal by providing a crafted version string. The `_get_versioned_path()` method in `kedro/io/core.py` directly interpolates user-supplied version strings into filesystem paths without sanitization. This enables an attacker to escape the intended versioned dataset directory and access files outside the expected path. The issue is also reachable through the CLI via the `--load-versions` parameter, as `_split_load_versions()` in `kedro/framework/cli/utils.py` does not validate the version string. This vulnerability can lead to unauthorized file reads, data poisoning, cross-project or cross-tenant data access, and broader downstream impacts in environments where Kedro is used with automation or orchestration layers.

CVSS 3.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Kedro-org Linuxfoundation
Products
Kedro Kedro
CVE-2026-47225

Improper Search Cache Isolation for Scoped Search API Keys in Typesense

Typesense is a fast, typo-tolerant search engine. Prior to versions 29.1 and 30.2, there is a cache isolation issue affecting search requests that use both server-side search result caching and Scoped Search API Keys. Under specific request ordering, cached search results could be reused across requests with different Scoped Search API Key constraints. This could result in a request receiving search results that should have been restricted by its Scoped Search API Key. This issue only affects search requests that use both server-side search result caching and Scoped Search API Keys with embedded filters to restrict access to search results within a collection. This vulnerability may result in unintended disclosure of search results across scoped authorization contexts. This issue has been patched in versions 29.1 and 30.2.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Typesense
Products
Typesense
CVE-2026-47216

Typesense: Unauthenticated Denial of Service in the Typesense /multi_search Endpoint

Typesense is a fast, typo-tolerant search engine. Prior to versions 29.1 and 30.2, there is an unauthenticated denial-of-service vulnerability in the /multi_search endpoint. A specially crafted request can trigger an unhandled exception during request processing, causing the server process to terminate. This issue can be exploited over the network without authentication and results in service unavailability. The duration of impact may vary depending on system configuration and dataset size. This issue has been patched in versions 29.1 and 30.2.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Typesense
Products
Typesense
CVE-2026-28742

Naxclow IoT Platform Use of hard-coded cryptographic key

Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt embedded in every firmware image. Once this salt is recovered from any device, an attacker can generate valid signatures for arbitrary device or account operations due to the absence of per-device keys, server-side nonce tracking, or replay protections. Combined with the system’s use of plain HTTP for control-plane traffic, the construction enables broad request forgery and impersonation across the platform.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Naxclow
Products
Ix Cam Smart Doorbell X3 V720 and 1 more
CVE-2026-50101

Naxclow IoT Platform Not using password aging

Naxclow devices use a server-side, per-device relay credential that never rotates and is re-issued to the device on each boot. Because this credential remains valid indefinitely and cannot be reset or revoked by the legitimate owner, any party that obtains it through any exposure path can maintain persistent access to the device’s relay channel. This enables long-term impersonation or interception, even after factory resets or re-onboarding.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Naxclow
Products
Ix Cam Smart Doorbell X3 V720 and 1 more
CVE-2026-50108

Naxclow IoT Platform Missing Authorization

The Naxclow platform API that returns device relay registration details exposes a persistent credential without verifying that the requester is the legitimate device or owner. An actor able to present a platform-valid request signature can retrieve credentials for arbitrary devices and register on the relay as that device, enabling interception and disruption of its communications.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Naxclow
Products
Ix Cam Smart Doorbell X3 V720 and 1 more
CVE-2026-42947

Naxclow IoT Platform Authorization bypass through User-Controlled key

A flaw in Naxclow's platform’s onboarding workflow allows an attacker to replay a confirm-then-bind sequence to silently reassign a device to an arbitrary account. Because the affected endpoints validate request signatures but do not confirm legitimate ownership, an attacker with any account can take over a device without user interaction while the device remains online and unaware.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Naxclow
Products
Ix Cam Smart Doorbell X3 V720 and 1 more
CVE-2026-42932

Naxclow IoT Platform Generation of Predictable Numbers or Identifiers

Naxclow device identifiers use fixed manufacturing prefixes combined with sequential counters, producing a fully predictable and enumerable identifier space. Because the platform also exposes an endpoint that reveals the current identifier high-water mark, the active fleet can be enumerated.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Naxclow
Products
Ix Cam Smart Doorbell X3 V720 and 1 more