CVE-2026-11847

Integration Corp｜iVEC-IEI Virtualization Edge Computer - Arbitrary File Deletion

The  iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has a Path Traversal vulnerability, allowing authenticated remote attackers to exploit this vulnerability to create directories in unintended system paths.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Iei Integration Corp

Products

Ivec Tank-xm811

CVE-2026-11848

IEI Integration Corp｜ iRM-IEI Remote Management - Missing Authentication

The iRM-IEI Remote Management developed by IEI Integration Corp has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to exploit a specific functionality to obtain partial system configuration information.

CVSS 4.0 · 7.9 High EPSS < 1% KEV · Not listed

Vendors

Iei Integration Corp

Products

Irm-tsi410x

CVE-2026-11849

IEI Integration Corp｜iRM-IEI Remote Management - Hard-coded Credentials

The  iRM-IEI Remote Management developed by IEI Integration Corp has a Hardcoded Credentials vulnerability, allowing unauthenticated remote attackers to exploit hard-coded credentials to gain administrative privileges on the database.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Iei Integration Corp

Products

Irm-tsi410x

CVE-2026-47196

Quest Bot: Empty automod rule causes every guild message to be deleted

Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the automod add command trims user input but does not reject an empty result. Adding a rule containing only whitespace stores an empty word. The message listener later checks content.includes(""), which is always true, causing the bot to delete every non-bot guild message. This issue has been patched in version 1.1.6.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Duck-organization

Products

Questbot

CVE-2026-47195

Quest Bot: Per-channel permission overwrite bypass in purge and slowmode commands.

Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the purge and slowmode commands check only guild-level permissions on the invoking member. They do not check the member’s effective permissions in the channel where the command is run. A user denied channel-level moderation permissions can still delete messages or change slowmode through the bot. This issue has been patched in version 1.1.6.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Duck-organization

Products

Questbot

CVE-2026-48485

Quest Bot: Stored warn reasons can still trigger bot-powered mass mentions through `/warns`.

Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the latest release suppresses mentions when creating, unbanning, unwarning, kicking, muting, and unmuting, but stored warning reasons are still printed by /warns without mention suppression. A moderator can create a warning with @everyone or @here in the reason, then make the bot later output that reason through /warns, causing a mass ping if the bot has permission. This issue has been patched in version 1.1.6.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Duck-organization

Products

Questbot

CVE-2026-49347

Quest Bot: Ticket creation has no per-user open-ticket limit or cooldown

Quest Bot is an opensource Discord Bot. Prior to version 1.1.8, any user who can access the ticket panel can repeatedly create new ticket channels. The latest release still creates a new database ticket and Discord channel for every completed ticket modal submission, without checking whether the same user already has an open ticket and without applying a cooldown. This issue has been patched in version 1.1.8.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Duck-organization

Products

Questbot

CVE-2017-20240

Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks

Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks. These versions use Perl's built-in eq comparison. Discrepancies in timing could be used to guess the underlying derived-key.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Arodland

Products

Crypt::pbkdf2

CVE-2026-11879

Arbitrary code execution in MobaXterm Personal Edition (Portable)

MobaXterm Personal Edition (Portable), in its 26.3 version (Build 5154), allows arbitrary code execution by loading malicious DLLs from a temporary directory that is predictable and can be modified by the user. During startup, the application searches for specific DLLs in this location before resorting to the system’s secure paths, enabling an attacker with local access to place a specially crafted DLL to be executed automatically when the victim launches the application.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Mobatek

Products

Mobaxterm Personal Edition Mobaxterm Personal Edition Portable

CVE-2026-11967

Arbitrary code execution in MobaXterm Personal Edition (Portable)

MobaXterm Personal Edition (Portable), in its 26.3 version (Build 5154), allows arbitrary code execution by loading a malicious DLL located in the same directory as the portable executable. Because the application automatically loads the winspool.drv library from that location during startup, an attacker with local access can place a specially crafted DLL alongside the executable to be executed when the victim launches the application.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Mobatek

Products

Mobaxterm Personal Edition Mobaxterm Personal Edition Portable

CVE-2026-6853

OTP Bypass in Başbelen Group's Pause+ Mobile App

Improper restriction of excessive authentication attempts vulnerability in Başbelen Group Food Cafe Businesses Industry and Trade Ltd. Co. Pause+ Mobile App allows Authentication Bypass. This issue affects Pause+ Mobile App: from v1.0.6 before v1.5.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Basbelen Group

Products

Pause+ Mobile App

CVE-2026-7368

Yarbo Android/iOS Mobile Application and Cloud Infrastructure Missing Authorization

The Yarbo cloud does not enforce per-device or per-user authorization. Any client possessing valid credentials, whether the shared hard-coded credentials or legitimate per-user credentials, can subscribe to wildcard topics covering all robots globally, and can publish to any robot's command topic using only the robot's serial number (disclosed in the telemetry stream). Even after removal of hard-coded credentials from the app, a single compromised credential could still provide fleet-wide access without per-device access controls.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Yarbo

Products

Yarbo Android/ios Mobile Application Yarbo Cloud Mqtt Infrastructure

CVE-2026-10557

Yarbo Android/iOS Mobile Application and Cloud Infrastructure Use of Hard-coded Credentials

The Yarbo Android and iOS applications contain hard-coded MQTT broker credentials that are identical for all users and all devices. These credentials are embedded in the application binary and are readily extractable via APK decompilation. The credentials provide access to cloud MQTT brokers carrying real-time telemetry for the entire global Yarbo robot fleet. They allow both wildcard subscription to all robot telemetry topics and publishing to any robot's command topic using only the robot's serial number.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Yarbo

Products

Yarbo Android/ios Mobile Application Yarbo Cloud Mqtt Infrastructure

CVE-2026-6211

Arbitrary File Upload in Global IT's WEOLL

Unrestricted upload of file with dangerous type vulnerability in Global IT Informatics Services Inc. WEOLL allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WEOLL: from 2.0.9 before 3.2.45.33.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Global It

Products

Weoll

CVE-2026-9638

Crypt::PBKDF2 versions before 0.261630 for Perl generate insecure random values for salts

Crypt::PBKDF2 versions before 0.261630 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Arodland

Products

Crypt::pbkdf2

CVE-2026-50082

Aqara Developer Portal insecure authentication token

The Aqara Cloud Developer Portal (developer.aqara.com) issued a developer token to any email address supplied by the attacker. This is an instance of "CWE-306: Missing Authentication for Critical Function" with an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (6.5 Medium). When combined with CVE-2026-50083, CVE-2026-50084, and CVE-2026-50085, any otherwise-unauthenticated attacker could execute a full takeover of affected devices.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Aqara

Products

Cloud Developer Portal

CVE-2026-50083

Aqara hardcoded OAuth client credentials

The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, which is an instance of "CWE-798: Use of Hard-coded Credentials." This issue has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 Critical). When combined with CVE-2026-50082, CVE-50084, and CVE-50085, this can lead to a fully unauthenticated, remote takeover of affected devices.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Aqara

Products

Aquara Iam/sso Gateway Iam\/sso Gateway

CVE-2026-50084

Aqara API cross-account access

The Aqara Cloud Production API (open-cn.aqara.com/v3.0/open/api) would authorize any valid developer token for access to any account. This is an instance of "CWE-862: Missing Authorization" with an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N (9.6 Critical). When combined with CVE-2026-50082, CVE-50083, and CVE-50085, this can lead to a fully unauthenticated, remote takeover of affected devices.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Aqara

Products

Cloud Production Api

CVE-2026-50085

Aqara Board IoT insecure debug API

The Aqara Board service (op-test.aqara.com) accepts arbitrary MQTT command payloads, and forwards them to the platfom's HiveMQ broker without authentication. This is an instance of "CWE-306: Missing Authentication for Critical Function" and has an estimated CVSS ofCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L (8.6 High). When combined with CVE-2026-50082, CVE-50083, and CVE-50084, this can lead to a fully unauthenticated, remote takeover of affected devices.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Aqara

Products

Board Service

CVE-2026-50086

Aqara unauthenticated AES oracle

The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes bidirectional AES round-trups against the platform's signing key without authentication. This is an instance of "CWE-306: Missing Authentication for Critical Function" and "CWE-327: Use of a Broken or Risky Cryptographic Algorithm," and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High).

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Aqara

Products

Aqara Iam/sso Gateway Iam\/sso Gateway