| CVE-2026-50226 |
Fixed AES-128-CBC keys inside the AcerConnect OTA application let attackers forge authorization credentials for…
|
6.9
Moyenne
|
4 juin 2026 |
| CVE-2026-50225 |
The registration path /v1/account/register provides no bot mitigation mechanisms, allowing malicious automated systems…
|
8.8
Élevée
|
4 juin 2026 |
| CVE-2026-50224 |
The web administration panel binds broadly to the public IPv6 address space on port [::]:8080 without default firewall…
|
6.9
Moyenne
|
4 juin 2026 |
| CVE-2026-50214 |
The /v1/Plan service relies entirely on a shared global API token for full administrative management, allowing arbitrary…
|
9.3
Critique
|
4 juin 2026 |
| CVE-2026-50213 |
The account validation endpoint /v1/User/validate returns comprehensive user profile data sheets, which can be crawled…
|
8.7
Élevée
|
4 juin 2026 |
| CVE-2026-50212 |
Weak validation logic within device dissociation API routines allows a remote entity to forcefully unbind unrelated user…
|
7.1
Élevée
|
4 juin 2026 |
| CVE-2026-50211 |
Leftover engineering diagnostics and factory-level diagnostic software remain exposed on retail builds, giving malicious…
|
8.8
Élevée
|
4 juin 2026 |
| CVE-2026-50210 |
The device encrypts data using AES-CBC with static zero-filled Initialization Vectors (IVs), making it susceptible to…
|
6.9
Moyenne
|
4 juin 2026 |
| CVE-2026-50209 |
Broadcast events allow malicious software to rewrite the device's default Mobile Device Management (MDM) endpoint…
|
9.3
Critique
|
4 juin 2026 |
| CVE-2026-50208 |
High-risk TrustAllCerts routines disable standard TLS certificate validation
|
9.2
Critique
|
4 juin 2026 |
| CVE-2026-50207 |
The system Binder boundary accepts unverified pass-through AT commands, giving local applications the power to read…
|
8.5
Élevée
|
4 juin 2026 |
| CVE-2026-50206 |
Incoming VPN network profile settings fail to process special characters safely, enabling command injection via…
|
8.5
Élevée
|
4 juin 2026 |
| CVE-2026-50205 |
System log files output unencrypted SMTP server authentication passwords alongside sensitive employee corporate…
|
8.8
Élevée
|
4 juin 2026 |
| CVE-2026-49204 |
Leftover debug modules contain fixed credentials for internal AWS Cognito test sandboxes, risking asset exploitation
|
6.9
Moyenne
|
4 juin 2026 |
| CVE-2026-49202 |
Internal multimedia session archives are accessible without authentication, exacerbated by loose Cross-Origin Resource…
|
8.8
Élevée
|
4 juin 2026 |
| CVE-2026-49203 |
Crucial management API endpoints for cellular eSIM allocation do not validate caller authorization, allowing remote…
|
7.2
Élevée
|
4 juin 2026 |
| CVE-2026-49194 |
The debugging routine SCREEN_CLICK(5053) enables a connection to skip the standard device login prompt entirely and…
|
9.4
Critique
|
4 juin 2026 |
| CVE-2026-49193 |
Overly permissive configuration settings on cloud storage containers expose active telemetry information publicly to the…
|
8.7
Élevée
|
4 juin 2026 |
| CVE-2026-49192 |
The summary service endpoint suffers from an IDOR vulnerability where it fails to verify user ownership of hardware…
|
5.3
Moyenne
|
4 juin 2026 |
| CVE-2026-49191 |
The production build of the M3WebServer hard-codes its backend API keys, which can be easily intercepted through verbose…
|
9.3
Critique
|
4 juin 2026 |
| CVE-2026-49190 |
The system fails to evaluate instructional permissions over multiple internal operation codes (opcodes), permitting…
|
9.4
Critique
|
4 juin 2026 |
| CVE-2026-49189 |
Unchecked public access permissions on a core Broadcast Receiver allow unauthorized local software components to…
|
8.5
Élevée
|
4 juin 2026 |
| CVE-2026-49188 |
The ai_cmd utility executes with full root permissions
|
8.7
Élevée
|
4 juin 2026 |
| CVE-2026-49187 |
The hard-coded APK resource files never expire, and the shared scepter leads to information leaks and potential misuse
|
8.7
Élevée
|
4 juin 2026 |
| CVE-2026-49186 |
The local MQTT broker does not enforce topic-level Access Control Lists (ACLs)
|
8.6
Élevée
|
4 juin 2026 |