CVE-2026-49195

Same vendor

• CVE-2026-50226 — Fixed AES-128-CBC keys inside the AcerConnect OTA application let attackers forge authorization credentials for arbitrary IMEI numbers (5.3 MEDIUM)
• CVE-2026-50225 — The registration path /v1/account/register provides no bot mitigation mechanisms, allowing malicious automated systems to flood the database (9.1 CRITICAL)
• CVE-2026-50224 — The web administration panel binds broadly to the public IPv6 address space on port [::]:8080 without default firewall limits, making int... (4.9 MEDIUM)
• CVE-2026-50214 — The /v1/Plan service relies entirely on a shared global API token for full administrative management, allowing arbitrary creation of zero... (9.8 CRITICAL)
• CVE-2026-50213 — The account validation endpoint /v1/User/validate returns comprehensive user profile data sheets, which can be crawled by iterating predi... (7.5 HIGH)

Same CWE

• CVE-2018-25437 — WordPress CherryFramework Themes 3.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to download... (7.5 HIGH)
• CVE-2026-12183 — Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 through 2.10.2 on Linux contains an Improper Authentication vulnerabili... (9.8 CRITICAL)
• CVE-2026-53868 — Capgo before 12.128.2 contains a denial of service vulnerability allowing attackers to register accounts using arbitrary email addresses ... (7.5 HIGH)
• CVE-2026-50287 — AgenticMail gives AI agents real email addresses and phone numbers
• CVE-2026-53981 — Cap-go prior to 12.128.2 contains an account takeover vulnerability in its email change mechanism that allows an attacker with temporary ... (7.6 HIGH)