CVE-2026-50208

Same vendor

• CVE-2026-50226 — Fixed AES-128-CBC keys inside the AcerConnect OTA application let attackers forge authorization credentials for arbitrary IMEI numbers (5.3 MEDIUM)
• CVE-2026-50225 — The registration path /v1/account/register provides no bot mitigation mechanisms, allowing malicious automated systems to flood the database (9.1 CRITICAL)
• CVE-2026-50224 — The web administration panel binds broadly to the public IPv6 address space on port [::]:8080 without default firewall limits, making int... (4.9 MEDIUM)
• CVE-2026-50214 — The /v1/Plan service relies entirely on a shared global API token for full administrative management, allowing arbitrary creation of zero... (9.8 CRITICAL)
• CVE-2026-50213 — The account validation endpoint /v1/User/validate returns comprehensive user profile data sheets, which can be crawled by iterating predi... (7.5 HIGH)

Same CWE

• CVE-2026-41701 — Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter (4.4 MEDIUM)
• CVE-2026-41838 — IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in co... (4.8 MEDIUM)
• CVE-2026-41207 — The netty incubator codec.bhttp is a java language binary http parser (5.3 MEDIUM)
• CVE-2026-44054 — Netatalk 2.0.0 through 4.4.2 generates AFP session tokens derived from predictable process IDs, which allows a remote authenticated attac... (6.5 MEDIUM)
• CVE-2026-42155 — Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-com...