CVE-2026-50211

Same vendor

• CVE-2026-50226 — Fixed AES-128-CBC keys inside the AcerConnect OTA application let attackers forge authorization credentials for arbitrary IMEI numbers (5.3 MEDIUM)
• CVE-2026-50225 — The registration path /v1/account/register provides no bot mitigation mechanisms, allowing malicious automated systems to flood the database (9.1 CRITICAL)
• CVE-2026-50224 — The web administration panel binds broadly to the public IPv6 address space on port [::]:8080 without default firewall limits, making int... (4.9 MEDIUM)
• CVE-2026-50214 — The /v1/Plan service relies entirely on a shared global API token for full administrative management, allowing arbitrary creation of zero... (9.8 CRITICAL)
• CVE-2026-50213 — The account validation endpoint /v1/User/validate returns comprehensive user profile data sheets, which can be crawled by iterating predi... (7.5 HIGH)

Same CWE

• CVE-2026-6242 — An authenticated format string vulnerability exists in the ONVIF Subscribe service in Tapo C520WS v2 due to improper handling of external...
• CVE-2026-6241 — An authenticated format string vulnerability is present in the ONVIF AddScopes in Tapo C520WS v2, where user-controlled input is improper...
• CVE-2026-7835 — A format string argument mismatch in Netatalk 3.0.3 through 4.4.2 allows a remote authenticated attacker to cause a minor denial of servi... (3.1 LOW)
• CVE-2026-6474 — Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via craf... (4.3 MEDIUM)
• CVE-2026-6843 — A flaw was found in nano (5.5 MEDIUM)