Loading story…
Gardyn disclosed two high-severity vulnerabilities affecting its cloud API, mobile application, and device firmware that could allow unauthorized access to sensitive data without prior authentication. CVE-2026-28766 is a CWE-306 missing-authentication flaw in a user-facing cloud endpoint that returns all registered user account information even when no authentication is provided, creating a direct path to broad data exposure over the network with no user interaction required.
A second issue, CVE-2025-10681, is a CWE-798 hard-coded credentials flaw in the Gardyn mobile app and device firmware. The embedded storage credentials reportedly grant overly broad permissions and do not expire within a reasonable time, potentially enabling unauthorized access to production storage containers and increasing the risk of confidentiality loss. Both records were published through CISA-linked advisories and vendor security references, indicating coordinated disclosure across federal and vendor channels.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
ICS-CERT received the vulnerability record for CVE-2026-25197 on 2026-04-03. The Gardyn cloud API flaw allows users to access or pivot to other user profiles by modifying an ID value in an API request, a CWE-639 insecure direct object reference issue.
ICS-CERT newly received the vulnerability record for CVE-2026-28766 on 2026-04-03. The flaw affects a Gardyn user-facing cloud API endpoint that returns all registered user account information without requiring authentication.
ICS-CERT newly received the vulnerability record for CVE-2025-10681 on 2026-04-03. The issue describes hard-coded credentials in the Gardyn mobile application and device firmware that could enable unauthorized access to production storage containers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researcher Sammy Azdoufal publicly disclosed a broad set of vulnerabilities in Aqara’s cloud platform, including **CVE-2026-50084**, a critical authorization flaw in the production API that allowed any valid developer token to access user-scoped endpoints for arbitrary accounts. The issue, rated **CVSS 9.6** and classified as `CWE-862`, affected `open-cn.aqara.com/v3.0/open/api` and stemmed from missing per-account authorization checks rather than the platform’s MD5-based request-signing scheme. Aqara said the flaw was fixed in April, before public disclosure, but the researcher reported mixed remediation status across the wider set of findings. The disclosure tied **ten CVEs** to Aqara cloud, mobile, and developer systems, including hardcoded OAuth credentials in the IAM/SSO gateway (**CVE-2026-50083**), an unauthenticated MQTT debug interface in Aqara Board (**CVE-2026-50085**), an unauthenticated AES oracle (**CVE-2026-50086**), permissive CORS issues (**CVE-2026-50087**, **CVE-2026-50088**), an OAuth `redirect_uri` validation bypass (**CVE-2026-50090**), and hardcoded cryptographic keys in the Aqara Home Android SDK (**CVE-2026-50091**). According to the advisory and CVE records, several of these flaws could be chained with **CVE-2026-50084** to achieve **fully unauthenticated remote takeover of affected devices**, while the GitHub disclosure also alleged additional exposures in Aqara back-office infrastructure and disputed the vendor’s claim that the impact was limited to test environments.
Jun 29, 2026
Several **high-severity vulnerability disclosures** were published across widely used developer and infrastructure components, with impacts ranging from **remote code execution (RCE)** to **account takeover** and **arbitrary host file writes**. In *Gogs* (self-hosted Git service), three CVEs were reported: **CVE-2025-64111** (CVSS 9.3) enables RCE by bypassing checks in `UpdateRepoFile` to modify `.git/config` via the API (described as an insufficient fix for an earlier issue); **CVE-2025-64175** (CVSS 7.7) allows a **cross-account 2FA recovery-code bypass** in versions `0.13.3` and earlier if an attacker already has a victim’s username/password; and **CVE-2026-24135** (CVSS 7.2) is a wiki rename path traversal that can delete arbitrary files by manipulating `old_title`. Separately, *Jinjava* (HubSpot CMS template engine) disclosed **CVE-2026-25526** (CVSS 9.8), a sandbox escape chain that permits arbitrary Java code execution by abusing `ForTag` iteration behavior (Bean ELResolver restriction bypass) and `ObjectMapper`-based JSON deserialization to instantiate disallowed classes. A critical Kubernetes storage issue was also disclosed in *Kubernetes Local Path Provisioner*: **CVE-2025-62878** (CVSS 10.0) allows directory traversal via the `parameters.pathPattern` setting, enabling a user who can create storage resources to provision volumes in arbitrary host locations (e.g., `/etc`) and potentially overwrite sensitive files on cluster nodes. In parallel to these product flaws, separate research reported widespread **exposure of Git metadata** on the public internet—approximately **4.96 million** IPs with accessible `.git` directories and **250,000+** exposing `.git/config` files that may contain deployment credentials—highlighting a common, high-impact misconfiguration pattern that can enable source code reconstruction and secret theft. Active exploitation activity was reported for *Ivanti Endpoint Manager Mobile (EPMM)* involving **CVE-2026-1281** and **CVE-2026-1340**, where attackers were observed dropping `/mifs/403.jsp` and using a Base64-delivered Java class loader designed for delayed, in-memory activation rather than immediate interactive webshell use.
Jun 29, 2026
Two high-severity vulnerabilities were disclosed affecting exposed application and device management surfaces, including a flaw that can give attackers **root access** and another that enables **arbitrary file write** through path traversal. **CVE-2026-3587** describes an unauthenticated remote attack path in a hidden CLI function that lets an attacker escape a restricted prompt and gain root access to the underlying Linux operating system, potentially leading to full device compromise. The issue was mapped to `CWE-912` and assigned a `CVSS v3.1` score vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, with CERT VDE publishing advisory `VDE-2026-020`. A separate vulnerability, **CVE-2026-5027**, affects Langflow's `POST /api/v2/files` endpoint, where improper sanitization of the multipart `filename` parameter allows path traversal using `../` sequences. An authenticated attacker can exploit the bug to write files to arbitrary filesystem locations, creating a route to compromise confidentiality, integrity, and availability. The flaw was classified as `CWE-22`, carries the `CVSS v3.1` vector `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, and is referenced in Tenable advisory `TRA-2026-26`.
Jun 29, 2026