https://vulnerability.circl.lu/cna-root/jpcert/recent 2026-08-19T13:30:54.329103+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Latest vulnerabilities published by the CNAs operating under the jpcert root of the CVE Program. https://vulnerability.circl.lu/vuln/cve-2026-70408 2026-08-19T04:54:02.396000+00:00 An incorrect authorization vulnerability exists in acmailer, which may allow a user to create a sub-account that has administrative privileges.

An incorrect authorization vulnerability exists in acmailer, which may allow a user to create a sub-account that has administrative privileges.

2026-08-19T04:54:02.396000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-66358 2026-08-19T04:53:33.355000+00:00 A cross-site scripting vulnerability exists in acmailer, which may allow an attacker to execute an arbitrary script.

A cross-site scripting vulnerability exists in acmailer, which may allow an attacker to execute an arbitrary script.

2026-08-19T04:53:33.355000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-11751 2026-08-19T01:19:34.960000+00:00 A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabled, allowing man-in-the-middle attacks against xDS-managed upstream connections.

A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabled, allowing man-in-the-middle attacks against xDS-managed upstream connections.

2026-08-19T01:19:34.960000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-72506 2026-08-13T04:07:00.335000+00:00 VoiceTra provided by National Institute of Information and Communications Technology (NICT) contains an incorrectly specified destination in a communication channel vulnerability. Users may be directed to a server (or service) controlled by an attacker, potentially resulting in the theft of input data or the display of incorrect results.

VoiceTra provided by National Institute of Information and Communications Technology (NICT) contains an incorrectly specified destination in a communication channel vulnerability. Users may be directed to a server (or service) controlled by an attacker, potentially resulting in the theft of input data or the display of incorrect results.

2026-08-13T04:07:00.335000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-66411 2026-08-10T08:13:34.748000+00:00 DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications. An unauthenticated attacker may connect and operate the affected robot.

DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications. An unauthenticated attacker may connect and operate the affected robot.

2026-08-10T08:13:34.748000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-66410 2026-08-10T08:08:54.747000+00:00 Android and iOS apps ECOVACS PRO App improperly validate server certificates. Communication may be retrieved and/or altered.

Android and iOS apps ECOVACS PRO App improperly validate server certificates. Communication may be retrieved and/or altered.

2026-08-10T08:08:54.747000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-66409 2026-08-10T08:04:05.423000+00:00 DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password may be analyzed and obtained to connect to the access point of an affected robot.

DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password may be analyzed and obtained to connect to the access point of an affected robot.

2026-08-10T08:04:05.423000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-66408 2026-08-10T08:01:00.420000+00:00 The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords. Physical access to an affected product may allow to obtain the password of the root account.

The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords. Physical access to an affected product may allow to obtain the password of the root account.

2026-08-10T08:01:00.420000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-66407 2026-08-10T08:00:43.341000+00:00 DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. The WebSocket private key may be retrieved through analyzing the traffic data via a man-in-the-middle attack, and communication contents may be altered.

DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. The WebSocket private key may be retrieved through analyzing the traffic data via a man-in-the-middle attack, and communication contents may be altered.

2026-08-10T08:00:43.341000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-66406 2026-08-10T08:00:25.140000+00:00 DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle attack may allow to obtain and/or alter communications of the affected products. As a result, arbitrary code may be executed with the administrative privilege.

DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle attack may allow to obtain and/or alter communications of the affected products. As a result, arbitrary code may be executed with the administrative privilege.

2026-08-10T08:00:25.140000+00:00