270 matches found
CVE-2026-66832 Mira Hormone Monitor, Mira Android App Use of GET request method with sensitive query strings
When the Mira Android app opens in-app WebView content e.g., shop redirect flows, the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web...
EUVD-2026-56978
When the Mira Android app opens in-app WebView content e.g., shop redirect flows, the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web...
PT-2026-70931
The Mira hormone monitor device firmware accepts a 0x01 write from any BLE central without authentication, causing the device to reboot into bootloader mode. An attacker could cause a denial-of-service condition or disrupt ovulation tracking and fertility monitoring workflow...
PT-2026-70926
The Mira cloud authentication endpoints do not enforce per-account rate limiting, per-IP throttling, or account lockout after repeated failed login attempts. An attacker can use brute-force methods to obtain gain access to user accounts...
PT-2026-70933
The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token...
PT-2026-70928
The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and access hormone record information and...
PT-2026-70927
When the Mira Android app opens in-app WebView content e.g., shop redirect flows, the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web...
PT-2026-70932
In the Mira hormone monitor device firmware v1.7.1.47 build 01070147, a remote unauthenticated attacker within BLE range approximately 10–30 meters can silently rebind the device to an attacker-controlled account, extract stored hormone measurements in cleartext, cause a denial-of-service via...
PT-2026-70934
The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information...
PT-2026-70925
The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version from the device itself. An authenticated attacker could submit arbitrary firmware version strings for their own device, allowing them to...
EUVD-2025-177823
Malicious code in mira-halley-halley-publish npm...
EUVD-2025-180356
Malicious code in archaeometry-airbnb-mira-ophiuchus npm...
EUVD-2025-175842
Malicious code in ultra-mira-centaurus-io npm...
EUVD-2025-180113
Malicious code in bellatrix-mira-europa-commitlint npm...
EUVD-2025-179629
Malicious code in commitlint-config-angular-sadr-cluster-mira npm...
EUVD-2025-180253
Malicious code in atlas-browserify-rigel-mira npm...
EUVD-2025-178993
Malicious code in exec-mira-puppeteer-warp npm...
EUVD-2025-180159
Malicious code in babel-ophiuchus-mira-bellatrix npm...