CVE-2026-97858

An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID...

CVE-2026-97858 Guangzhou Juan IoT Technology EseeCloud Improperly Controlled Modification of Dynamically-Determined Object Attributes

An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID...

EUVD-2026-102879

An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID...

CVE-2026-97858

A vulnerability exists in Guangzhou Juan IoT Technology EseeCloud (CWE-915) where an attacker can trigger the server to unbind a target device from its current owner and rebind it to the requesting account. This action can be performed regardless of whether the device is already associated with a...

CVE-2026-97858: Improperly Controlled Modification of Dynamically-Determined Object Attributes

An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID...

PT-2026-115615

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An attacker can force the server to unbind a target device from its current owner and rebind it to the requesting account. This action occurs regardless of wheth...

GHSA-JQ29-R496-R955 payload-preferences has Cross-Collection IDOR in Access Control (Multi-Auth Environments)

Impact A cross-collection Insecure Direct Object Reference IDOR vulnerability exists in the payload-preferences internal collection. In multi-auth collection environments using Postgres or SQLite with default serial/auto-increment IDs, authenticated users from one auth collection can read and...

Exploit for CVE-2025-22954

Koha CVE-2025-22954: SQL Injection in lateissues-export.pl...

LOWKEY: Hunting for the Missing Volume Serial ID

In August 2019, FireEye released the “Double Dragon” report on our newest graduated threat group: APT41. A China-nexus dual espionage and financially-focused group, APT41 targets industries such as gaming, healthcare, high-tech, higher education, telecommunications, and travel services. This blog...