CVE-2026-64934 Mira Hormone Monitor, Mira Android App Reliance on untrusted inputs in a security decision

The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version from the device itself. An authenticated attacker could submit arbitrary firmware version strings for their own device, allowing them to...

CVE-2026-64934

CVE-2026-64934 affects the Mira Hormone Monitor ecosystem, specifically the Mira Android App and related cloud API. The root cause is reliance on the firmware version reported by the companion app without independent attestation from the device itself. An authenticated attacker could submit arbit...

CVE-2026-64934 Mira Hormone Monitor, Mira Android App Reliance on untrusted inputs in a security decision

The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version from the device itself. An authenticated attacker could submit arbitrary firmware version strings for their own device, allowing them to...

GO-2026-5119 Nezha's authenticated agents can forge service-monitor results for other users' services in github.com/nezhahq/nezha

Nezha accepts service-monitor TaskResult messages from an authenticated agent based only on whether the reported service ID exists. The dashboard authenticates the agent and derives the reporter server ID from the gRPC stream, but the service-monitor result worker does not verify that the reporte...

CVE-2026-47299

Improper neutralization of special elements used in a command 'command injection' in Azure Monitor Agent allows an authorized attacker to elevate privileges over a network...

CVE-2026-47299 Azure Monitor Agent Elevation of Privilege Vulnerability

...

EUVD-2026-56305

Improper neutralization of special elements used in a command 'command injection' in Azure Monitor Agent allows an authorized attacker to elevate privileges over a network...

CVE-2026-47299 Azure Monitor Agent Elevation of Privilege Vulnerability

...

CVE-2026-47299

CVE-2026-47299 involves the Azure Monitor Agent and is due to improper neutralization of special elements used in a command (command injection). The vulnerability could allow an authorized attacker to elevate privileges over a network, with network as the attack vector, no user interaction requir...

CVE-2026-47299

Improper neutralization of special elements used in a command 'command injection' in Azure Monitor Agent allows an authorized attacker to elevate privileges over a network...

Azure Monitor Agent Elevation of Privilege Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Azure Monitor Agent allows an authorized attacker to elevate privileges over a network...

staging: vme_user: fix location monitor leak in tsi148 bridge

...

Mira Hormone Monitor, Mira Android App

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker to access unauthorized health profile information, make changes to health information, cause a denial-of-service condition, disclose session token information, and obtain control of user accounts. 2...

CVE-2026-66098: Missing Authentication for Critical Function

The Mira hormone monitor device firmware accepts a 0x01 write from any BLE central without authentication, causing the device to reboot into bootloader mode. An attacker could cause a denial-of-service condition or disrupt ovulation tracking and fertility monitoring workflow...

CVE-2026-47299: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in Azure Monitor Agent allows an authorized attacker to elevate privileges over a network...

CVE-2026-32791: Untrusted Search Path

Untrusted search path for some IntelR Performance Counter Monitor IntelR PCM before version tag 202604 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of...

PT-2026-76019

Nezha accepts service-monitor TaskResult messages from an authenticated agent based only on whether the reported service ID exists. The dashboard authenticates the agent and derives the reporter server ID from the gRPC stream, but the service-monitor result worker does not verify that the reporte...

PT-2026-70932

In the Mira hormone monitor device firmware v1.7.1.47 build 01070147, a remote unauthenticated attacker within BLE range approximately 10–30 meters can silently rebind the device to an attacker-controlled account, extract stored hormone measurements in cleartext, cause a denial-of-service via...

KLA91203 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. An elevation of...

PT-2026-70931

The Mira hormone monitor device firmware accepts a 0x01 write from any BLE central without authentication, causing the device to reboot into bootloader mode. An attacker could cause a denial-of-service condition or disrupt ovulation tracking and fertility monitoring workflow...