CVE-2026-66098

The Mira hormone monitor device firmware accepts a 0x01 write from any BLE central without authentication, causing the device to reboot into bootloader mode. An attacker could cause a denial-of-service condition or disrupt ovulation tracking and fertility monitoring workflow...

CVE-2026-66098 Mira Hormone Monitor, Mira Android App Missing authentication for critical function

The Mira hormone monitor device firmware accepts a 0x01 write from any BLE central without authentication, causing the device to reboot into bootloader mode. An attacker could cause a denial-of-service condition or disrupt ovulation tracking and fertility monitoring workflow...

CVE-2026-66098

The CVE affects the Mira hormone monitor device firmware. A 0x01 BLE write from any unauthenticated central triggers reboot into bootloader mode, enabling a denial-of-service condition and potentially disrupting ovulation tracking and fertility monitoring workflow. The sources describe the vulner...

CVE-2026-67558

The CVE concerns the Mira Android companion app version 4.5.15.4, which authenticates to the paired Mira hormone analyzer via a simple substring match on the BLE advertising name. There is no cryptographic periphery authentication, MAC allowlist, or bonded-identity check described in the provided...

CVE-2026-68067 Mira Hormone Monitor, Mira Android App Weak Authentication

The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and access hormone record information and...

CVE-2026-66340 Mira Hormone Monitor, Mira Android App Improper restriction of excessive authentication attempts

The Mira cloud authentication endpoints do not enforce per-account rate limiting, per-IP throttling, or account lockout after repeated failed login attempts. An attacker can use brute-force methods to obtain gain access to user accounts...

CVE-2026-64934

CVE-2026-64934 affects the Mira Hormone Monitor ecosystem, specifically the Mira Android App and related cloud API. The root cause is reliance on the firmware version reported by the companion app without independent attestation from the device itself. An authenticated attacker could submit arbit...

CVE-2026-64934 Mira Hormone Monitor, Mira Android App Reliance on untrusted inputs in a security decision

The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version from the device itself. An authenticated attacker could submit arbitrary firmware version strings for their own device, allowing them to...

CVE-2026-64934 Mira Hormone Monitor, Mira Android App Reliance on untrusted inputs in a security decision

The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version from the device itself. An authenticated attacker could submit arbitrary firmware version strings for their own device, allowing them to...

GO-2026-5119 Nezha's authenticated agents can forge service-monitor results for other users' services in github.com/nezhahq/nezha

Nezha accepts service-monitor TaskResult messages from an authenticated agent based only on whether the reported service ID exists. The dashboard authenticates the agent and derives the reporter server ID from the gRPC stream, but the service-monitor result worker does not verify that the reporte...

CVE-2026-47299

Improper neutralization of special elements used in a command 'command injection' in Azure Monitor Agent allows an authorized attacker to elevate privileges over a network...

CVE-2026-47299 Azure Monitor Agent Elevation of Privilege Vulnerability

...

EUVD-2026-56305

Improper neutralization of special elements used in a command 'command injection' in Azure Monitor Agent allows an authorized attacker to elevate privileges over a network...

CVE-2026-47299

CVE-2026-47299 involves the Azure Monitor Agent and is due to improper neutralization of special elements used in a command (command injection). The vulnerability could allow an authorized attacker to elevate privileges over a network, with network as the attack vector, no user interaction requir...

CVE-2026-47299 Azure Monitor Agent Elevation of Privilege Vulnerability

...

CVE-2026-47299

Improper neutralization of special elements used in a command 'command injection' in Azure Monitor Agent allows an authorized attacker to elevate privileges over a network...

Azure Monitor Agent Elevation of Privilege Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Azure Monitor Agent allows an authorized attacker to elevate privileges over a network...

staging: vme_user: fix location monitor leak in tsi148 bridge

...

CVE-2026-66875: Missing Authentication for Critical Function

In the Mira hormone monitor device firmware v1.7.1.47 build 01070147, a remote unauthenticated attacker within BLE range approximately 10–30 meters can silently rebind the device to an attacker-controlled account, extract stored hormone measurements in cleartext, cause a denial-of-service via...

CVE-2026-47299: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in Azure Monitor Agent allows an authorized attacker to elevate privileges over a network...