https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T17:49:57.131259+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-326891 EUVD-2026-326891 2026-10-06T17:49:57.134905+00:00 EUVD-2026-326891 https://cve.radiocsirt.org/vuln/fkie_cve-2026-50086 fkie_cve-2026-50086 2026-10-06T17:49:57.134949+00:00

The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes bidirectional AES round-trups against the platform's signing key without authentication. This is an instance of "CWE-306: Missing Authentication for Critical Function" and "CWE-327: Use of a Broken or Risky Cryptographic Algorithm," and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High).

 https://cve.radiocsirt.org/vuln/ghsa-3897-2crh-vgmr GHSA-3897-2crh-vgmr 2026-10-06T17:49:57.134994+00:00

The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes bidirectional AES round-trups against the platform's signing key without authentication. This is an instance of "CWE-306: Missing Authentication for Critical Function" and "CWE-327: Use of a Broken or Risky Cryptographic Algorithm," and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High).