https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 01:11:05 +0000 https://cve.radiocsirt.org/vuln/cve-2026-7368 <p><strong>Affected:</strong> Yarbo Android/IOS mobile application, Yarbo Cloud MQTT infrastructure</p> <p>The Yarbo cloud does not enforce per-device or per-user authorization. Any client possessing valid credentials, whether the shared hard-coded credentials or legitimate per-user credentials, can subscribe to wildcard topics covering all robots globally, and can publish to any robot&#39;s command topic using only the robot&#39;s serial number (disclosed in the telemetry stream). Even after removal of hard-coded credentials from the app, a single compromised credential could still provide fleet-wide access without per-device access controls.</p> <p><strong>Affected:</strong> Yarbo Android/IOS mobile application, Yarbo Cloud MQTT infrastructure</p> <p>The Yarbo cloud does not enforce per-device or per-user authorization. Any client possessing valid credentials, whether the shared hard-coded credentials or legitimate per-user credentials, can subscribe to wildcard topics covering all robots globally, and can publish to any robot&#39;s command topic using only the robot&#39;s serial number (disclosed in the telemetry stream). Even after removal of hard-coded credentials from the app, a single compromised credential could still provide fleet-wide access without per-device access controls.</p> https://cve.radiocsirt.org/vuln/cve-2026-7368