Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2568▼ 310 respecto a la semana anterior
Críticas / altas1351▲ 96 respecto a la semana anterior
Nueva explotación activa (KEV)5▼ 7 respecto a la semana anterior
Sin puntuar (sin CVSS)62▼ 466 respecto a la semana anterior
4 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Aplazada | Crítica (9.5) | 0.65% | — | Gardyn Home KITAIGardyn StudioAI | 3/7/2026 | 6/7/2026 | Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user to invoke an IoTHub Registry Manager function which returns connection information for all Gardyn Home Kit and Studio devices. Access to this key also allows a malicious user to execute arbitrary commands on a specific… | |
| Aplazada | Crítica (9.8) | 2.1% | — | Gardyn Home KIT FirmwareAIGardyn Home KIT Mobile ApplicationAIGardyn Home KIT Cloud APIAI | 25/7/2025 | 17/6/2026 | Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 allow command injection through vulnerable methods that do not sanitize input before passing content to the operating system for execution. The vulnerability may allow an attacker to execute… | |
| Aplazada | Crítica (9.1) | 0.49% | — | Gardyn Home KIT FirmwareAIGardyn Home KIT Mobile ApplicationAIGardyn Home KIT Cloud APIAI | 25/7/2025 | 17/6/2026 | Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 use weak default credentials for secure shell access. This may result in attackers gaining access to exposed Gardyn Home Kits. | |
| Aplazada | Crítica (9.4) | 0.28% | — | Gardyn Home KIT FirmwareAIGardyn Home KIT Mobile ApplicationAIGardyn Home KIT Cloud APIAI | 25/7/2025 | 17/6/2026 | A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection in Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 leaving the string vulnerable to interception and modification through a Man-in-the-Middle attack.… |