https://vulnerability.circl.lu Latest vulnerabilities published by the CNAs operating under the jpcert root of the CVE Program. http://www.rssboard.org/rss-specification python-feedgen en Tue, 18 Aug 2026 17:18:58 +0000 https://vulnerability.circl.lu/vuln/cve-2026-72506 VoiceTra provided by National Institute of Information and Communications Technology (NICT) contains an incorrectly specified destination in a communication channel vulnerability. Users may be directed to a server (or service) controlled by an attacker, potentially resulting in the theft of input data or the display of incorrect results. VoiceTra provided by National Institute of Information and Communications Technology (NICT) contains an incorrectly specified destination in a communication channel vulnerability. Users may be directed to a server (or service) controlled by an attacker, potentially resulting in the theft of input data or the display of incorrect results. https://vulnerability.circl.lu/vuln/cve-2026-72506 Thu, 13 Aug 2026 04:07:00 +0000 https://vulnerability.circl.lu/vuln/cve-2026-66411 DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications. An unauthenticated attacker may connect and operate the affected robot. DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications. An unauthenticated attacker may connect and operate the affected robot. https://vulnerability.circl.lu/vuln/cve-2026-66411 Mon, 10 Aug 2026 08:13:34 +0000 https://vulnerability.circl.lu/vuln/cve-2026-66410 Android and iOS apps ECOVACS PRO App improperly validate server certificates. Communication may be retrieved and/or altered. Android and iOS apps ECOVACS PRO App improperly validate server certificates. Communication may be retrieved and/or altered. https://vulnerability.circl.lu/vuln/cve-2026-66410 Mon, 10 Aug 2026 08:08:54 +0000 https://vulnerability.circl.lu/vuln/cve-2026-66409 DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password may be analyzed and obtained to connect to the access point of an affected robot. DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password may be analyzed and obtained to connect to the access point of an affected robot. https://vulnerability.circl.lu/vuln/cve-2026-66409 Mon, 10 Aug 2026 08:04:05 +0000 https://vulnerability.circl.lu/vuln/cve-2026-66408 The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords. Physical access to an affected product may allow to obtain the password of the root account. The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords. Physical access to an affected product may allow to obtain the password of the root account. https://vulnerability.circl.lu/vuln/cve-2026-66408 Mon, 10 Aug 2026 08:01:00 +0000 https://vulnerability.circl.lu/vuln/cve-2026-66407 DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. The WebSocket private key may be retrieved through analyzing the traffic data via a man-in-the-middle attack, and communication contents may be altered. DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. The WebSocket private key may be retrieved through analyzing the traffic data via a man-in-the-middle attack, and communication contents may be altered. https://vulnerability.circl.lu/vuln/cve-2026-66407 Mon, 10 Aug 2026 08:00:43 +0000 https://vulnerability.circl.lu/vuln/cve-2026-66406 DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle attack may allow to obtain and/or alter communications of the affected products. As a result, arbitrary code may be executed with the administrative privilege. DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle attack may allow to obtain and/or alter communications of the affected products. As a result, arbitrary code may be executed with the administrative privilege. https://vulnerability.circl.lu/vuln/cve-2026-66406 Mon, 10 Aug 2026 08:00:25 +0000 https://vulnerability.circl.lu/vuln/cve-2026-66405 DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to the affected products. DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to the affected products. https://vulnerability.circl.lu/vuln/cve-2026-66405 Mon, 10 Aug 2026 07:59:40 +0000 https://vulnerability.circl.lu/vuln/cve-2026-66404 DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activity logs stored on the affected products may be retrieved. DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activity logs stored on the affected products may be retrieved. https://vulnerability.circl.lu/vuln/cve-2026-66404 Mon, 10 Aug 2026 07:59:17 +0000 https://vulnerability.circl.lu/vuln/cve-2026-66403 DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may be retrieved. DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may be retrieved. https://vulnerability.circl.lu/vuln/cve-2026-66403 Mon, 10 Aug 2026 07:58:47 +0000