CVE-2026-121818High· 7.8▾ TwilightHerowatch Mini developed by About Time Technologies has a system signing vulnerability. Authenticated local attackers can exploit a publicly available test key to sign malicious programs, allowing them to elevate privileges and execute a…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.1%
Herowatch Mini developed by About Time Technologies has a system signing vulnerability. Authenticated local attackers can exploit a publicly available test key to sign malicious programs, allowing them to elevate privileges and execute arbitrary code.
herowatch_go allThe product is no longer maintained. Users are advised to replace it with a supported device.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-121817High· 7.5About Time Technologies｜Herowatch Go Server - Insecure Direct Object Reference
CVE-2026-121816High· 8.8About Time Technologies｜Herowatch Mini - Missing Authentication
CVE-2026-85295Critical· 9.8Chartbrew: Full account takeover via JWTs accepted under default CB_SECRET
CVE-2026-120442Critical· 9.8ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass
CVE-2026-119660Critical· 9.8MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key
CVE-2026-92777Medium· 6.4A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary code.