CVE-2026-97858Medium· 5.3▾ SunlitAn attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the d…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 17.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
0.3% → 0.3%
An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-107617Critical· 9.8An attacker can use a hard-coded credential to log in to EseeCloud devices.
CVE-2026-105664Medium· 5.3The endpoint exposes an observable response discrepancy when processing ID values
CVE-2026-58255High· 8.8Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401
CVE-2026-116216Medium· 5.3MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment
CVE-2026-115933Critical· 9.9Forged signed tokens let any registered user take over other users and organizations
CVE-2026-96378Medium· 4.3Commerce Decoupled Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-179