Shenzhen Shine Industrial Co., Ltd. has 12 CVEs on record. Disclosure cadence is accelerating: 12 in the last 90 days against 0 in the 90 before. The busiest recent month was November 2026 with 12. The median CVSS is 7.6 (high), with 2 rated critical. None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.6
- Publish → KEV
- —
- Last 90 days
- 12 prev 0
Worst active — by depth score
CVE-2026-54384Critical· 9.8VitaFit Cloud API Authentication Bypass via POST /front/login/sns/54CVE-2026-54378Critical· 9.6VitaFit Cloud API Broken Access Control via S3 Token Endpoint53CVE-2026-54372High· 8.8VitaFit Android < 2.8.1.0 Insecure TLS Certificate Validation48CVE-2026-54375High· 8.4VitaFit Android < 2.8.1.0 Long-Lived Session Token Exposure46CVE-2026-54376High· 8.2VitaFit Android < 2.8.1.0 Custom URI Scheme Token Hijacking45
Shenzhen Shine Industrial Co., Ltd. vulnerabilities
CVEs affecting Shenzhen Shine Industrial Co., Ltd., newest first. Open any entry for full detail, references, and exploit status.
12 CVEsRSS
CVE-2026-54384Critical· 9.8VitaFit Cloud API Authentication Bypass via POST /front/login/sns/
VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /f…
CVE-2026-54383Medium· 6.5VitaFit Cloud API Excessive Data Exposure via relation/search Endpoint
VitaFit cloud API before 2026-10-30 contained an excessive data exposure vulnerability that allows any authenticated user to query the GET /front/relation/search/ endpoint and retrieve PII and health-related profile information for user …
CVE-2026-54381High· 7.5VitaFit Cloud API Storage Bucket Unauthenticated Access Information Disclosure
VitaFit cloud API before 2026-10-30 contained a misconfigured cloud storage bucket vulnerability that allows unauthenticated attackers to list and download stored files without authentication. Attackers can enumerate the publicly accessi…
CVE-2026-54382High· 7.7VitaFit Cloud API AWS IAM Misconfiguration via Cognito S3 Access
VitaFit cloud API before 2026-10-30 contained an improper access control vulnerability in its Cognito-issued AWS role that allows authenticated attackers to perform s3:PutObject operations across the entire shared bucket instead of being…
CVE-2026-54378Critical· 9.6VitaFit Cloud API Broken Access Control via S3 Token Endpoint
VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. Attackers can use these improp…
CVE-2026-54380Medium· 5.4VitaFit Cloud API Stored XSS via SVG File Upload
VitaFit cloud API before 2026-10-30 contained a stored cross-site scripting vulnerability that allows authenticated attackers to upload an SVG image containing malicious JavaScript to the shared storage bucket. Attackers can exploit the …
CVE-2026-54377Medium· 6.5VitaFit Cloud API IDOR via profile_id Endpoints
VitaFit cloud API before 2026-10-30 contained an insecure direct object reference vulnerability that allows authenticated attackers to access another user's data by supplying a different user_id or profile_id to endpoints such as GET /fr…
CVE-2026-54376High· 8.2VitaFit Android < 2.8.1.0 Custom URI Scheme Token Hijacking
VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure custom URI scheme vulnerability that allows a malicious application to intercept Fitbit login tokens by registering the same callback scheme (vitafit://vtio…
CVE-2026-54375High· 8.4VitaFit Android < 2.8.1.0 Long-Lived Session Token Exposure
VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure session management vulnerability that allows attackers to extract or intercept unencrypted m_session_id tokens stored in application backups, which remain v…
CVE-2026-54374High· 7.5VitaFit Android < 2.8.1.0 Hardcoded Credentials Disclosure
VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a hardcoded credentials vulnerability that allows attackers to extract confidential third-party integration secrets by decompiling the APK. Attackers can retrieve embed…
CVE-2026-54373Low· 3.5VitaFit Android < 2.8.1.0 Cleartext Traffic via Missing Network Security Config
VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a cleartext traffic vulnerability that allows network-based attackers to intercept or modify unencrypted HTTP communications due to the absence of an Android network se…
CVE-2026-54372High· 8.8VitaFit Android < 2.8.1.0 Insecure TLS Certificate Validation
VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability that allows network-based attackers to intercept and modify HTTPS traffic by exploiting a custom X509TrustManag…