Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-111629

IoTSharp through 3.6.1 Cross-Tenant Data Exposure via Customers and Devices APIs

IoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any authenticated user to read other tenants' data because Customers and Devices API handlers do not scope queries to the caller's tenant. Attackers can self-register through the anonymous AccountController.Create endpoint and supply other tenants' GUIDs to read customer contact details, device inventories and device attribute telemetry.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Iotsharp
Products
Iotsharp
CVE-2026-71262

IoTSharp BlobStorageController Missing Authentication and Path Traversal

IoTSharp BlobStorageController.cs lacks the [Authorize] attribute applied to every other controller in the application (DevicesController, CustomersController, TenantsController, etc.), and no global authorization FallbackPolicy is configured in Startup.cs, leaving its Upload/Download/List/Modify/Delete endpoints reachable by unauthenticated remote attackers.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Iotsharp
Products
Iotsharp