Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10

Export CSV
CVE-2026-13768

Gardyn IoT Hub Use of Hard-coded Credentials

Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user to invoke an IoTHub Registry Manager function which returns connection information for all Gardyn Home Kit and Studio devices. Access to this key also allows a malicious user to execute arbitrary commands on a specific connected device and may allow the malicious user to pivot to other devices on the user's network.

CVSS 4.0 · 9.5 Critical EPSS < 1% KEV · Not listed
Vendors
Gardyn
Products
Gardyn Cloud Api Gardyn Home Firmware Gardyn Studio Firmware
CVE-2026-55726

Gardyn IoT Hub Exposure of Sensitive System Information to an Unauthorized Control Sphere

The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication. A malicious user would be able to access any device log file available in the blob storage container.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Gardyn
Products
Gardyn Cloud Api Gardyn Home Firmware Gardyn Studio Firmware
CVE-2026-32646

Gardyn Cloud API Missing Authentication for Critical Function

A specific administrative endpoint is accessible without proper authentication, exposing device management functions.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Gardyn Mygardyn
Products
Cloud Api Cloud Api
CVE-2026-28767

Gardyn Cloud API Missing Authentication for Critical Function

A specific administrative endpoint notifications is accessible without proper authentication.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Gardyn Mygardyn
Products
Cloud Api Cloud Api
CVE-2026-28766

Gardyn Cloud API Missing Authentication for Critical Function

A specific endpoint exposes all user account information for registered Gardyn users without requiring authentication.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Gardyn Mygardyn
Products
Cloud Api Cloud Api
CVE-2026-25197

Gardyn Cloud API Authorization Bypass Through User-Controlled Key

A specific endpoint allows authenticated users to pivot to other user profiles by modifying the id number in the API call.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Gardyn Mygardyn
Products
Cloud Api Cloud Api
CVE-2025-1242

Administrative Credentials Can Be Extracted Through Gardyn API Responses

The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineering. The exposure may result in an attacker gaining full administrative access to the Gardyn IoT Hub exposing connected devices to malicious control.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Gardyn
Products
Home Kit Home Kit Cloud Api Home Kit Mobile Application
CVE-2025-10681

Gardyn Mobile Application and Device Firmware Use Hard-coded Credentials

Storage credentials are hardcoded in the mobile app and device firmware. These credentials do not adequately limit end user permissions and do not expire within a reasonable amount of time. This vulnerability may grant unauthorized access to production storage containers.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Gardyn
Products
Cloud Api Mobile Application