Gardyn

Records13All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical7CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

Gardyn records in CISA KEV

No Gardyn vulnerabilities are listed in CISA KEV.

Products in the NVD configurations · select one to filter the records

5 records in Cloud Api · all components

TI-2026-20353 CVE-2026-25197 · GHSA-m6m3-75j4-96wf

MEDIUM 48

A specific endpoint allows authenticated users to pivot to other user profiles by modifying the id number in the API call.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.003 Published 2026-04-03 Fixed in 2.12.2026 CWE-639

TI-2026-22962 CVE-2026-28766 · GHSA-m7jc-wgg6-fhj3

MEDIUM 46

A specific endpoint exposes all user account information for registered Gardyn users without requiring authentication.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00444 Published 2026-04-03 Fixed in 2.12.2026 CWE-306

TI-2026-25154 CVE-2026-32646 · GHSA-rj89-w4p6-78wv

MEDIUM 44

A specific administrative endpoint is accessible without proper authentication, exposing device management functions.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00494 Published 2026-04-03 Fixed in 2.12.2026 CWE-306

TI-2026-22963 CVE-2026-28767 · GHSA-v4x2-mqq5-6xqv

LOW 37

A specific administrative endpoint notifications is accessible without proper authentication.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00391 Published 2026-04-03 Fixed in 2.12.2026 CWE-306

TI-2026-25164 CVE-2026-32662 · GHSA-35v5-5w5j-5cx2

LOW 36

Development and test API endpoints are present that mirror production functionality.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00328 Published 2026-04-03 Fixed in 2.12.2026 CWE-489