Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

7 records

Release: Shenzhen Shine Industrial VitaFit 2026-10-30 Clear all filters
TI-2026-85254 CVE-2026-54384 · GHSA-gx2r-4x57-mvww

Authentication bypass in VitaFit Cloud API login endpoint

Priority MEDIUM 41

VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifi…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00661 Published 2026-11-04 Fixed in 2026-10-30 CWE-290
TI-2026-85253 CVE-2026-54383 · GHSA-f537-2pqg-8rvm

Excessive data exposure in VitaFit cloud API relation search endpoint

Priority LOW 31

VitaFit cloud API before 2026-10-30 contained an excessive data exposure vulnerability that allows any authenticated user to query the GET /front/relation/search/ endpoint and retrieve PII and health-related profile info…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00231 Published 2026-11-04 Fixed in 2026-10-30 CWE-862
TI-2026-85252 CVE-2026-54382 · GHSA-vfgc-8vj5-8w5w

Improper access control in VitaFit cloud API lets users overwrite S3 objects

Priority LOW 27

VitaFit cloud API before 2026-10-30 contained an improper access control vulnerability in its Cognito-issued AWS role that allows authenticated attackers to perform s3:PutObject operations across the entire shared bucket…

CVSS 4.0MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00213 Published 2026-11-04 Fixed in 2026-10-30 CWE-266
TI-2026-85244 CVE-2026-54381 · GHSA-qg7r-2qmf-p77f

Misconfigured storage bucket in VitaFit Cloud API exposes user files

Priority LOW 38

VitaFit cloud API before 2026-10-30 contained a misconfigured cloud storage bucket vulnerability that allows unauthenticated attackers to list and download stored files without authentication.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00422 Published 2026-11-04 Fixed in 2026-10-30 CWE-732
TI-2026-85239 CVE-2026-54380 · GHSA-mcvv-pcqf-fqr2

Stored cross-site scripting in VitaFit Cloud API via SVG uploads

Priority LOW 22

VitaFit cloud API before 2026-10-30 contained a stored cross-site scripting vulnerability that allows authenticated attackers to upload an SVG image containing malicious JavaScript to the shared storage bucket.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00165 Published 2026-11-04 Fixed in 2026-10-30 CWE-79
TI-2026-85238 CVE-2026-54378 · GHSA-jr4h-546g-564w

Broken access control in VitaFit cloud API exposes other users' files

Priority MEDIUM 40

VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint.

CVSS 4.0CRITICAL 9.3 Network Low privileges No interaction EPSS 0.00231 Published 2026-11-04 Fixed in 2026-10-30 CWE-522
TI-2026-85237 CVE-2026-54377 · GHSA-h9gp-qv79-4jmg

Insecure direct object reference in VitaFit cloud API exposes user data

Priority LOW 30

VitaFit cloud API before 2026-10-30 contained an insecure direct object reference vulnerability that allows authenticated attackers to access another user's data by supplying a different user_id or profile_id to endpoint…

CVSS 4.0MEDIUM 6.9 Local No auth No interaction EPSS 0.00183 Published 2026-11-04 Fixed in 2026-10-30 CWE-639