[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-49994":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-28T18:04:36.952Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":256,"aliases":257,"duplicate_of":9,"upstream":258,"downstream":259,"duplicates":260,"related":261,"reserved_at":9,"published_at":262,"modified_at":263,"state":264,"summary":265,"references_raw":272,"kevs":288,"epss":9,"epss_history":289,"metrics":290,"affected":298},"CVE-2026-49994","Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when auth_enabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/* handlers (settings, devices, groups, per-device endpoints including /api/device/{mac}/notes) called no auth check at all. A network attacker reachable on the dashboard port could read Bluetooth tracking data and modify application state — including the heartbeat URL, prune retention, device groups, and per-device notes — without a session cookie. This issue has been patched in version 0.7.1.",null,[11,40],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-306","Missing Authentication for Critical Function","The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.","weakness","Draft","Base","High",[20,24,28,32,36],{"id":21,"name":22,"techniques":23},"CAPEC-12","Choosing Message Identifier",[],{"id":25,"name":26,"techniques":27},"CAPEC-166","Force the System to Reset Values",[],{"id":29,"name":30,"techniques":31},"CAPEC-216","Communication Channel Manipulation",[],{"id":33,"name":34,"techniques":35},"CAPEC-36","Using Unpublished Interfaces or Functionality",[],{"id":37,"name":38,"techniques":39},"CAPEC-62","Cross Site Request Forgery",[],{"_key":41,"id":41,"name":42,"description":43,"type":15,"status":44,"abstraction":45,"likelihood_of_exploit":18,"capec":46},"CWE-862","Missing Authorization","The product does not perform an authorization check when an actor attempts to access a resource or perform an action.","Incomplete","Class",[47],{"id":48,"name":49,"techniques":50},"CAPEC-665","Exploitation of Thunderbolt Protection Flaws",[51,88,128],{"id":52,"name":53,"tactics":54,"countermeasures":61},"T1211","Exploitation for Stealth",[55,58],{"id":56,"name":57},"TA0030","Defense Evasion",{"id":59,"name":60},"TA0005","Stealth",[62,67,72,76,80,84],{"id":63,"name":64,"tactic":65},"D3-PSEP","Process Segment Execution Prevention",{"name":66},"Harden",{"id":68,"name":69,"tactic":70},"D3-MBT","Memory Boundary Tracking",{"name":71},"Detect",{"id":73,"name":74,"tactic":75},"D3-PCSV","Process Code Segment Verification",{"name":71},{"id":77,"name":78,"tactic":79},"D3-SFCV","Stack Frame Canary Validation",{"name":66},{"id":81,"name":82,"tactic":83},"D3-SSC","Shadow Stack Comparisons",{"name":71},{"id":85,"name":86,"tactic":87},"D3-SAOR","Segment Address Offset Randomization",{"name":66},{"id":89,"name":90,"tactics":91,"countermeasures":97},"T1542.002","Component Firmware",[92,93,94],{"id":56,"name":57},{"id":59,"name":60},{"id":95,"name":96},"TA0110","Persistence",[98,102,106,110,114,119,124],{"id":99,"name":100,"tactic":101},"D3-FEMC","Firmware Embedded Monitoring Code",{"name":71},{"id":103,"name":104,"tactic":105},"D3-FV","Firmware Verification",{"name":71},{"id":107,"name":108,"tactic":109},"D3-FBA","Firmware Behavior Analysis",{"name":71},{"id":111,"name":112,"tactic":113},"D3-SU","Software Update",{"name":66},{"id":115,"name":116,"tactic":117},"D3-SWI","Software Inventory",{"name":118},"Model",{"id":120,"name":121,"tactic":122},"D3-RS","Restore Software",{"name":123},"Restore",{"id":125,"name":126,"tactic":127},"D3-AVE","Asset Vulnerability Enumeration",{"name":118},{"id":129,"name":130,"tactics":131,"countermeasures":140},"T1556","Modify Authentication Process",[132,133,136,137],{"id":56,"name":57},{"id":134,"name":135},"TA0112","Defense Impairment",{"id":95,"name":96},{"id":138,"name":139},"TA0031","Credential Access",[141,146,150,155,159,163,167,171,175,179,183,187,191,195,200,204,208,212,216,220,224,228,232,236,240,244,248,252],{"id":142,"name":143,"tactic":144},"D3-LFP","Local File Permissions",{"name":145},"Isolate",{"id":147,"name":148,"tactic":149},"D3-HBPI","Hardware-based Process Isolation",{"name":145},{"id":151,"name":152,"tactic":153},"D3-FEV","File Eviction",{"name":154},"Evict",{"id":156,"name":157,"tactic":158},"D3-HS","Host Shutdown",{"name":154},{"id":160,"name":161,"tactic":162},"D3-PSMD","Process Self-Modification Detection",{"name":71},{"id":164,"name":165,"tactic":166},"D3-CQ","Content Quarantine",{"name":145},{"id":168,"name":169,"tactic":170},"D3-ABPI","Application-based Process Isolation",{"name":145},{"id":172,"name":173,"tactic":174},"D3-SFA","System File Analysis",{"name":71},{"id":176,"name":177,"tactic":178},"D3-PT","Process Termination",{"name":154},{"id":180,"name":181,"tactic":182},"D3-SCF","System Call Filtering",{"name":145},{"id":184,"name":185,"tactic":186},"D3-AM","Access Modeling",{"name":118},{"id":188,"name":189,"tactic":190},"D3-RC","Restore Configuration",{"name":123},{"id":192,"name":193,"tactic":194},"D3-FE","File Encryption",{"name":66},{"id":196,"name":197,"tactic":198},"D3-DF","Decoy File",{"name":199},"Deceive",{"id":201,"name":202,"tactic":203},"D3-FIM","File Integrity Monitoring",{"name":71},{"id":205,"name":206,"tactic":207},"D3-CF","Content Filtering",{"name":145},{"id":209,"name":210,"tactic":211},"D3-FA","File Analysis",{"name":71},{"id":213,"name":214,"tactic":215},"D3-WSAM","Web Session Access Mediation",{"name":145},{"id":217,"name":218,"tactic":219},"D3-CI","Configuration Inventory",{"name":118},{"id":221,"name":222,"tactic":223},"D3-RF","Restore File",{"name":123},{"id":225,"name":226,"tactic":227},"D3-PSA","Process Spawn Analysis",{"name":71},{"id":229,"name":230,"tactic":231},"D3-PLA","Process Lineage Analysis",{"name":71},{"id":233,"name":234,"tactic":235},"D3-RFAM","Remote File Access Mediation",{"name":145},{"id":237,"name":238,"tactic":239},"D3-CM","Content Modification",{"name":145},{"id":241,"name":242,"tactic":243},"D3-NTPM","Network Traffic Policy Mapping",{"name":118},{"id":245,"name":246,"tactic":247},"D3-KBPI","Kernel-based Process Isolation",{"name":145},{"id":249,"name":250,"tactic":251},"D3-PS","Process Suspension",{"name":154},{"id":253,"name":254,"tactic":255},"D3-HR","Host Reboot",{"name":154},[],[],[],[],[],[],"2026-09-28T17:55:28.805Z","2026-09-28T19:16:15.444Z","Received",{"cisa_kev":266,"cisa_ransomware":266,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":267,"severity_score":268,"severity_version":269,"severity_source":270,"severity_vector":271,"severity_status":264},false,"critical",9.1,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",[273,279,284],{"url":274,"sources":275,"tags":277},"https://github.com/dannymcc/bluehood/security/advisories/GHSA-qj2j-wcg3-74jw",[270,276],"nvd",[278],"X Refsource CONFIRM",{"url":280,"sources":281,"tags":282},"https://github.com/dannymcc/bluehood/commit/401479938c0deb1f6f6847d442f98a2d03efca68",[270,276],[283],"X Refsource MISC",{"url":285,"sources":286,"tags":287},"https://github.com/dannymcc/bluehood/releases/tag/v0.7.1",[270,276],[283],[],[],[291,296],{"source":270,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":292,"cvss_v4_0":9},{"baseScore":268,"baseSeverity":293,"vectorString":271,"impactScore":294,"exploitabilityScore":295},"CRITICAL",8.7,10,{"source":276,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":297,"cvss_v4_0":9},{"baseScore":268,"baseSeverity":293,"vectorString":271,"impactScore":294,"exploitabilityScore":295},[299],{"ecosystem":9,"name":300,"vendor":301,"product":300,"cpe_part":302,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":303},"bluehood","dannymcc","a",[304],{"version":305,"is_range":306,"range_type":270,"version_start":9,"version_start_type":9,"version_end":307,"version_end_type":308,"fixed_in":9},"\u003C 0.7.1",true,"0.7.1","excluding"]