CVE-2026-18844
High · 8.1CVSS
8.1
EPSS
0.2%
Published
Aug 11, 2026
CISA due date
—
The record
The firmware of the Pulsetto Vagus Nerve Stimulator accepts several undisclosed commands over its Bluetooth Low Energy (BLE) interface. These commands are sent without authentication or encryption, and are never issued by the companion mobile application, yet are fully processed by the device when it is powered on.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-15413 The Link Factory WordPress plugin is a backdoor. CWE-912
- CVE-2026-17032 Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's… CWE-912
- CVE-2026-14812 The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that… CWE-912
- CVE-2026-11976 The official MonsterInsights Pro update distribution bucket… CWE-912
- CVE-2026-61515 Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command… CWE-912
- CVE-2026-4769 Certain devices in the WAGO System I/O Field series activate an internal diagnostic… CWE-912
- CVE-2026-41446 Snap One WattBox 800 and 820 series firmware versions prior to 2.10.0.0 contain… CWE-912
- CVE-2026-1952 Delta Electronics AS320T has denial of service via the undocumented subfunction… CWE-912