CVE-2026-2756

A security vulnerability has been detected in OmniPEMF NeoRhythm up to 20260308. This affects an unknown function of the component BLE Interface. Such manipulation leads to missing authentication. The attack can only be initiated within the local network. This attack is characterized by high complexity. The exploitability is reported as difficult. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-287
• CWE-306

• https://ab3j.radio/NeoRhythm.pdf
• https://vuldb.com/cve/CVE-2026-2756
• https://vuldb.com/submit/774937
• https://vuldb.com/vuln/352383
• https://vuldb.com/vuln/352383/cti

Published

Mar 21, 2026

Last Modified

Sep 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27554A low-privileged remote attacker can exploit a command injec…8.8
• CVE-2026-27555A low-privileged remote attacker can exploit a local file in…8.8
• CVE-2026-27556A low-privileged remote attacker can exploit a local file in…8.8
• CVE-2026-27557An unauthenticated remote attacker can exploit a path traver…7.5
• CVE-2026-27558A low-privileged remote attacker can exploit a command injec…8.8
• CVE-2026-27559A low-privileged remote attacker can exploit a command injec…8.8
• CVE-2026-27560A high-privileged remote attacker can exploit a command inje…7.2
• CVE-2026-27561A high-privileged remote attacker can exploit a command inje…7.2
• CVE-2026-27562A high-privileged remote attacker can exploit a command inje…7.2
• CVE-2026-27563A high-privileged remote attacker can exploit a command inje…7.2
• CVE-2026-27564A high-privileged remote attacker can exploit a command inje…7.2
• CVE-2026-27565An unauthenticated remote attacker can upload a malicious IO…9.8