CVE-2025-27853 | High | 7.3 | 2026-05-13 | The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows its authentication to be bypassed. The WDU web site only performs authentication wit… |
CVE-2025-27852 | Medium | 5.0 | 2026-05-13 | The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a reflected cross site scripting (XSS) attack. This allows an attacker on the local… |
CVE-2025-27851 | Critical | 9.3 | 2026-05-13 | The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a cross-site origin WebSocket hijacking attack. Among other uses, the WDU utilizes W… |
CVE-2025-27850 | High | 7.5 | 2026-05-13 | The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a symlink attack. If a malicious graphics package containing symlinks is uploaded, t… |
CVE-2023-23306 | Critical | 9.8 | 2023-05-23 | The `Toybox.Ant.BurstPayload.add` API method in CIQ API version 2.2.0 through 4.1.7 suffers from a type confusion vulnreability, which can result in an out-of-… |
CVE-2023-23305 | Critical | 9.8 | 2023-05-23 | The GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 is vulnerable to various buffer overflows when loading binary resources. A malicious applicat… |
CVE-2023-23304 | Critical | 9.1 | 2023-05-23 | The GarminOS TVM component in CIQ API version 2.1.0 through 4.1.7 allows applications with a specially crafted head section to use the `Toybox.SensorHistory` m… |
CVE-2023-23303 | Critical | 9.8 | 2023-05-23 | The `Toybox.Ant.GenericChannel.enableEncryption` API method in CIQ API version 3.2.0 through 4.1.7 does not validate its parameter, which can result in buffer… |
CVE-2023-23302 | Critical | 9.8 | 2023-05-23 | The `Toybox.GenericChannel.setDeviceConfig` API method in CIQ API version 1.2.0 through 4.1.7 does not validate its parameter, which can result in buffer overf… |
CVE-2023-23301 | Critical | 9.8 | 2023-05-23 | The `news` MonkeyC operation code in CIQ API version 1.0.0 through 4.1.7 fails to check that string resources are not extending past the end of the expected se… |
CVE-2023-23300 | Critical | 9.8 | 2023-05-23 | The `Toybox.Cryptography.Cipher.initialize` API method in CIQ API version 3.0.0 through 4.1.7 does not validate its parameters, which can result in buffer over… |
CVE-2023-23299 | High | 7.5 | 2023-05-23 | The permission system implemented and enforced by the GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 can be bypassed entirely. A malicious appli… |
CVE-2023-23298 | Critical | 9.8 | 2023-05-23 | The `Toybox.Graphics.BufferedBitmap.initialize` API method in CIQ API version 2.3.0 through 4.1.7 does not validate its parameters, which can result in integer… |
CVE-2022-46081 | High | 7.5 | 2023-01-04 | In Garmin Connect 4.61, terminating a LiveTrack session wouldn't prevent the LiveTrack API from continued exposure of private personal information. NOTE: this… |
CVE-2020-27486 | Critical | 9.9 | 2020-11-16 | Garmin Forerunner 235 before 8.20 is affected by: Buffer Overflow. The component is: ConnectIQ TVM. The attack vector is: To exploit the vulnerability, the att… |
CVE-2020-27485 | Critical | 9.9 | 2020-11-16 | Garmin Forerunner 235 before 8.20 is affected by: Array index error. The component is: ConnectIQ TVM. The attack vector is: To exploit the vulnerability, the a… |
CVE-2020-27484 | Critical | 9.9 | 2020-11-16 | Garmin Forerunner 235 before 8.20 is affected by: Integer Overflow. The component is: ConnectIQ TVM. The attack vector is: To exploit the vulnerability, the at… |
CVE-2020-27483 | Critical | 9.9 | 2020-11-16 | Garmin Forerunner 235 before 8.20 is affected by: Array index error. The component is: ConnectIQ TVM. The attack vector is: To exploit the vulnerability, the a… |
CVE-2009-0194 | | | 2009-05-11 | The domain-locking implementation in the GARMINAXCONTROL.GarminAxControl_t.1 ActiveX control in npGarmin.dll in the Garmin Communicator Plug-In 2.6.4.0 does no… |