CVEs we hold for Xiaomi

Records whose assigning authority named Xiaomi as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-26214Xiaomi Galaxy FDS Android SDK <= 3.0.8 TLS Hostname Verification Disabled Enables MITMXiaomi Technology Co., Ltd. Galaxy FDS Android SDK

CVE-2024-45361Mi Connect Service APP protocol flaws lead to leaking sensitive user informationXiaomi Mi Connect Service

CVE-2024-45356Xiaomi phone framework has unauthorized access vulnerabilityXiaomi phone framework has unauthorized access vulnerability

CVE-2024-45355Xiaomi phone framework has unauthorized access vulnerabilityXiaomi phone framework

CVE-2024-45354xiaomi shop application Webview has code execution vulnerabilityXiaomi shop application

CVE-2024-45353quick App has intent redriction vulnerabilityXiaomi quick app framework

CVE-2024-45352Xiaomi smarthome application Webview has code execution vulnerabilityXiaomi smarthome application

CVE-2024-45351Game center application has code execution VulnerabilityXiaomi Game center application

CVE-2024-45348Xiaomi Router AX9000 has a post-authorization command injection vulnerabilityXiaomi Router AX9000

CVE-2024-45347Mi Connect Service APP protocol flaws lead to unauthorized accessXiaomi Mi Connect Service

CVE-2024-45346GetApps application has code execution vulnerabilityXiaomi GetApps application

CVE-2024-4406Xiaomi Pro 13 GetApps integral-dialog-page Cross-Site Scripting Remote Code Execution VulnerabilityXiaomi Pro 13

CVE-2024-4405Xiaomi Pro 13 mimarket manual-upgrade Cross-Site Scripting Remote Code Execution VulnerabilityXiaomi Pro 13

CVE-2023-26324GetApps application has code execution vulnerabilityXiaomi GetApps application

CVE-2023-26323Xiaomi App Market has a code execution vulnerabilityXiaomi App Market

CVE-2023-26322GetApps application has code execution vulnerabilityXiaomi GetApps application

CVE-2023-26321The international version of Xiaomi File Manager has a path traversal vulnerabilityXiaomi File Manager App International Version

CVE-2023-26320Xiaomi Router external request interface vulnerability leads to stack overflowXiaomi Router

CVE-2023-26319Xiaomi Router administration interface vulnerability leads command injection and stack overflowXiaomi Router

CVE-2023-26318Xiaomi router web interface post-authorization stack overflowXiaomi Router

CVE-2023-26317Xiaomi router external request interface has command injectionXiaomi router

CVE-2023-26316no title heldn/a Xiaomi cloud service Application

CVE-2023-26315Xiaomi router has a command injection vulnerability after authorizationXiaomi Router AX9000

CVE-2020-14140no title heldn/a Xiaomi Multiple Devices

CVE-2020-14131no title heldn/a Xiaomi specific devices

CVE-2020-14130no title heldn/a Xiaomi community app

CVE-2020-14129no title heldn/a Xiaomi a certain APP

CVE-2020-14124no title heldn/a Xiaomi Router AX3600

CVE-2020-14119no title heldn/a Xiaomi Router AX3600

CVE-2020-14117no title heldn/a Xiaomi Content Center APP

CVE-2020-14115no title heldn/a Xiaomi Router AX3600

CVE-2020-14114no title heldn/a Xiaomi SmartHome APP

CVE-2020-14111no title heldn/a Xiaomi Router Router AX3600

CVE-2020-14109no title heldn/a Xiaomi Router AX3600

CVE-2020-14107no title heldn/a Xiaomi mirror screen

CVE-2020-14106no title heldn/a Xiaomi Mobile Phone

CVE-2020-14105no title heldn/a Xiaomi 10

CVE-2020-14104no title heldn/a Xiaomi router AX3600

CVE-2020-14103no title heldn/a Xiaomi 10

CVE-2020-14102no title heldn/a Xiaomi route RM1800

CVE-2020-14101no title heldn/a Xiaomi route RM1800

CVE-2020-14100no title heldn/a Xiaomi router R3600

CVE-2020-14099no title heldn/a Xiaomi Router AX1800,Xiaomi Rourer RM1800

CVE-2020-14098no title heldn/a Xiaomi route RM1800

CVE-2020-14097no title heldn/a Xiaomi router AX6

CVE-2020-14096no title heldn/a Xiaomi AI speaker

CVE-2020-14095no title heldXiaomi router R3600

CVE-2020-14094no title heldXiaomi router R3600

CVE-2019-6743no title heldXiaomi Browser

CVE-2019-13322no title heldXiaomi Browser

CVE-2019-13321no title heldXiaomi Browser

51 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.