Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,443 results · page 2 of 29
Sep 15, 2026Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager.CVE-2026-49446 · Other software · azukaar · reported by GitHubMedium 6.1
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers and before invoking AdminOnlyWithRedirect. An attacker with a valid x-cstln-auth API key for an enrolled device who reaches Cosmos through the Constellation Nebula tunnel can supply a chosen x-cosmos-user value to a route with AuthEnabled enabled when the upstream application trusts that forward-auth header. The request can bypass Cosmos JWT, password, MFA, and AdminOnly checks, allowing user impersonation and admin-tier reads or writes exposed by the proxied application. This issue is fixed in version 0.22.19.
- Product
- Cosmos-Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software.CVE-2026-59178 · Other software · esphome · reported by GitHubCritical 9.8
ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from `$ESPHOME_USERNAME` and `$ESPHOME_PASSWORD`. Earlier versions, and the legacy `esphome` dashboard, read the bare `$USERNAME` and `$PASSWORD` instead. When the env vars were renamed the bare names were dropped with no fallback, so an operator who had protected their dashboard with `USERNAME` / `PASSWORD` (as the older getting started guide documented) loses authentication on upgrade and the dashboard starts open to anyone who can reach its port. The issue is fixed in 1.0.12. The bare `$USERNAME` / `$PASSWORD` are accepted again as a deprecated fallback so previously protected instances stay protected across the upgrade without operator intervention, with a loud deprecation warning at startup directing operators to rename them to `$ESPHOME_USERNAME` / `$ESPHOME_PASSWORD`. The fallback is gated on `$PASSWORD` being set and is only adopted as a pair, so the OS provided `$USERNAME` is never read on its own and the original collision footgun stays closed. A lone bare `$PASSWORD` with no username still fails loud as a cr
- Product
- device-builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2026Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor.CVE-2025-64059 · Other software · getgrav · reported by MITRELow 1.8
Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admins are allowed to modify templates, install plugins, and upload other executable content.
- Product
- Grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comdrive.google.com
Sep 7, 2026Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /.CVE-2026-86351 · Other software · MISP · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8Medium 5.1
Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers. The vulnerable homepage value can be stored as a user setting and later used by the post-login routing logic. The commit explicitly identifies //attacker.example as a payload that passed validation and was emitted to the Location header after login. The fix introduces a shared InternalRedirectValidator that rejects URLs containing a host, scheme, userinfo, unsafe leading // or /\, malformed URLs, and control characters. It also revalidates homepage settings on read so legacy or internally written unsafe values cannot bypass the new storage-time validation. Version affected: ≤2.5.45
- Product
- MISP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2026MyHome Core: Authentication BypassCVE-2026-15980 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the send_link() AJAX handler and improper token validation in the activate() function. This makes it possible for unauthenticated attackers to generate an activation token for an unconfirmed user account and obtain a valid authentication cookie for that account, including administrators. Successful exploitation requires the MyHome theme to be configured in legacy/WPBakery mode with frontend registration and confirmation email enabled, and the target account must not already have the myhome_agent_confirmed user meta set.
- Product
- MyHome Core
- Affected
- up to 4.4.5
- What to do
- Affects up to 4.4.5. Update MyHome Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Aug 26, 2026Multiple TP-Link Kasa smart home devices contain insufficient cryptographic protections in the local device communication protocol.CVE-2026-76784 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630High 8.7
Multiple TP-Link Kasa smart home devices contain insufficient cryptographic protections in the local device communication protocol. An adjacent network attacker may intercept, replay or forge locally exchanged control messages, potentially resulting in unauthorized device control. Successful exploitation could allow an attacker to manipulate the operational state of an affected device, resulting in unauthorized state changes, disruption of normal device functionality or a denial-of-service condition.
- Product
- HS103P3 / HS103P4 v5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtp-link.comtp-link.com
Aug 26, 2026Bird Home Automation GmbH D1101V-F 000140 is vulnerable to Incorrect Access Control via the Key derivation process, password validation process.CVE-2023-42179 · Other software · reported by MITRECritical 9.8
Bird Home Automation GmbH D1101V-F 000140 is vulnerable to Incorrect Access Control via the Key derivation process, password validation process.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026Rently Smart Home versions 20.1.0 and prior are vulnerable to an Insufficiently Protected Credentials vulnerability.CVE-2026-75960 · Other software · Rently · reported by ics-cert@hq.dhs.govHigh 8.7
Rently Smart Home versions 20.1.0 and prior are vulnerable to an Insufficiently Protected Credentials vulnerability. This could allow an attacker to retrieve pins including the Master Pin, overriding standard user permissions.
- Product
- Smart Home
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Runtipi is a personal homeserver orchestrator.CVE-2026-55168 · Other software · runtipi · reported by GitHubMedium 6.5
Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during the backup restore flow. An authenticated attacker can plant user-config/app.env as a symlink to an arbitrary reachable path and then send PUT /api/user-config/demoapp3:_user with attacker-controlled appEnv content. FilesystemService.writeTextFile() follows the planted link, allowing content to be written outside the intended restore and user-config directory boundary with Runtipi process permissions. This issue is fixed in version 4.10.1.
- Product
- runtipi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026nnn stores homelen variable as uchar_t, which can only represent values in the range 0-255.CVE-2026-65610 · Other software · nnn · reported by cvd@cert.plLow 2.4
nnn stores homelen variable as uchar_t, which can only represent values in the range 0-255. An attacker who can influence the victim's execution environment can provide an arbitrary HOME path with length that is truncated to 0. The expression (homelen - 1) is promoted to signed int and becomes -1 and producing an out-of-bounds read and an out-of-bounds write one byte before the path buffer. Maintainer of this project was notified about this vulnerability. It might has been addressed, but the maintainer did not provide a vulnerable version range. Only version 5.2 was tested and confirmed as vulnerable.
- Product
- nnn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files.CVE-2026-53458 · Other software · ha-china · reported by GitHubMedium 5.3
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio backend API handlers in custom_components/blueprint_studio/backend/api.py returned raw exception strings to authenticated Home Assistant users. Some exception messages could contain internal filesystem paths or implementation details. The disclosed information could help an authenticated user fingerprint a Home Assistant installation and refine follow-up attacks. This issue is fixed in version 2.5.2.
- Product
- blueprint-studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files.CVE-2026-53457 · Other software · ha-china · reported by GitHubMedium 5.1
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, the legacy stateless terminal command execution path in custom_components/blueprint_studio/backend/terminal_manager.py accepted a cwd working-directory parameter and checked only whether the directory existed, without requiring it to remain inside the Home Assistant configuration directory. An administrator using the restricted terminal helper could select an existing directory outside the intended configuration boundary. Commands could then access or modify host paths permitted by the Home Assistant container and filesystem permissions, weakening the helper's expected filesystem restriction. This issue is fixed in version 2.5.2.
- Product
- blueprint-studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files.CVE-2026-53456 · Other software · ha-china · reported by GitHubMedium 5.6
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio terminal SSH key authentication in custom_components/blueprint_studio/backend/terminal_manager.py wrote SSH private-key material to a file under the Home Assistant configuration directory before applying restrictive permissions and relied on best-effort cleanup. The key could temporarily remain on disk and could persist if cleanup failed or Home Assistant crashed. A user or process with filesystem access to the Home Assistant configuration directory could obtain the residual private key. This issue is fixed in version 2.5.2.
- Product
- blueprint-studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files.CVE-2026-53455 · Other software · ha-china · reported by GitHubHigh 8.6
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio generated a shell-based Git credential helper in custom_components/blueprint_studio/backend/git_manager.py by interpolating the configured Git username and token directly into executable helper script content without validating credential values. An attacker able to set Git credentials could include newline characters or shell syntax in a username or token. When Git executed the generated credential helper, the injected shell commands ran with the operating-system privileges of Home Assistant and could access or modify Home Assistant configuration data. This issue is fixed in version 2.5.2.
- Product
- blueprint-studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files.CVE-2026-53454 · Other software · ha-china · reported by GitHubMedium 6.9
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens in plaintext in the .git-credentials file for the user running Home Assistant. Tokens could remain outside Blueprint Studio's intended Home Assistant storage and be read by other users or processes with access to the same filesystem context. The persistent helper configuration also affected later Git operations beyond the immediate Blueprint Studio action. This issue is fixed in version 2.5.2.
- Product
- blueprint-studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files.CVE-2026-53453 · Other software · ha-china · reported by GitHubHigh 8.7
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio exposed administrator-intended backend API actions to any authenticated Home Assistant user because the backend did not consistently enforce the panel's admin-only authorization boundary. Affected surfaces included the backend API, upload API, stream routes, terminal WebSocket, Blueprint Studio WebSocket subscriptions, call_service, render_template, global_replace, file and stream access paths, upload handling, and terminal helpers. A non-admin user could invoke arbitrary Home Assistant services, expose Home Assistant state through templates, modify configuration files, access streamed or downloaded configuration content, upload files, or reach terminal-related helpers. These actions could compromise the confidentiality, integrity, and availability of the Home Assistant installation. This issue is fixed in version 2.5.2.
- Product
- blueprint-studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration.CVE-2026-72836 · Other software · filebrowser · reported by VulnCheckCritical 9.2
FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem (confirmed on Windows/NTFS), two self-registered usernames that differ only in letter case (e.g., CaseVictim and casevictim) are stored as distinct accounts but resolve to the same physical home directory, because the scope-ownership check compares the persisted scope as an exact case-sensitive string. A second registrant can therefore read, overwrite, and delete another account's files through authenticated HTTP endpoints, without needing an existing account or victim interaction.
- Product
- filebrowser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contentsCVE-2026-58444 · Other software · Gitea · reported by 88ee5874-cf24-4952-aea0-31affedb7ff2Medium 4.3
Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents
- Product
- Gitea Open Source Git Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.gitea.comgithub.com
Aug 10, 2026When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home diCVE-2026-6791 · Other software · The GNU C Library · reported by 3ff69d7a-14f2-4f67-a097-88dee7810d18Medium 6.6
When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.
- Product
- glibc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed userCVE-2026-16742 · Other software · systemd · reported by 98a521c5-3a3e-4e2b-bc27-002067e0463cMedium 6.7
systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user
- Product
- systemd-homed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2026Home Assistant is open source home automation software focused on local control and privacy.CVE-2026-66061 · Other software · home-assistant · reported by GitHubHigh 7.1
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.0, the iOS Companion app treats tag links (NFC or QR) delivered through an OS-level routing mechanism such as iOS universal links as if they were physically scanned, without validating the calling app or prompting the user. As a result, any untrusted app on the device can forward an arbitrary tag to Home Assistant, causing it to execute the associated automation as though a legitimate user had scanned an authorized tag. This allows silent, unattended automation execution by untrusted local callers. This issue has been fixed in version 2026.5.0.
- Product
- core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2026Home Assistant is open source home automation software focused on local control and privacy.CVE-2026-66060 · Other software · home-assistant · reported by GitHubHigh 7.1
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.3, the Companion app treats tag links (NFC or QR) delivered through an OS-level routing mechanism as if they were physically scanned, without validating the calling app or prompting the user. As a result, any untrusted app on the device can forward an arbitrary tag to Home Assistant, causing it to execute the associated automation as though a legitimate user had scanned an authorized tag. This allows silent, unattended automation execution by untrusted local callers. This issue is fixed in version 2026.8.1.
- Product
- core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2026Home Assistant is open source home automation software focused on local control and privacy.CVE-2026-59717 · Other software · home-assistant · reported by GitHubMedium 4.3
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the destination hostname. Because no screen in the invitation or onboarding flow shows the parsed server URL before onboarding commits to it, a victim has no way to distinguish a legitimate invite from a malicious one. An attacker can craft an invite so that a single tap on the legitimate-looking "Connect to my Home Assistant server" button opens their /auth/authorize endpoint in the URL-less onboarding WebView, presenting a look-alike login page that captures the victim's credentials. Since invitations are intended to onboard brand-new users, targets are especially unlikely to notice the substitution. This issue is fixed in version 2026.6.1.
- Product
- core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026RealHomes Memberships: Does not verify that a membership payment actually completedCVE-2026-15246 · WordPress plugins & themes · reported by WPScanMedium 4.3
The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package, allowing any authenticated user such as a Subscriber to obtain paid membership packages without paying.
- Product
- RealHomes Memberships
- Fixed in
- 3.1.0
- What to do
- Update RealHomes Memberships to 3.1.0 or newer.
Aug 5, 2026ESPHome through 2026.7.0-dev discloses plaintext passwords via its web_server component.CVE-2026-71260 · Other software · esphome · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cMedium 6.5
ESPHome through 2026.7.0-dev discloses plaintext passwords via its web_server component. In WebServer::text_json_ (esphome/components/web_server/web_server.cpp), a text entity configured with mode: password (TEXT_MODE_PASSWORD) has its JSON "state" field correctly masked as "********", but the same serialization path unconditionally writes the raw password into the JSON "value" field via set_json_icon_state_value/set_json_value.
- Product
- esphome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/config_validation.py.CVE-2026-71259 · Other software · esphome · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 8.6
ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/config_validation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the external_components YAML directive's git source schema, which is passed to (git supports file:// natively).
- Product
- esphome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026299Ko's public contact form (plugin/contact/controllers/ContactController.php, home) sets raw POST field values (name, firstname, email, message) into the page CVE-2026-71249 · Other software · 299ko · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cMedium 6.1
299Ko's public contact form (plugin/contact/controllers/ContactController.php, home) sets raw POST field values (name, firstname, email, message) into the page template with no sanitization. The template engine's variable output function (common/Template.php, _show_var) echoes values with no htmlspecialchars call, and the sink template (contact.tpl) outputs these values unescaped into an HTML attribute and a textarea.
- Product
- 299Ko
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID='<decoded lastLogin cookie>' after base64-decodCVE-2026-71231 · Other software · thebradleysanders · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cCritical 9.8
IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID='<decoded lastLogin cookie>' after base64-decoding the client-supplied lastLogin cookie via safe_decode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string.
- Product
- IOTSmartHome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2026RealHomes Memberships: Authorization bypassCVE-2026-10782 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RealHomes Memberships plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to grant themselves any premium membership tier without completing a PayPal transaction, generating a falsified active payment receipt and gaining unauthorized access to restricted property listing allowances.
- Product
- RealHomes Memberships
- Affected
- up to 3.0.9
- What to do
- Affects up to 3.0.9. Update RealHomes Memberships to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 29, 2026Autel MaxiCharger AC Elite Home NFC Stack-based Buffer Overflow Arbitrary Code Execution Vulnerability.CVE-2026-13309 · Other software · Autel · reported by zdi-disclosures@trendmicro.comMedium 6.8
Autel MaxiCharger AC Elite Home NFC Stack-based Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of card responses via the NFC interface. A crafted card response can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29044.
- Product
- MaxiCharger AC Elite Home
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Execution Vulnerability.CVE-2026-13308 · Other software · Autel · reported by zdi-disclosures@trendmicro.comHigh 8.1
Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of WebSocket messages related to the OCPP service. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29113.
- Product
- MaxiCharger AC Elite Home
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026Autel MaxiCharger AC Elite Home USB Heap-based Buffer Overflow Arbitrary Code Execution Vulnerability.CVE-2026-13307 · Other software · Autel · reported by zdi-disclosures@trendmicro.comMedium 6.8
Autel MaxiCharger AC Elite Home USB Heap-based Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of custom USB packets. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29048.
- Product
- MaxiCharger AC Elite Home
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026Autel MaxiCharger AC Elite Home USB Authentication Bypass Vulnerability.CVE-2026-13306 · Other software · Autel · reported by zdi-disclosures@trendmicro.comMedium 4.3
Autel MaxiCharger AC Elite Home USB Authentication Bypass Vulnerability. This vulnerability allows physically present attackers to bypass authentication on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the exposed USB interface. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-29046.
- Product
- MaxiCharger AC Elite Home
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026Autel MaxiCharger AC Elite Home Software Update Improper Verification of Cryptographic Signature Arbitrary Code Execution Vulnerability.CVE-2026-13305 · Other software · Autel · reported by zdi-disclosures@trendmicro.comMedium 6.4
Autel MaxiCharger AC Elite Home Software Update Improper Verification of Cryptographic Signature Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of software updates. The issue results from the lack of proper validation of a user-supplied software update image. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29062.
- Product
- MaxiCharger AC Elite Home
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager.CVE-2026-49447 · Other software · azukaar · reported by GitHubMedium 5.3
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, `GET /cosmos/api/constellation/public-devices` discloses Constellation device metadata to a requester that supplies any non-empty Authorization header. The handler strips the string Bearer from the header but never validates the resulting token and never uses it in the database query. This vulnerability is fixed in 0.22.19.
- Product
- Cosmos-Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulnerability could allow an unauthorized actoCVE-2026-16581 · Other software · igloohome · reported by ics-cert@hq.dhs.govMedium 6.9
In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulnerability could allow an unauthorized actor to access functions or backend services that were not sufficiently protected by authentication controls.
- Product
- Smart Lock Mobile Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers tCVE-2026-48535 · Other software · GFI Software · reported by VulnCheckMedium 5.1
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the proxy server address parameter to /Archiver/CallHomeSettingsWizard.aspx. The injected payload is stored by CallHomeSettingsWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the General Settings Additional Settings page.
- Product
- GFI Archiver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on tCVE-2026-64825 · Other software · home-assistant · reported by VulnCheckCritical 9
Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem by uploading a crafted backup archive during the initial onboarding window. Attackers can manipulate the 'name' field inside the uploaded archive's backup.json to supply an absolute path, causing pathlib.Path.__truediv__ to discard the configured backup directory prefix and write attacker-controlled content to arbitrary locations, with full filesystem access when the process runs as root.
- Product
- Home Assistant Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absCVE-2026-64824 · Other software · home-assistant · reported by VulnCheckCritical 9.3
Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absolute filesystem paths by supplying a crafted tar archive with a SYMTYPE entry containing a benign member name paired with an absolute linkname pointing outside the extraction directory. Because the official Docker image runs the Home Assistant process as root and the subsequent regular-file entry is written through the unvalidated symlink, attackers can achieve remote code execution by overwriting auto-imported Python paths such as site-packages/sitecustomize.py or custom component directories.
- Product
- Home Assistant Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's async_get_media_image() method that allows attackeCVE-2026-64823 · Other software · home-assistant · reported by VulnCheckLow 2.1
Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's async_get_media_image() method that allows attackers controlling a Shelly device's thumb field to serve arbitrary HTML content by supplying a data URI with a text/html content type without validation against an image-only allowlist. Attackers can cause the media player proxy endpoint to serve attacker-controlled bytes with Content-Type text/html in the Home Assistant web origin, enabling theft of session tokens from local storage and authenticated calls to sensitive service endpoints including lock, alarm, and cover controls.
- Product
- Home Assistant Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026AdGuard Home is a network-wide software for blocking ads and tracking.CVE-2026-47703 · Other software · AdguardTeam · reported by GitHubMedium 6.3
AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.75, AdGuard Home's client-triggered DoQ forwarding path to a udp:// upstream reduced backend UDP DNS state by producing dns_id=0 or txid=0 and exposed a quoted-port ICMP source-port oracle, weakening DNS response matching for forwarded queries. This issue is fixed in version 0.107.75.
- Product
- AdGuardHome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, in the interaction model command processing logic.CVE-2025-56365 · Other software · Csa-iot · reported by MITREMedium 5.7
A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, in the interaction model command processing logic. When an InvokeCommandRequest is sent to a nonexistent endpoint and cluster (e.g., 0x34), the code incorrectly treats the endpoint as valid due to missing checks in CodegenDataModelProvider::Invoke. This causes a VerifyOrDie failure in ProcessCommandDataIB and results in a crash (SIGABRT). The issue has been acknowledged and fixed in a later revision (PR #37207).
- Product
- Matter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026A use of uninitialized value vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, where the `GetDestinationGroupId().Value()` method is calledCVE-2025-56364 · Other software · Csa-iot · reported by MITREMedium 5.7
A use of uninitialized value vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, where the `GetDestinationGroupId().Value()` method is called without first checking whether a value exists. This leads to a crash when an InvokeCommand is sent without initializing the destination group ID. The issue affects all versions before commit 0360cc3 (Dec 5, 2024) and leads to denial of service through SIGABRT. It is fixed by adding a .HasValue() check before access.
- Product
- Matter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, affecting the ReadRevisionAttribute function used in multiple CVE-2025-56363 · Other software · Csa-iot · reported by MITREMedium 5.7
A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, affecting the ReadRevisionAttribute function used in multiple clusters (Channel, Account Login, TargetNavigator, etc.). The function lacks proper validation of the delegate pointer before dereferencing. A remote unauthenticated attacker can exploit this issue by sending a crafted read request, causing the device to crash (denial of service). This issue has been confirmed in SDK version v1.4 (commit ab3d5ae).
- Product
- Matter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.2, specifically within the Level Control cluster's periodic server ticCVE-2025-56362 · Other software · Csa-iot · reported by MITREMedium 5.7
A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.2, specifically within the Level Control cluster's periodic server tick logic. When a MoveToLevel command is sent and immediately followed by a write of OperationMode=2 (in the Pump Configuration and Control cluster), the server tick function violates the assertion `currentLevel < maxLevel`, resulting in a crash. This can be exploited remotely without authentication to cause denial of service. Affected versions include 1.3 and 1.4 (commit ab3d5ae).
- Product
- Matter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) 1.3 thru 1.4, specifically within the Level Control cluster's server tick logic (CVE-2025-56361 · Other software · Csa-iot · reported by MITREMedium 5.7
A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) 1.3 thru 1.4, specifically within the Level Control cluster's server tick logic (`emberAfLevelControlClusterServerTickCallback`). When a MoveToLevel command is executed and followed by a conflicting write to the OperationMode attribute (in the Pump Configuration and Control cluster), an invariant check (`minLevel < currentLevel`) fails and causes the device to abort. This leads to a denial of service condition. The issue is confirmed in SDK versions 1.3 and 1.4 (commit ab3d5ae), and is triggered remotely without authentication.
- Product
- Matter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2026A vulnerability was identified in sergomanov SmartHomeAdatum up to cf495353d81b680675eb8d9aa14a318aa45ce12c.CVE-2026-15498 · Other software · sergomanov · reported by VulDBMedium 6.9
A vulnerability was identified in sergomanov SmartHomeAdatum up to cf495353d81b680675eb8d9aa14a318aa45ce12c. This impacts an unknown function of the file users.php of the component Login. Such manipulation of the argument Login leads to sql injection. The attack may be launched remotely. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SmartHomeAdatum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication.CVE-2026-55726 · Other software · Gardyn · reported by ics-cert@hq.dhs.govMedium 6.9
The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication. A malicious user would be able to access any device log file available in the blob storage container.
- Product
- Gardyn Home Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commygardyn.com
Jul 2, 2026The admin panel lacks standard security headers, enabling clickjacking and cross-site scripting attacks.CVE-2026-54477 · Other software · Gardyn · reported by ics-cert@hq.dhs.govMedium 5.1
The admin panel lacks standard security headers, enabling clickjacking and cross-site scripting attacks.
- Product
- Gardyn Home Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commygardyn.com
Jul 2, 2026Gardyn devices expose a privileged iothubowner key.CVE-2026-13768 · Other software · Gardyn · reported by ics-cert@hq.dhs.govCritical 9.5
Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user to invoke an IoTHub Registry Manager function which returns connection information for all Gardyn Home Kit and Studio devices. Access to this key also allows a malicious user to execute arbitrary commands on a specific connected device and may allow the malicious user to pivot to other devices on the user's network.
- Product
- Gardyn Home Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commygardyn.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.