Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,170 results · page 3 of 24
Apr 28, 2026Penetration Testing engineers at Amazon discovered a vulnerability where the camera system failed to properly validate input, allowing specially crafted requestCVE-2024-54012 · Other software · Hanwha Vision · reported by fc9afe74-3f80-4fb7-a313-e6f036a89882High 8.5
Penetration Testing engineers at Amazon discovered a vulnerability where the camera system failed to properly validate input, allowing specially crafted requests containing malicious commands to be executed on the device. The manufacturer has released patch firmware for the flaw; please refer to the manufacturer's report for details and workarounds.
- Product
- QND-8080R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2026Penetration Testing engineers at Amazon have discovered a flaw where the camera system fails to properly handle data supplied in certain requests, causing a serCVE-2024-54011 · Other software · Hanwha Vision · reported by fc9afe74-3f80-4fb7-a313-e6f036a89882Medium 5.3
Penetration Testing engineers at Amazon have discovered a flaw where the camera system fails to properly handle data supplied in certain requests, causing a service disruption. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.
- Product
- QND-8080R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2026A command injection vulnerability exists in the web server of specific firmware versions of Milesight cameras.CVE-2026-32649 · Other software · Milesight · reported by ics-cert@hq.dhs.govHigh 7.3
A command injection vulnerability exists in the web server of specific firmware versions of Milesight cameras.
- Product
- MS-Cxx63-PD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2026Specific firmware versions of Milesight AIOT cameras use SSL certificates with default private keys.CVE-2026-32644 · Other software · Milesight · reported by ics-cert@hq.dhs.govCritical 9.2
Specific firmware versions of Milesight AIOT cameras use SSL certificates with default private keys.
- Product
- MS-Cxx63-PD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2026An out-of-bounds memory access vulnerability exists in specific firmware versions of Milesight AIOT cameras.CVE-2026-20766 · Other software · Milesight · reported by ics-cert@hq.dhs.govHigh 8.6
An out-of-bounds memory access vulnerability exists in specific firmware versions of Milesight AIOT cameras.
- Product
- MS-Cxx63-PD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2026Specific firmware versions of Milesight AIOT camera firmware contain hard-coded credentials.CVE-2026-27785 · Other software · Milesight · reported by ics-cert@hq.dhs.govHigh 7.7
Specific firmware versions of Milesight AIOT camera firmware contain hard-coded credentials.
- Product
- MS-Cxx63-PD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2026A weak key generation vulnerability exists in specific firmware versions of Milesight AIOT cameras allows authorization to be bypassed.CVE-2026-28747 · Other software · Milesight · reported by ics-cert@hq.dhs.govHigh 7.3
A weak key generation vulnerability exists in specific firmware versions of Milesight AIOT cameras allows authorization to be bypassed.
- Product
- MS-Cxx63-PD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2026MERCURY MIPC252W IP camera 1.0.5 Build 230306 Rel.79931n contains an improper authentication vulnerability in the RTSP service.CVE-2026-35903 · Other software · Mercurycom · reported by MITRECritical 9.8
MERCURY MIPC252W IP camera 1.0.5 Build 230306 Rel.79931n contains an improper authentication vulnerability in the RTSP service. After successful Digest authentication in an initial DESCRIBE request, the device does not verify the Digest response parameter in subsequent RTSP requests within the same session. As a result, RTSP methods such as SETUP, PLAY, and TEARDOWN can be processed even when the Authorization header contains an empty or invalid response value, as long as the nonce and session identifier correspond to a previously authenticated session. This allows an attacker with network access to reuse session parameters and issue unauthorized RTSP control commands without computing a valid Digest response.
- Product
- Mipc252w Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2026The RTSP service of MERCURY IP camera MIPC252W 1.0.5 Build 230306 has an issue handling failed Digest authentication attempts.CVE-2026-35902 · Other software · Mercurycom · reported by MITREMedium 6.2
The RTSP service of MERCURY IP camera MIPC252W 1.0.5 Build 230306 has an issue handling failed Digest authentication attempts. By repeatedly sending RTSP requests with invalid authentication parameters, an unauthenticated attacker can cause the RTSP service to enter a persistent authentication failure state, preventing legitimate clients from authenticating and leading to a denial of service.
- Product
- Mipc252w Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026The installers of LiveOn Meet Client for Windows (Downloader5Installer.exe and Downloader5InstallerForAdmin.exe) and the installers of Canon Network Camera PlugCVE-2026-32679 · Other software · Japan Media Systems Corporation · reported by vultures@jpcert.or.jpHigh 8.4
The installers of LiveOn Meet Client for Windows (Downloader5Installer.exe and Downloader5InstallerForAdmin.exe) and the installers of Canon Network Camera Plugin (CanonNWCamPlugin.exe and CanonNWCamPluginForAdmin.exe) insecurely load Dynamic Link Libraries (DLLs). If a malicious DLL is placed at the same directory, the affected installer may load that DLL and execute its code with the privilege of the user invoking the installer.
- Product
- Downloader5Installer.exe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpweb.liveon.ne.jp
Apr 17, 2026libgphoto2 is a camera access and control library.CVE-2026-40341 · Other software · gphoto · reported by GitHubLow 3.5
libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, an out of bound read in ptp_unpack_EOS_FocusInfoEx could be used to crash libgphoto2 when processing input from untrusted USB devices. Commit c385b34af260595dfbb5f9329526be5158985987 contains a patch. No known workarounds are available.
- Product
- libgphoto2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026libgphoto2 is a camera access and control library.CVE-2026-40340 · Other software · gphoto · reported by GitHubMedium 6.1
libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read vulnerability in `ptp_unpack_OI()` in `camlibs/ptp2/ptp-pack.c` (lines 530–563). The function validates `len < PTP_oi_SequenceNumber` (i.e., len < 48) but subsequently accesses offsets 48–56, up to 9 bytes beyond the validated boundary, via the Samsung Galaxy 64-bit objectsize detection heuristic. Commit 7c7f515bc88c3d0c4098ac965d313518e0ccbe33 fixes the issue.
- Product
- libgphoto2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026libgphoto2 is a camera access and control library.CVE-2026-40339 · Other software · gphoto · reported by GitHubMedium 5.2
libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack.c` (line 842). The function reads the FormFlag byte via `dtoh8o(data, *poffset)` without a prior bounds check. The standard `ptp_unpack_DPD()` at lines 686–687 correctly validates `*offset + sizeof(uint8_t) > dpdlen` before this same read, but the Sony variant omits this check entirely. Commit 09f8a940b1e418b5693f5c11e3016a1ad2cea62d fixes the issue.
- Product
- libgphoto2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026libgphoto2 is a camera access and control library.CVE-2026-40338 · Other software · gphoto · reported by GitHubMedium 5.2
libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in the PTP_DPFF_Enumeration case of `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack.c` (line 856). The function reads a 2-byte enumeration count N via `dtoh16o(data, *poffset)` without verifying that 2 bytes remain in the buffer. The standard `ptp_unpack_DPD()` at line 704 has this exact check, confirming the Sony variant omitted it by oversight. Commit 3b9f9696be76ae51dca983d9dd8ce586a2561845 fixes the issue.
- Product
- libgphoto2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026libgphoto2 is a camera access and control library.CVE-2026-40336 · Other software · gphoto · reported by GitHubLow 2.4
libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have a memory leak in `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack.c` (lines 884–885). When processing a secondary enumeration list (introduced in 2024+ Sony cameras), the function overwrites dpd->FORM.Enum.SupportedValue with a new calloc() without freeing the previous allocation from line 857. The original array and any string values it contains are leaked on every property descriptor parse. Commit 404ff02c75f3cb280196fc260a63c4d26cf1a8f6 fixes the issue.
- Product
- libgphoto2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026libgphoto2 is a camera access and control library.CVE-2026-40335 · Other software · gphoto · reported by GitHubMedium 5.2
libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in `ptp_unpack_DPV()` in `camlibs/ptp2/ptp-pack.c` (lines 622–629). The UINT128 and INT128 cases advance `*offset += 16` without verifying that 16 bytes remain in the buffer. The entry check at line 609 only guarantees `*offset < total` (at least 1 byte available), leaving up to 15 bytes unvalidated. Commit 433bde9888d70aa726e32744cd751d7dbe94379a patches the issue.
- Product
- libgphoto2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026libgphoto2 is a camera access and control library.CVE-2026-40334 · Other software · gphoto · reported by GitHubLow 3.5
libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, a missing null terminator exists in ptp_unpack_Canon_FE() in camlibs/ptp2/ptp-pack.c (line 1377). The function copies a filename into a 13-byte buffer using strncpy without explicitly null-terminating the result. If the source data is exactly 13 bytes with no null terminator, the buffer is left unterminated, leading to out-of-bounds reads in any subsequent string operation. Commit 259fc7d3bfe534ce4b114c464f55b448670ab873 patches the issue.
- Product
- libgphoto2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026libgphoto2 is a camera access and control library.CVE-2026-40333 · Other software · gphoto · reported by GitHubMedium 6.1
libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, two functions in camlibs/ptp2/ptp-pack.c accept a data pointer but no length parameter, performing unbounded reads. Their callers in ptp_unpack_EOS_events() have xsize available but never pass it, leaving both functions unable to validate reads against the actual buffer boundary. Commit 1817ecead20c2aafa7549dac9619fe38f47b2f53 patches the issue.
- Product
- libgphoto2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026Anviz CX7 Firmware is vulnerable to an unauthenticated POST to the device that captures a photo with the front facing camera, exposing visual information aboutCVE-2026-33093 · Other software · Anviz · reported by ics-cert@hq.dhs.govMedium 5.3
Anviz CX7 Firmware is vulnerable to an unauthenticated POST to the device that captures a photo with the front facing camera, exposing visual information about the deployment environment.
- Product
- Anviz CX7 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026Improper access control in Samsung Camera prior to version 16.5.00.28 allows local attacker to access location data.CVE-2026-21014 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.1
Improper access control in Samsung Camera prior to version 16.5.00.28 allows local attacker to access location data. User interaction is required for triggering this vulnerability.
- Product
- Samsung Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Apr 6, 2026Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.CVE-2026-21378 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.CVE-2026-21376 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2026A buffer overflow vulnerability exists in the ONVIF GetStreamUri function of LSC Indoor Camera V7.6.32.CVE-2025-69986 · Other software · reported by MITREHigh 7.2
A buffer overflow vulnerability exists in the ONVIF GetStreamUri function of LSC Indoor Camera V7.6.32. The application fails to validate the length of the Protocol parameter inside the Transport element. By sending a specially crafted SOAP request containing an oversized protocol string, an attacker can overflow the stack buffer, overwriting the return instruction pointer (RIP). This vulnerability allows for Denial of Service (DoS) via device crash or Remote Code Execution (RCE) in the context of the ONVIF service.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras.CVE-2026-33470 · Other software · blakeblackshear · reported by GitHubMedium 6.5
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In version 0.17.0, a low-privilege authenticated user restricted to one camera can access snapshots from other cameras. This is possible through a chain of two authorization problems: `/api/timeline` returns timeline entries for cameras outside the caller's allowed camera set, then `/api/events/{event_id}/snapshot-clean.webp` declares `Depends(require_camera_access)` but never actually validates `event.camera` after looking up the event. Together, this allows a restricted user to enumerate event IDs from unauthorized cameras and then fetch clean snapshots for those events. Version 0.17.1 fixes the issue.
- Product
- frigate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras.CVE-2026-33469 · Other software · blakeblackshear · reported by GitHubMedium 6.5
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In version 0.17.0, an authenticated non-admin user can retrieve the full raw Frigate configuration through `/api/config/raw`. This exposes sensitive values that are intentionally redacted from `/api/config`, including camera credentials, go2rtc stream credentials, MQTT passwords, proxy secrets, and any other secrets stored in `config.yml`. This appears to be a broken access control issue introduced by the admin-by-default API refactor: `/api/config/raw_paths` is admin-only, but `/api/config/raw` is still accessible to any authenticated user. Version 0.17.1 contains a patch.
- Product
- frigate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026A buffer overflow vulnerability in the dgiot binary in LSC Smart Indoor IP Camera V7.6.32.CVE-2024-51347 · Other software · reported by MITREHigh 7.2
A buffer overflow vulnerability in the dgiot binary in LSC Smart Indoor IP Camera V7.6.32. The flaw exists in the handling of the Time Zone (TZ) parameter within the ONVIF configuration interface. The time zone (TZ) parameter does not have its length properly validated before being copied into a fixed-size buffer using the insecure strcpy function.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras.CVE-2026-33126 · Other software · blakeblackshear · reported by GitHubMedium 5
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to version 0.16.3, the /ffprobe endpoint accepts arbitrary user-controlled URLs without proper validation, allowing Server-Side Request Forgery (SSRF) attacks. An attacker can use the Frigate server to make HTTP requests to internal network resources, cloud metadata services, or perform port scanning. This issue has been patched in version 0.16.3.
- Product
- frigate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras.CVE-2026-33125 · Other software · blakeblackshear · reported by GitHubHigh 7.1
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In versions 0.16.2 and below, users with the viewer role can delete admin and low-privileged user accounts. Exploitation can lead to DoS and affect data integrity. This issue has been patched in version 0.16.3.
- Product
- frigate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras.CVE-2026-33124 · Other software · blakeblackshear · reported by GitHubHigh 8.6
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Versions prior to 0.17.0-beta1 allow any authenticated user to change their own password without verifying the current password through the /users/{username}/password endpoint. Changing a password does not invalidate existing JWT tokens, and there is no validation of password strength. If an attacker obtains a valid session token (e.g., via accidentally exposed JWT, stolen cookie, XSS, compromised device, or sniffing over HTTP), they can change the victim’s password and gain permanent control of the account. Since password changes do not invalidate existing JWT tokens, session hijacks persist even after a password reset. Additionally, the lack of password strength validation exposes accounts to brute-force attacks. This issue has been resolved in version 0.17.0-beta1.
- Product
- frigate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026A vulnerability was identified in Yi Technology YI Home Camera 2 2.1.1_20171024151200.CVE-2026-4478 · Other software · Yi Technology · reported by VulDBHigh 8.2
A vulnerability was identified in Yi Technology YI Home Camera 2 2.1.1_20171024151200. This impacts an unknown function of the file home/web/ipc of the component HTTP Firmware Update Handler. The manipulation leads to improper verification of cryptographic signature. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- YI Home Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026A vulnerability was determined in Yi Technology YI Home Camera 2 2.1.1_20171024151200.CVE-2026-4477 · Other software · Yi Technology · reported by VulDBLow 1.3
A vulnerability was determined in Yi Technology YI Home Camera 2 2.1.1_20171024151200. This affects an unknown function of the component WPA/WPS. Executing a manipulation can lead to use of hard-coded cryptographic key . The attack can only be done within the local network. This attack is characterized by high complexity. The exploitability is reported as difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- YI Home Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026A vulnerability was found in Yi Technology YI Home Camera 2 2.1.1_20171024151200.CVE-2026-4476 · Other software · Yi Technology · reported by VulDBLow 2.1
A vulnerability was found in Yi Technology YI Home Camera 2 2.1.1_20171024151200. The impacted element is an unknown function of the file home/web/ipc of the component CGI Endpoint. Performing a manipulation results in missing authentication. Access to the local network is required for this attack. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- YI Home Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026A vulnerability has been found in Yi Technology YI Home Camera 2 2.1.1_20171024151200.CVE-2026-4475 · Other software · Yi Technology · reported by VulDBHigh 7.4
A vulnerability has been found in Yi Technology YI Home Camera 2 2.1.1_20171024151200. The affected element is an unknown function of the file home/web/ipc. Such manipulation leads to hard-coded credentials. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- YI Home Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026iSmartViewPro 1.3.34 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the camera ID input field.CVE-2019-25354 · Other software · Shenzhen Smarteye Digital Electronics Co., Ltd. · reported by VulnCheckMedium 4.6
iSmartViewPro 1.3.34 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the camera ID input field. Attackers can paste a 257-character buffer into the camera DID and password fields to trigger an application crash on iOS devices.
- Product
- iSmartViewPro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsmarteyegroup.comapps.apple.com
Feb 11, 2026P2PWIFICAM2 for iOS 10.4.1 contains a denial of service vulnerability that allows attackers to crash the application by manipulating the Camera ID input field.CVE-2020-37175 · Other software · Ka Ming Cheung · reported by VulnCheckMedium 4.6
P2PWIFICAM2 for iOS 10.4.1 contains a denial of service vulnerability that allows attackers to crash the application by manipulating the Camera ID input field. Attackers can paste a 257-character buffer into the Camera ID field to trigger an application crash on iOS devices.
- Product
- P2PWIFICAM2 for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.cnet.comexploit-db.com
Feb 10, 2026An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appropriate permissions.CVE-2025-12063 · Other software · Axis Communications AB · reported by product-security@axis.comMedium 5.7
An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appropriate permissions.
- Product
- AXIS Camera Station Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026A server-side injection was possible for a malicious admin to manipulate the application to include a malicious script which is executed by the server.CVE-2025-13064 · Other software · Axis Communications AB · reported by product-security@axis.comMedium 4.5
A server-side injection was possible for a malicious admin to manipulate the application to include a malicious script which is executed by the server. This attack is only possible if the admin uses a client that have been tampered with.
- Product
- AXIS Camera Station Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026An AXIS Camera Station Pro feature can be exploited in a way that allows a non-admin user to view information they are not permitted to.CVE-2025-12757 · Other software · Axis Communications AB · reported by product-security@axis.comMedium 4.6
An AXIS Camera Station Pro feature can be exploited in a way that allows a non-admin user to view information they are not permitted to.
- Product
- AXIS Camera Station Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026AXIS Camera Station Pro contained a flaw to perform a privilege escalation attack on the server as a non-admin user.CVE-2025-11547 · Other software · Axis Communications AB · reported by product-security@axis.comHigh 7.8
AXIS Camera Station Pro contained a flaw to perform a privilege escalation attack on the server as a non-admin user.
- Product
- AXIS Camera Station Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026DBPower C300 HD Camera contains a configuration disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive credentials through an unprCVE-2020-37157 · Other software · DBPower · reported by VulnCheckHigh 8.7
DBPower C300 HD Camera contains a configuration disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive credentials through an unprotected configuration backup endpoint. Attackers can download the configuration file and extract hardcoded username and password by accessing the /tmpfs/config_backup.bin resource.
- Product
- DBPower C300 HD Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordweb.archive.orgexploit-db.com
Feb 6, 2026ACE Security WiP-90113 HD Camera contains a configuration disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration filCVE-2020-37146 · Other software · ACE SECURITY · reported by VulnCheckHigh 8.7
ACE Security WiP-90113 HD Camera contains a configuration disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration files. Attackers can access the camera's configuration backup by sending a GET request to the /config_backup.bin endpoint, exposing credentials and system settings.
- Product
- Aptina AR0130 960P 1.3MP Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordacesecurity.jpacesecurity.jp
Feb 6, 2026Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras.CVE-2026-25643 · Other software · blakeblackshear · reported by GitHubCritical 9.1
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to 0.16.4, a critical Remote Command Execution (RCE) vulnerability has been identified in the Frigate integration with go2rtc. The application does not sanitize user input in the video stream configuration (config.yaml), allowing direct injection of system commands via the exec: directive. The go2rtc service executes these commands without restrictions. This vulnerability is only exploitable by an administrator or users who have exposed their Frigate install to the open internet with no authentication which allows anyone full administrative control. This vulnerability is fixed in 0.16.4.
- Product
- frigate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026Out-of-bounds write vulnerability in the camera module.CVE-2026-24926 · Other software · Huawei · reported by psirt@huawei.comHigh 8.4
Out-of-bounds write vulnerability in the camera module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Feb 6, 2026Type confusion vulnerability in the camera module.CVE-2026-24914 · Other software · Huawei · reported by psirt@huawei.comMedium 4
Type confusion vulnerability in the camera module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Feb 2, 2026In cameraisp, there is a possible out of bounds write due to a missing bounds check.CVE-2026-20412 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comHigh 7.8
In cameraisp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10351676; Issue ID: MSV-5733.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2026In cameraisp, there is a possible escalation of privilege due to use after free.CVE-2026-20411 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comHigh 7.8
In cameraisp, there is a possible escalation of privilege due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10351676; Issue ID: MSV-5737.
- Product
- MediaTek chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026The HTTP parser of Tapo C210 v3, C220 v1 and C520WS v2 cameras improperly handles requests containing an excessively long URL path.CVE-2026-0919 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630High 7.1
The HTTP parser of Tapo C210 v3, C220 v1 and C520WS v2 cameras improperly handles requests containing an excessively long URL path. An invalid‑URL error path continues into cleanup code that assumes allocated buffers exist, leading to a crash and service restart. An unauthenticated attacker can force repeated service crashes or device reboots, causing denial of service.
- Product
- Tapo C220 v1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtp-link.comtp-link.com
Jan 27, 2026The Tapo C100 v5, C220 v1 and C520WS v2 cameras’ HTTP service does not safely handle POST requests containing an excessively large Content-Length header.CVE-2026-0918 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630High 7.1
The Tapo C100 v5, C220 v1 and C520WS v2 cameras’ HTTP service does not safely handle POST requests containing an excessively large Content-Length header. The resulting failed memory allocation triggers a NULL pointer dereference, causing the main service process to crash. An unauthenticated attacker can repeatedly crash the service, causing temporary denial of service. The device restarts automatically, and repeated requests can keep it unavailable.
- Product
- Tapo C220 v1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcrac-learning.comtp-link.com
Jan 16, 2026Authentication bypass in the password recovery feature of the local web interface across multiple VIGI camera models allows an attacker on the LAN to reset the CVE-2026-0629 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630High 8.7
Authentication bypass in the password recovery feature of the local web interface across multiple VIGI camera models allows an attacker on the LAN to reset the admin password without verification by manipulating client-side state. Attackers can gain full administrative access to the device, compromising configuration and network security.
- Product
- VIGI InSight Sx45 Series (S245/S345/S445)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2026Path Traversal vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA Corporation.CVE-2026-22876 · Other software · TOA Corporation · reported by vultures@jpcert.or.jpHigh 7.1
Path Traversal vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA Corporation. If this vulnerability is exploited, arbitrary files on the affected product may be retrieved by a logged-in user with the low("monitoring user") or higher privilege.
- Product
- Multiple Network Cameras TRIFORA 3 series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jptoa-products.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.