Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7 results
Jul 13, 2026Lorex 2K Indoor Wi-Fi Security Camera Device Management Server Improper Certificate Validation Vulnerability.CVE-2026-15683 · Other software · Lorex · reported by zdi-disclosures@trendmicro.comHigh 7.5
Lorex 2K Indoor Wi-Fi Security Camera Device Management Server Improper Certificate Validation Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lorex 2K Indoor Wi-Fi Security Cameras. User interaction is not required to exploit this vulnerability. The specific flaw exists within the device management functionality. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-26851.
- Product
- 2K Indoor Wi-Fi Security Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2026Lorex 2K Indoor Wi-Fi Security Camera CDeviceOperator Format String Remote Code Execution Vulnerability.CVE-2026-15680 · Other software · Lorex · reported by zdi-disclosures@trendmicro.comHigh 7.5
Lorex 2K Indoor Wi-Fi Security Camera CDeviceOperator Format String Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lorex 2K Indoor Wi-Fi Security Cameras. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of JSON requests in the sonia binary. The issue results from the lack of proper validation of a user-supplied string before using it as a format specifier. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-25884.
- Product
- 2K Indoor Wi-Fi Security Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024An attacker who can execute arbitrary Operating Systems commands, can bypass code signing enforcements in the kernel, and execute arbitrary native code.CVE-2024-52548 · Other software · Lorex · reported by cve@rapid7.comMedium 6.7
An attacker who can execute arbitrary Operating Systems commands, can bypass code signing enforcements in the kernel, and execute arbitrary native code. This vulnerability has been resolved in firmware version 2.800.0000000.8.R.20241111.
- Product
- 2K Indoor Wi-Fi Security Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024An authenticated attacker can trigger a stack based buffer overflow in the DHIP Service (TCP port 80).CVE-2024-52547 · Other software · Lorex · reported by cve@rapid7.comHigh 7.2
An authenticated attacker can trigger a stack based buffer overflow in the DHIP Service (TCP port 80). This vulnerability has been resolved in firmware version 2.800.0000000.8.R.20241111.
- Product
- 2K Indoor Wi-Fi Security Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024An unauthenticated attacker can perform a null pointer dereference in the DHIP Service (UDP port 37810).CVE-2024-52546 · Other software · Lorex · reported by cve@rapid7.comMedium 5.3
An unauthenticated attacker can perform a null pointer dereference in the DHIP Service (UDP port 37810). This vulnerability has been resolved in firmware version 2.800.0000000.8.R.20241111.
- Product
- 2K Indoor Wi-Fi Security Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024An unauthenticated attacker can perform an out of bounds heap read in the IQ Service (TCP port 9876).CVE-2024-52545 · Other software · Lorex · reported by cve@rapid7.comMedium 6.5
An unauthenticated attacker can perform an out of bounds heap read in the IQ Service (TCP port 9876). This vulnerability has been resolved in firmware version 2.800.0000000.8.R.20241111.
- Product
- 2K Indoor Wi-Fi Security Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024An unauthenticated attacker can trigger a stack based buffer overflow in the DP Service (TCP port 3500).CVE-2024-52544 · Other software · Lorex · reported by cve@rapid7.comCritical 9.8
An unauthenticated attacker can trigger a stack based buffer overflow in the DP Service (TCP port 3500). This vulnerability has been resolved in firmware version 2.800.0000000.8.R.20241111.
- Product
- 2K Indoor Wi-Fi Security Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.