Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7 results
Sep 18, 2026CareCam CM2507 IP cameras store the device's root-account password using a fixed legacy password hash that provides insufficient resistance to offline cracking.CVE-2026-85497 · Other software · CareCam · reported by ics-cert@hq.dhs.govCritical 9.3
CareCam CM2507 IP cameras store the device's root-account password using a fixed legacy password hash that provides insufficient resistance to offline cracking. An attacker who obtains the firmware image or password database could recover the associated credential, which may also be reusable across other devices running the same firmware.
- Product
- HMT.CM2507 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026A CM2507 IP camera running firmware version HMT.CM2507 v251211.1507 exposes an interactive bootloader through a physical debug interface without requiring autheCVE-2026-85478 · Other software · CareCam · reported by ics-cert@hq.dhs.govLow 2.4
A CM2507 IP camera running firmware version HMT.CM2507 v251211.1507 exposes an interactive bootloader through a physical debug interface without requiring authentication. An attacker with physical access could interrupt the normal boot process and access functionality that permits inspection or modification of boot configuration, firmware data, and software loaded by the device.
- Product
- HMT.CM2507 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem.CVE-2026-81321 · Other software · CareCam · reported by ics-cert@hq.dhs.govCritical 9.3
CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem. An attacker who obtains filesystem access through physical access, a debugging interface, or another vulnerability could recover the configured network identifier and pre-shared key.
- Product
- HMT.CM2507 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026CareCam CM2507 IP cameras do not require authentication for access to its network video streaming service.CVE-2026-88259 · Other software · CareCam · reported by ics-cert@hq.dhs.govHigh 8.7
CareCam CM2507 IP cameras do not require authentication for access to its network video streaming service. An unauthenticated attacker with network access to the affected device could retrieve live camera video.
- Product
- HMT.CM2507 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026CareCam CM2507 IP cameras contain an insufficiently protected network maintenance mechanism that can activate a remote debugging service.CVE-2026-84400 · Other software · CareCam · reported by ics-cert@hq.dhs.govLow 2.3
CareCam CM2507 IP cameras contain an insufficiently protected network maintenance mechanism that can activate a remote debugging service. An attacker on the same local network who satisfies certain device state conditions could make the service remotely accessible, increasing the risk of unauthorized administrative access.
- Product
- HMT.CM2507 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service.CVE-2026-84398 · Other software · CareCam · reported by ics-cert@hq.dhs.govHigh 8.7
CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network access to the affected device could access privileged management functions and obtain device, user, media-profile, and stream configuration information.
- Product
- HMT.CM2507 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026CM2507 IP cameras automatically execute a predetermined script from removable media without verifying its authenticity or integrity.CVE-2026-81305 · Other software · CareCam · reported by ics-cert@hq.dhs.govHigh 7
CM2507 IP cameras automatically execute a predetermined script from removable media without verifying its authenticity or integrity. An attacker with physical access to the device could supply a malicious script and execute arbitrary code in the security context of the affected device.
- Product
- HMT.CM2507 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.