Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7 results
Jun 12, 2026The Naxclow platform exposes a registration endpoint that accepts signed requests containing a batch prefix and an arbitrary caller-supplied account identifier,CVE-2026-50244 · Other software · Naxclow · reported by ics-cert@hq.dhs.govMedium 6.9
The Naxclow platform exposes a registration endpoint that accepts signed requests containing a batch prefix and an arbitrary caller-supplied account identifier, without validating any ownership relationship. Each call mints a new sequential device identifier and returns the current high-water counter value for the batch, allowing callers to measure and enumerate the active device space. The endpoint’s behavior enables precise fleet enumeration.
- Product
- Smart Doorbell X3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026The Naxclow platform API that returns device relay registration details exposes a persistent credential without verifying that the requester is the legitimate dCVE-2026-50108 · Other software · Naxclow · reported by ics-cert@hq.dhs.govHigh 8.7
The Naxclow platform API that returns device relay registration details exposes a persistent credential without verifying that the requester is the legitimate device or owner. An actor able to present a platform-valid request signature can retrieve credentials for arbitrary devices and register on the relay as that device, enabling interception and disruption of its communications.
- Product
- Smart Doorbell X3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026Naxclow devices use a server-side, per-device relay credential that never rotates and is re-issued to the device on each boot.CVE-2026-50101 · Other software · Naxclow · reported by ics-cert@hq.dhs.govCritical 9.2
Naxclow devices use a server-side, per-device relay credential that never rotates and is re-issued to the device on each boot. Because this credential remains valid indefinitely and cannot be reset or revoked by the legitimate owner, any party that obtains it through any exposure path can maintain persistent access to the device’s relay channel. This enables long-term impersonation or interception, even after factory resets or re-onboarding.
- Product
- Smart Doorbell X3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026During WiFi association, Naxclow device firmware prints the host network’s SSID, PSK, and negotiated WPA keys in cleartext to an exposed UART console on productCVE-2026-50099 · Other software · Naxclow · reported by ics-cert@hq.dhs.govMedium 5.1
During WiFi association, Naxclow device firmware prints the host network’s SSID, PSK, and negotiated WPA keys in cleartext to an exposed UART console on production hardware. The UART pads are labeled, run with default serial settings, and drop to an interactive RT-Thread shell that permits arbitrary memory reads, enabling full firmware extraction. An attacker with brief physical access, common for outdoor-mounted devices, can therefore recover WiFi credentials and bootstrap firmware-side attacks.
- Product
- Smart Doorbell X3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026A flaw in Naxclow's platform’s onboarding workflow allows an attacker to replay a confirm-then-bind sequence to silently reassign a device to an arbitrary accouCVE-2026-42947 · Other software · Naxclow · reported by ics-cert@hq.dhs.govHigh 8.7
A flaw in Naxclow's platform’s onboarding workflow allows an attacker to replay a confirm-then-bind sequence to silently reassign a device to an arbitrary account. Because the affected endpoints validate request signatures but do not confirm legitimate ownership, an attacker with any account can take over a device without user interaction while the device remains online and unaware.
- Product
- Smart Doorbell X3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026Naxclow device identifiers use fixed manufacturing prefixes combined with sequential counters, producing a fully predictable and enumerable identifier space.CVE-2026-42932 · Other software · Naxclow · reported by ics-cert@hq.dhs.govMedium 6.9
Naxclow device identifiers use fixed manufacturing prefixes combined with sequential counters, producing a fully predictable and enumerable identifier space. Because the platform also exposes an endpoint that reveals the current identifier high-water mark, the active fleet can be enumerated.
- Product
- Smart Doorbell X3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt embedded in every firmware image.CVE-2026-28742 · Other software · Naxclow · reported by ics-cert@hq.dhs.govCritical 9.2
Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt embedded in every firmware image. Once this salt is recovered from any device, an attacker can generate valid signatures for arbitrary device or account operations due to the absence of per-device keys, server-side nonce tracking, or replay protections. Combined with the system’s use of plain HTTP for control-plane traffic, the construction enables broad request forgery and impersonation across the platform.
- Product
- Smart Doorbell X3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.