Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
9 results
Sep 20, 2026The ZTE SmartLife application has a hardcoded key.CVE-2026-86555 · Other software · ZTE · reported by psirt@zte.com.cnMedium 6.2
The ZTE SmartLife application has a hardcoded key. The key used to decrypt account server information is stored in plaintext in the code. Once the key is obtained, the server information can be decrypted, thus exposing it.
- Product
- SmartLife
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2026SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process.CVE-2026-86554 · Other software · ZTE · reported by psirt@zte.com.cnMedium 4.3
SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained SmartLife application authentication parameters, attackers can directly invoke the backend interface /account/verify.serv to determine whether a target email address is registered for a SmartLife account. If the account exists, the real backend account ID can also be retrieved.
- Product
- SmartLife
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2026SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process.CVE-2026-86553 · Other software · ZTE · reported by psirt@zte.com.cnHigh 8.8
SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface /account/verify.serv to obtain the real account ID corresponding to a registered email address. By spoofing the application authentication information together with the target account ID, the attacker can reset the password of the target account.
- Product
- SmartLife
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2026SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime.CVE-2026-86552 · Other software · ZTE · reported by psirt@zte.com.cnMedium 5.4
SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface /account/person/signup.serv. Email ownership is not verified prior to registration.
- Product
- SmartLife
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026The ZTE Smart Life app contains an SQL injection vulnerability that allows attackers to execute UNION SELECT statements to query sensitive data in the feedback.CVE-2026-8029 · Other software · ZTE · reported by psirt@zte.com.cnLow 3.9
The ZTE Smart Life app contains an SQL injection vulnerability that allows attackers to execute UNION SELECT statements to query sensitive data in the feedback.db database across tables, including user accounts, phone numbers, feedback content, and local debug log paths, thereby enabling the theft of local privacy data.
- Product
- SmartLife
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 24, 2025Cross-Site Request Forgery (CSRF) vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smart and Smartlife mobiCVE-2025-56400 · Other software · Tuya · reported by MITREHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smart and Smartlife mobile applications, as well as other third-party applications that integrate the SDK, allows an attacker to link their own Amazon Alexa account to a victim's Tuya account. The applications fail to validate the OAuth state parameter during the account linking flow, enabling a cross-site request forgery (CSRF)-like attack. By tricking the victim into clicking a crafted authorization link, an attacker can complete the OAuth flow on the victim's behalf, resulting in unauthorized Alexa access to the victim's Tuya-connected devices. This affects users regardless of prior Alexa linkage and does not require the Tuya application to be active at the time. Successful exploitation may allow remote control of devices such as cameras, doorbells, door locks, or alarms.
- Product
- Smartlife
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2025Nedis SmartLife android app v1.4.0 was discovered to contain an API key disclosure vulnerability.CVE-2024-34897 · Other software · reported by MITREHigh 7.5
Nedis SmartLife android app v1.4.0 was discovered to contain an API key disclosure vulnerability.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2025An issue in Nedis SmartLife Video Doorbell (WIFICDP10GY), Nedis SmartLife IOS v1.4.0 causes users who are disconnected from a previous peer-to-peer connection wCVE-2024-34896 · Other software · reported by MITREHigh 7.5
An issue in Nedis SmartLife Video Doorbell (WIFICDP10GY), Nedis SmartLife IOS v1.4.0 causes users who are disconnected from a previous peer-to-peer connection with the device to still have access to live video feed.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2023The Imou Life com.mm.android.smartlifeiot application through 6.8.0 for Android allows Remote Code Execution via a crafted intent to an exported component.CVE-2023-42470 · Other software · Imoulife · reported by MITRECritical 9.8
The Imou Life com.mm.android.smartlifeiot application through 6.8.0 for Android allows Remote Code Execution via a crafted intent to an exported component. This relates to the com.mm.android.easy4ip.MainActivity activity. JavaScript execution is enabled in the WebView, and direct web content loading occurs.
- Product
- Life
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.