Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
8 results
Oct 28, 2026Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi.CVE-2026-75520 · Other software · domoticz · reported by GitHubMedium 5.4
Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the `udevices` JSON command handler, `Cmd_UpdateDevices` in `main/WebServerCmds.cpp`, performed no `session.rights` check before invoking a Lua parser script, while its sibling command handlers gate access by role. A low-privilege authenticated user could trigger execution of an existing operator-installed Lua parser script with attacker-controlled input through the `GET /json.htm` endpoint with `type=command` and `param=udevices`. The `script` parameter also lacked a `..` path-traversal guard: `CLuaHandler::executeLuaScript` in `main/LuaHandler.cpp` constructed the filename from the parser directory and the supplied script name before passing it to `luaL_loadfile`. Execution is limited to already-installed valid Lua files; this is not arbitrary code execution, and the advisory states that file-write and upload paths require administrator privileges. This issue is addressed in version 2026.3.
- Product
- domoticz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2026Domoticz versions prior to 2026.3 contains a stored cross-site scripting vulnerability in the mobile dashboard that allows authenticated attackers to inject arbCVE-2026-11425 · Other software · Domoticz · reported by VulnCheckLow 2
Domoticz versions prior to 2026.3 contains a stored cross-site scripting vulnerability in the mobile dashboard that allows authenticated attackers to inject arbitrary HTML and JavaScript by updating Text or Alert subtype device values through the API. The mobile dashboard renders device data via ng-bind-html with only an nl2br() transform that performs no HTML escaping, allowing attackers to store malicious payloads that execute in any administrator's browser upon viewing the mobile dashboard, enabling session cookie theft and account takeover.
- Product
- Domoticz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026Domoticz's MochadTCP::MatchLine handler for MOCHAD_RFSEC messages (hardware/MochadTCP.cpp) copies network-received data from the up-to-1028-byte m_mochadbuffer CVE-2026-71265 · Other software · domoticz · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 7.5
Domoticz's MochadTCP::MatchLine handler for MOCHAD_RFSEC messages (hardware/MochadTCP.cpp) copies network-received data from the up-to-1028-byte m_mochadbuffer into a fixed 50-byte stack buffer tempRFSECbuf using strcpy with no length check, across three separate code branches (DS10A/KR10A/MS10A device types).
- Product
- domoticz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026Domoticz versions prior to 2026.1 contain a stored cross-site scripting vulnerability in the Add Hardware and rename device functionality of the web interface tCVE-2026-1001 · Other software · Domoticz · reported by VulnCheckMedium 4.8
Domoticz versions prior to 2026.1 contain a stored cross-site scripting vulnerability in the Add Hardware and rename device functionality of the web interface that allows authenticated administrators to execute arbitrary scripts by supplying crafted names containing script or HTML markup. Attackers can inject malicious code that is stored and rendered without proper output encoding, causing script execution in the browsers of users viewing the affected page and enabling unauthorized actions within their session context.
- Product
- Domoticz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddomoticz.comvulncheck.com
Apr 29, 2021Emmanuel MyDomoAtHome (MDAH) REST API REST API Domoticz ISS Gateway 0.2.40 is affected by an information disclosure vulnerability due to improper access controlCVE-2020-21990 · Other software · Domoticz · reported by MITREHigh 7.5
Emmanuel MyDomoAtHome (MDAH) REST API REST API Domoticz ISS Gateway 0.2.40 is affected by an information disclosure vulnerability due to improper access control enforcement. An unauthenticated remote attacker can exploit this, via a specially crafted request to gain access to sensitive information.
- Product
- Mydomoathome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comzeroscience.mk
Aug 23, 2019Domoticz 4.10717 has XSS via item.Name.CVE-2019-15480 · Other software · Domoticz · reported by MITREMedium 5.4
Domoticz 4.10717 has XSS via item.Name.
- Product
- Domoticz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2019Domoticz before 4.10579 neglects to categorize \n and \r as insecure argument options.CVE-2019-10678 · Other software · Domoticz · reported by MITREHigh 7.5
Domoticz before 4.10579 neglects to categorize \n and \r as insecure argument options.
- Product
- Domoticz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Mar 31, 2019Domoticz before 4.10578 allows SQL Injection via the idx parameter in CWebServer::GetFloorplanImage in WebServer.cpp.CVE-2019-10664 · Other software · Domoticz · reported by MITRECritical 9.8
Domoticz before 4.10578 allows SQL Injection via the idx parameter in CWebServer::GetFloorplanImage in WebServer.cpp.
- Product
- Domoticz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.