CVE-2026-4476: Missing Authentication for Critical Function

A vulnerability was found in Yi Technology YI Home Camera 2 2.1.120171024151200. The impacted element is an unknown function of the file home/web/ipc of the component CGI Endpoint. Performing a manipulation results in missing authentication. Access to the local network is required for this attack...

CVE-2026-4475: Use of Hard-coded Credentials

A vulnerability has been found in Yi Technology YI Home Camera 2 2.1.120171024151200. The affected element is an unknown function of the file home/web/ipc. Such manipulation leads to hard-coded credentials. Access to the local network is required for this attack to succeed. The exploit has been...

PT-2026-26571

A vulnerability was determined in Yi Technology YI Home Camera 2 2.1.1 20171024151200. This affects an unknown function of the component WPA/WPS. Executing a manipulation can lead to use of hard-coded cryptographic key . The attack can only be done within the local network. This attack is...

D-Link’s various products have command injection vulnerabilities

D-Link DNS-120, etc., are products of D-Link Corporation from China. The D-Link DNS-120 is a network storage adapter. The D-Link DNR-202L is a network video camera. The D-Link DNS-315L is a network attached storage device. Several D-Link products have command injection vulnerabilities, which stem...

czeview-meari-firmware

CZeView / Meari Camera — Root & Firmware Research Reverse eng...

jooan-ja-a52-root

Jooan JA-A52 A2RU Root Exploit Full root shell on the Joo...

Maintaining Security and Protecting Smart Home Devices from Hackers

Learn how to protect smart home devices from hackers. Strong passwords, updates and secure networks help keep cameras, sensors and data safe...

Apeman Cameras

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to take control of the device or view camera feeds. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize...

buffer-overflow-exploit-ip-camera-

buffe...

OpenClaw: Node camera URL payload host-binding bypass allowed gateway fetch pivots

Summary OpenClaw accepted camera.snap / camera.clip node payload url fields and downloaded them on the gateway/agent host without binding downloads to the resolved node host. In OpenClaw's documented trust model, paired nodes are in the same operator trust boundary, so this is scoped as...

GHSA-2858-XG23-26FP OpenClaw: Node camera URL payload host-binding bypass allowed gateway fetch pivots

Summary OpenClaw accepted camera.snap / camera.clip node payload url fields and downloaded them on the gateway/agent host without binding downloads to the resolved node host. In OpenClaw's documented trust model, paired nodes are in the same operator trust boundary, so this is scoped as...

Chrome flaw let extensions hijack Gemini’s camera, mic, and file access

Chrome’s Gemini “Live in Chrome” panel Gemini’s embedded, agent-style assistant mode within Chrome had a high‑severity vulnerability tracked as CVE‑2026‑0628. The flaw let a low‑privilege extension inject code into the Gemini side panel and inherit its powerful capabilities, including local file...

Pelco, Inc. Sarix Pro 3 Series IP Cameras

RISK EVALUATION Successful exploitation of this vulnerability could allow attackers to gain unauthorized access to sensitive device data, bypass surveillance controls, and expose facilities to privacy breaches, operational risks, and regulatory compliance issues. 2. RECOMMENDED PRACTICES CISA...

RTSP Unauthenticated Stream Exposure Checker

This Python script uses the OpenCV library cv2 to test whether an IP camera exposes its RTSP stream without authentication. It attempts to connect to the default RTSP endpoint rtsp://:554/default and checks if the stream can be opened and a video frame retrieved successfully. If the connection...

📄 Frigate NVR 0.16.3 Remote Command Execution

This Python exploit targets a critical configuration manipulation vulnerability in Frigate NVR versions up to 0.16.3 both authenticated and unauthenticated paths. By injecting a malicious go2rtc stream and a fake camera entry, it triggers arbitrary command execution as the Frigate process during...

D-Link doSystem() Command Execution

The vulnerability of the doSystem/setSystemAdmin function in D-Link DCS-931L microprogrammed security cameras is related to the lack of measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Exploit for Improper Privilege Management in Frigate

Frigate NVR ≤ 0.16.3 Blind RCE Exploit CVE-2026-25643 PoC...

Tattile Smart+ Access Control Vulnerability

Tattile Smart+ is a smart license plate recognition camera developed by the Italian company Tattile. Tattile Smart+, Vega, and Basic 1.181.5 and earlier versions have an access control vulnerability. This vulnerability stems from the fact that RTSP streams do not require authentication, which may...

Tattile Smart+ code issue vulnerabilities

Tattile Smart+ is a smart license plate recognition camera developed by the Italian company Tattile. There are code-related vulnerabilities in Tattile Smart+, Vega, and Basic 1.181.5 and earlier versions. These vulnerabilities stem from an inadequate mechanism for handling expired authentication...

edisgo (0.2.0), opencv-browser-camera (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-27199 via werkzeug (2.2.0)

werkzeug PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - edisgo 0.2.0 - opencv-browser-camera =0.1.0, =0.1.2 Source cves: CVE-2026-27199 Source advisory: OSV:PYSEC-2026-2320...