CVE-2026-82933

The mH-DEVELOPER smart home module is vulnerable to cleartext transmission of sensitive information because it sends web interface and API traffic over unencrypted HTTP . This allows an attacker on the same network to intercept passwords , authentication tokens , and device commands , potentially...

CVE-2026-82933 Cleartext Transmission of Sensitive Information in mH-DEVELOPER

mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and tokens, and hijack sessions. This iss...

EUVD-2026-88232

mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and tokens, and hijack sessions. This iss...

CVE-2026-82932

The mH-DEVELOPER smart home module contains a security flaw where it fails to load any firewall rules at startup. This configuration oversight leaves all listening services, such as SSH , HTTP , WebSocket , and Node-RED , fully exposed on the local area network (LAN) without any access control. C...

CVE-2026-82932 Missing Firewall Configuration in mH-DEVELOPER

mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSocket, and Node-RED, fully exposed on the LAN without access control. Any client on the same network can reach every service. This issue was fixed in...

EUVD-2026-88231

mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSocket, and Node-RED, fully exposed on the LAN without access control. Any client on the same network can reach every service. This issue was fixed in...

CVE-2026-82930

The mH-DEVELOPER smart home module contains a vulnerability where the authorization middleware fails to verify tokens. This flaw leaves all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can exploit this to query endpoints, access system...

EUVD-2026-88230

mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can query these endpoints, access system information, and send raw control commands to...

CVE-2026-82930 Missing Authentication in mH-DEVELOPER

mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can query these endpoints, access system information, and send raw control commands to...

CVE-2026-82929 Use of Shared Cryptographic Key in mH-DEVELOPER

mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, enabling man-in-the-middle attacks and credential...

EUVD-2026-88229

mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, enabling man-in-the-middle attacks and credential...

CVE-2026-82929

The mH-DEVELOPER smart home module is vulnerable because it uses identical hard-coded SSH host keys across all devices instead of generating unique per-device keys. An attacker capable of extracting these keys from the firmware can deploy a rogue SSH server that clients will trust automatically. ...

CVE-2026-82928 Undocumented access path in mH-DEVELOPER

mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorizedkeys, serving as a potential backdoor. The SSH daemon allows root login via key authentication and starts automatically. An attacker with the matching private key can gain a root shell on any affected devic...

CVE-2026-82928

The mH-DEVELOPER smart home module contains a hardcoded SSH public key within /root/.ssh/authorized_keys, which functions as a potential backdoor . Because the SSH daemon starts automatically and permits root login via key authentication, an attacker possessing the matching private key can obtain...

EUVD-2026-88228

mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorizedkeys, serving as a potential backdoor. The SSH daemon allows root login via key authentication and starts automatically. An attacker with the matching private key can gain a root shell on any affected devic...

DevGuide

Guía de Desarrollo de OWASP Foundation La Guía de Desarrollo es uno de los documentos originales de OWASP y por lo tanto tiene una larga historia. El repositorio original de DevGuide tiene muchas de las versiones anteriores que se remontan a la primera versión 1.0 publicada en 2002. Este es el...

ladder

Ladder Ladder is a http web proxy. 简体中文 Ladder is a developer tool for testing and analyzing paywall implementations and content delivery behavior on modern websites. It allows developers, researchers, and publishers to simulate different client environments such as browsers and crawlers and...

dalfox

Dalfox is a powerful open-source tool that focuses on automation, making it ideal for quickly scanning for XSS flaws and analyzing parameters. Its advanced testing engine and niche features are designed to streamline the process of detecting and verifying vulnerabilities. Key features Subcommands...

guac

GUAC: Graph for Understanding Artifact Composition Note: GUAC is under active development - if you are interested in contributing, please look at contributor guide. GUAC is an OpenSSF incubating project under the Supply Chain Integrity WG. Graph for Understanding Artifact Composition GUAC...

spamassassin

Apache SpamAssassin GitHub Actions for testing The Apache SpamAssassin project uses a subversion repo for its development process. A read-only mirror of the repo is maintained on GitHub here. The .github directory containing this README file is not part of the Apache SpamAssassin release package...