Schneider Electric SCADAPack and RemoteConnect Improper Check For Unusual or Exceptional Conditions (CVE-2026-0667)

CWE-754 Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause remote code execution, denial of service, and loss of confidentiality and integrity of the RTU controller when an unauthenticated attacker sends specially crafted Modbus TCP packets to the device...

CVE-2026-71264

WLED's GET /json/cfg endpoint registered in wled00/wledserver.cpp calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration network, hardware, LED setup to any unauthenticated client on the network...

CVE-2026-71264 WLED Unauthenticated Configuration Disclosure via /json/cfg and Global Settings-PIN Lock State

WLED's GET /json/cfg endpoint registered in wled00/wledserver.cpp calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration network, hardware, LED setup to any unauthenticated client on the network...

EUVD-2026-53349

WLED's GET /json/cfg endpoint registered in wled00/wledserver.cpp calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration network, hardware, LED setup to any unauthenticated client on the network...

CVE-2026-66747

Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package librctl.so, started at boot and run as root under the process name kworker to blend in...

EUVD-2026-53301

Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package librctl.so, started at boot and run as root under the process name kworker to blend in...

CVE-2026-64573

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLVTYPENVM branch of qcatlvcheckdata the tag loop bound is "while idx length - sizeofstruct tlvtypenvm". "length" is a signed int from the firmware TLV header and...

CVE-2026-64573 Bluetooth: qca: fix NVM tag length underflow in TLV parser

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLVTYPENVM branch of qcatlvcheckdata the tag loop bound is "while idx length - sizeofstruct tlvtypenvm". "length" is a signed int from the firmware TLV header and...

CVE-2026-64573 Bluetooth: qca: fix NVM tag length underflow in TLV parser

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLVTYPENVM branch of qcatlvcheckdata the tag loop bound is "while idx length - sizeofstruct tlvtypenvm". "length" is a signed int from the firmware TLV header and...

CVE-2026-64573

The CVE-2026-64573 issue affects the Linux kernel Bluetooth stack (qca TLV parser). In the TLV_TYPE_NVM branch of qca_tlv_check_data(), the loop bound used length - sizeof(struct tlv_type_nvm) with length as a signed int promoted to size_t, which could underflow when firmware

EUVD-2025-210619

Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. The application contains hardcoded credentials in the RTSP authentication mechanism. An attacker with network access can use the unchangeable default credentials to access the RTSP video stream, resulting in unauthorized...

CVE-2026-18810

A security vulnerability has been detected in H3C NX15 V100R017. Impacted is an unknown function of the file /api/wizard/networkSetup. Such manipulation leads to missing authentication. The attack may be performed from remote. The vendor was contacted early about this disclosure...

CVE-2026-18787

CVE-2026-18787 affects GL.iNet AX1800 firmware up to 4.8.3. The vulnerability resides in the RPC Endpoint component, specifically the function remove_rule in /usr/share/gl-ngx/oui-rpc.lua, where manipulation of the argument args.id leads to a command injection . The attack can be carried out remo...

CVE-2026-61515

Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrary operating system commands by sending a crafted JSON payload to the DebugShell interface exposed on TCP port 34567. Attackers can exploit...

CVE-2026-25289

CVE-2026-25289 describes memory corruption/stack-based overflow when processing Device Capability Extended attributes in NAN Service Discovery Frames with invalid length values in WLAN firmware. The issue is tied to the firmware image referenced in the August 2026 Qualcomm security bulletin; no e...

CVE-2026-25289 Stack-based Buffer Overflow in WLAN Firmware

Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values...

CVE-2026-25288

CVE-2026-25288 refers to a transient denial-of-service in WLAN firmware when handling a short target wake time channel usage response frame built with insufficient packet size. Documented in multiple sources (CVE, NVD, CVE list, EUVD), this appears to affect WLAN firmware as reported, with root c...

CVE-2026-61514 Puwell IP Camera 2.x - 4.x Unauthenticated Access via TCP Port 23456

Puwell IP Camera firmware versions 2.x through 4.x contains an authentication bypass vulnerability that allows unauthenticated attackers to access device functions by sending protocol-conforming packets over TCP port 23456 without credentials. Attackers can exploit the unvalidated Session field i...

EUVD-2026-52689

Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrary operating system commands by sending a crafted JSON payload to the DebugShell interface exposed on TCP port 34567. Attackers can exploit...

CVE-2026-61515 Puwell IP Camera 2.x - 4.x Unauthenticated Command Injection via DebugShell

Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrary operating system commands by sending a crafted JSON payload to the DebugShell interface exposed on TCP port 34567. Attackers can exploit...