CVE-2026-123998

The Hisense VIDAA Smart TV (firmware V0000.01.00a.P0220 ) is susceptible to an authentication bypass vulnerability within its remote-control MQTT broker on TCP port 36669 . The root cause is the acceptance of publicly documented default credentials and an ineffective 4-digit pairing PIN that lack...

EUVD-2026-118428

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an authentication bypass vulnerability in its remote-control MQTT broker on TCP port 36669, which accepts publicly documented default credentials and an ineffective 4-digit pairing PIN with no rate limiting or lockout, allowing a brute...

CVE-2026-123996

The Hisense VIDAA Smart TV running firmware V0000.01.00a.P0220 is vulnerable to a missing authentication flaw in the UPnP/DLNA RenderingControl service on TCP port 38400 . This vulnerability allows a LAN-adjacent attacker to issue SetVolume, SetMute, and SelectPreset(FactoryDefaults) commands fol...

EUVD-2026-118426

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains a missing authentication vulnerability in the UPnP/DLNA RenderingControl service on TCP port 38400 that allows a LAN-adjacent attacker to issue SetVolume, SetMute, and SelectPresetFactoryDefaults commands after a one-time DLNA pairing wi...

CVE-2026-96651 Plex Media Server path traversal

Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/system/agents/media/get'. A remote attacker with a valid session token could read any file that the target user can access. This access includes the...

CVE-2026-96651

Plex Media Server before version 1.43.3.10861 is vulnerable to a path traversal flaw because the software fails to validate ../ sequences in the url parameter. An attacker can exploit this via the /system/agents/media/get endpoint to read any file accessible by the target user. Specifically, an a...