CVE-2026-110655

The miniupnpc library (versions through 2.3.3 ) is vulnerable to a one-byte heap out-of-bounds read in the minixml parseatt function. This vulnerability occurs when the library processes crafted replies from malicious UPnP gateways. Specifically, an attacker on the local network can spoof a gatew...

CVE-2026-110656: Out-of-bounds Read

miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseelt function's namespace-prefix handling that skips an end-of-buffer check after advancing past ':'. A malicious or spoofed UPnP gateway on the local network can send a device description or SOAP...

CVE-2026-110655: Out-of-bounds Read

miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseatt function that allows malicious UPnP gateways to read past buffer bounds via crafted replies. Attackers on the local network can spoof a gateway serving device descriptions or SOAP responses...

CVE-2026-109506: Improper Authentication

Multiple TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary transformation in the HTTP web-management login flow. An unauthenticated attacker on the same local network who can capture the network traffic associated with legitimate administrator login may be able to derive a...

CVE-2026-107606

SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to retrieve a snapshot of the live feed without authentication...

CVE-2026-107607

SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to access a real-time video stream without authentication...

CVE-2026-107605

SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to view live video feed without authentication...

CVE-2026-107607 Missing authentication for critical function in Swann Communications SWIFI-SE2KIC

SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to access a real-time video stream without authentication...

CVE-2026-107607

Swann Communications SWIFI-SE2KIC devices running firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function (CWE-306) vulnerability. An attacker situated on the local network can exploit this flaw to access a real-time video stream without any authenticat...

CVE-2026-107606

The Swann Communications SWIFI-SE2KIC device is vulnerable to a Missing Authentication for Critical Function vulnerability in firmware versions 2.0.22 and prior . An attacker situated on the local network can exploit this flaw to retrieve a snapshot of the live feed without any authentication. No...

CVE-2026-107606 Missing authentication for critical function in Swann Communications SWIFI-SE2KIC

SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to retrieve a snapshot of the live feed without authentication...

CVE-2026-107605

Swann Communications SWIFI-SE2KIC devices running firmware versions 2.0.22 and prior are affected by a Missing Authentication for Critical Function vulnerability (CWE-306). This flaw allows an attacker on the local network to view the live video feed without any authentication. No specific remedi...

CVE-2026-107605 Missing authentication for critical function in Swann Communications SWIFI-SE2KIC

SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to view live video feed without authentication...

CVE-2026-107918 Insufficient input validation vulnerability in NETGEAR R7300

Insufficient input validation vulnerability in the LAN Setup feature of NETGEAR R7300 router allows authenticated administrators connected to the local network to perform unauthorized actions on the router.This issue was identified through testing in a controlled research environment using a...

CVE-2026-107918

The NETGEAR R7300 router contains an insufficient input validation vulnerability within its LAN Setup feature. This flaw allows authenticated administrators connected to the local network to perform unauthorized actions on the device. This issue was identified via research testing on a simulated ...

CVE-2026-107917 Insufficient input validation vulnerability in NETGEAR R7300 router

Insufficient input validation vulnerability in the PPPoE Setup feature of NETGEAR R7300 router allows authenticated administrators connected to the local network to perform unauthorized actions on the router. This issue was identified through testing in a controlled research environment using a...

CVE-2026-9218 Insufficient input validation vulnerability in Certain NETGEAR routers allows unauthorized access

Insufficient input validation vulnerability in time server NTP setting of the listed NETGEAR models allows an attacker who is connected to the router’s local network and has the router’s administrator credentials to run unauthorized commands on the router. This vulnerability could impact the...

CVE-2026-9218

Certain NETGEAR routers are vulnerable to an insufficient input validation vulnerability within the time server (NTP) setting . An attacker who is connected to the router's local network and possesses administrator credentials can exploit this flaw to execute unauthorized commands on the device. ...

LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network

Three vulnerabilities in LG's webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or any interaction from the owner. LG has issued a fix, according to an advisory published by SSD Secure Disclosure on October 12. The chain was tested o...

CVE-2026-107918: Improper Input Validation

Insufficient input validation vulnerability in the LAN Setup feature of NETGEAR R7300 router allows authenticated administrators connected to the local network to perform unauthorized actions on the router.This issue was identified through testing in a controlled research environment using a...