62590 matches found
CVE-2026-111623 Xiaozhi-esp32-server-java through 6.1.0 Authentication Bypass via OTA Endpoint Token Issuance
Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid device WebSocket tokens by requesting /api/device/ota with any MAC address. Attackers can open a victim device's WebSocket channel to read private role...
EUVD-2026-103045
Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid device WebSocket tokens by requesting /api/device/ota with any MAC address. Attackers can open a victim device's WebSocket channel to read private role...
CVE-2026-111623 Xiaozhi-esp32-server-java through 6.1.0 Authentication Bypass via OTA Endpoint Token Issuance
Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid device WebSocket tokens by requesting /api/device/ota with any MAC address. Attackers can open a victim device's WebSocket channel to read private role...
CVE-2026-97858
An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID...
EUVD-2026-102880
The endpoint exposes an observable response discrepancy when processing ID values. A request submitted with a nonexistent ID returns a distinct error response code from one submitted with a valid, registered ID, allowing an attacker holding a valid access token - but without further authenticatio...
CVE-2026-105664
The Guangzhou Juan IoT Technology EseeCloud platform is vulnerable to an observable response discrepancy (CWE-204) when processing ID values. An attacker possessing a valid access token can distinguish valid, registered IDs from the 10-digit numeric search space because the system returns differe...
CVE-2026-105664 Guangzhou Juan IoT Technology EseeCloud Observable Response Discrepancy
The endpoint exposes an observable response discrepancy when processing ID values. A request submitted with a nonexistent ID returns a distinct error response code from one submitted with a valid, registered ID, allowing an attacker holding a valid access token - but without further authenticatio...
CVE-2026-97858 Guangzhou Juan IoT Technology EseeCloud Improperly Controlled Modification of Dynamically-Determined Object Attributes
An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID...
EUVD-2026-102879
An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID...
kernel: ALSA: virtio: Validate control metadata from the device
A flaw was found in the Linux kernel's ALSA virtio sound driver. A malicious or buggy virtio device can provide invalid control metadata, such as an unknown control type or an oversized value count. The driver's control handling trusts this unvalidated metadata, leading to out-of-bounds access wh...
CVE-2026-111555
A flaw exists in luksmeta due to improper boundary validation of metadata slots. An attacker capable of supplying or modifying a disk header can redirect wipe or load operations outside the intended metadata area. By providing a crafted header with valid checksums, an attacker can overwrite or ze...
CVE-2026-98431
A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA subsystem. A circular locking dependency between memory mapping locks and device disassociation locks can lead to a deadlock condition during concurrent operations. A local user could trigger this vulnerability by performing...
EUVD-2026-102535
A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access...
Microsoft Windows HEVC Video Extensions from Device Manufacturer < 2.4.86.0 / 2.5.25.0 RCE (October 2026)
The Windows 'HEVC Video Extensions from Device Manufacturer' app installed on the remote host is prior to 2.4.86.0 2.5.25.0 on Windows 11 versions 25H2 and 26H1. It is, therefore, affected by a remote code execution vulnerability. Integer overflow or wraparound in Microsoft Windows Codecs Library...
CVE-2026-111623: Authentication Bypass by Spoofing
Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid device WebSocket tokens by requesting /api/device/ota with any MAC address. Attackers can open a victim device's WebSocket channel to read private role...
CVE-2026-89057: Authentication Bypass Using an Alternate Path or Channel
A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access...
PT-2026-116053
šØ CVE-2026-111654 FastBee through 2.1.0 contains an insecure direct object reference vulnerability that allows authenticated low-privilege users to access other users' device groups because GroupController queries lack owner checks. Attackers, including self-registered users, can supply sequentia...
CVE-2026-97858: Improperly Controlled Modification of Dynamically-Determined Object Attributes
An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID...
CVE-2026-105664: Observable Response Discrepancy
The endpoint exposes an observable response discrepancy when processing ID values. A request submitted with a nonexistent ID returns a distinct error response code from one submitted with a valid, registered ID, allowing an attacker holding a valid access token - but without further authenticatio...
PT-2026-115615
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An attacker can force the server to unbind a target device from its current owner and rebind it to the requesting account. This action occurs regardless of wheth...