cve-2019-10678

CVE-2019-10678 This is part of Cved: a tool to manage vulnerable docker containers. Cved: https://github.com/git-rep-src/cved Image source: https://github.com/cved-sources/cve-2019-10678 Image author: https://github.com/joshuacox/mkdomoticz...

CVE-2026-75520

A flaw was found in Domoticz. Missing authorization checks allow low-privileged authenticated users to execute existing server scripts with attacker-controlled input. The application's device update command handler fails to validate user permissions before invoking Lua scripts and does not proper...

CVE-2026-75520

Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the udevices JSON command handler, CmdUpdateDevices in main/WebServerCmds.cpp, performed no session.rights check before invoking a Lua parser script, while its sibling command...

CVE-2026-75520 Domoticz: Missing authorization and path traversal in the udevices Lua parser handler

Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the udevices JSON command handler, CmdUpdateDevices in main/WebServerCmds.cpp, performed no session.rights check before invoking a Lua parser script, while its sibling command...

EUVD-2026-112548

Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the udevices JSON command handler, CmdUpdateDevices in main/WebServerCmds.cpp, performed no session.rights check before invoking a Lua parser script, while its sibling command...

CVE-2026-75520 Domoticz: Missing authorization and path traversal in the udevices Lua parser handler

Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the udevices JSON command handler, CmdUpdateDevices in main/WebServerCmds.cpp, performed no session.rights check before invoking a Lua parser script, while its sibling command...

CVE-2026-75520

Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the "udevices" JSON command handler, "CmdUpdateDevices" in "main/WebServerCmds.cpp", performed no "session.rights" check before invoking a Lua parser script, while its sibling...

CVE-2026-75520

The home automation system Domoticz (prior to version 2026.3 ) contains a missing authorization and path traversal vulnerability in the udevices JSON command handler (Cmd_UpdateDevices in main/WebServerCmds.cpp). Because this handler fails to perform a session.rights check, a low-privilege authen...

CVE-2026-75520: domoticz: Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi

Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the udevices JSON command handler, CmdUpdateDevices in main/WebServerCmds.cpp, performed no session.rights check before invoking a Lua parser script, while its sibling command...

PT-2026-129224

Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the udevices JSON command handler, Cmd UpdateDevices in main/WebServerCmds.cpp, performed no session.rights check before invoking a Lua parser script, while its sibling command...

Domoticz path traversal vulnerability

Domoticz versions 2026.2 and earlier contain a security vulnerability. This vulnerability arises because the udevices JSON command handler fails to verify the session.rights permission before invoking Lua parsing scripts; additionally, the script parameter lacks path traversal protection. As a...

CVE-2026-71265

A flaw was found in Domoticz. The MochadTCP component in Domoticz contains a stack buffer overflow vulnerability. This flaw occurs when the MatchLine handler processes MOCHADRFSEC messages, copying network-received data into a fixed-size buffer without proper length checks. A remote attacker on t...

[SECURITY] Fedora 43 Update: domoticz-2026.3-1.fc43

Domoticz is a Home Automation System that lets you monitor and configure vari ous devices like: Lights, Switches, various sensors/meters like Temperature, Rain, Wind, UV, Electra, Gas, Water and much more. Notifications/Alerts can be sent to any mobile device...

Fedora 43 : domoticz (2026-cda155613e)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-cda155613e advisory. Version 2026.3 August 2nd 2026 This release contains important security fixes in the web server and API, upgrading is strongly recommended...

[SECURITY] Fedora 44 Update: domoticz-2026.3-1.fc44

Domoticz is a Home Automation System that lets you monitor and configure vari ous devices like: Lights, Switches, various sensors/meters like Temperature, Rain, Wind, UV, Electra, Gas, Water and much more. Notifications/Alerts can be sent to any mobile device...

Fedora 44 : domoticz (2026-471f1abb1f)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-471f1abb1f advisory. Version 2026.3 August 2nd 2026 This release contains important security fixes in the web server and API, upgrading is strongly recommended...

CVE-2026-11425

A flaw was found in Domoticz. An authenticated attacker can exploit a stored cross-site scripting XSS vulnerability in the mobile dashboard. This allows the attacker to inject malicious code by updating specific device values through the application's programming interface API. When an...

CVE-2026-11425

Domoticz versions prior to 2026.3 contains a stored cross-site scripting vulnerability in the mobile dashboard that allows authenticated attackers to inject arbitrary HTML and JavaScript by updating Text or Alert subtype device values through the API. The mobile dashboard renders device data via...

CVE-2026-11425

Domoticz versions prior to 2026.3 contains a stored cross-site scripting vulnerability in the mobile dashboard that allows authenticated attackers to inject arbitrary HTML and JavaScript by updating Text or Alert subtype device values through the API. The mobile dashboard renders device data via...

CVE-2026-11425 Domoticz Mobile Dashboard versions prior to 2026.3 Stored XSS via Text/Alert Device Rendering

Domoticz versions prior to 2026.3 contains a stored cross-site scripting vulnerability in the mobile dashboard that allows authenticated attackers to inject arbitrary HTML and JavaScript by updating Text or Alert subtype device values through the API. The mobile dashboard renders device data via...