CVE-2026-71237

Miantang IoT-PHP is affected by an unauthenticated SQL injection in the index.php POST /userlogin route. The code reads the password from $_POST['pwd'] and directly concatenates it into a SQL query: select * from userlists where username='$username' and password='$password' limit 1, without prope...

CVE-2026-71237 Miantang IoT-PHP - Unauthenticated SQL Injection in /userlogin

Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from 'pwd' with no sanitization and concatenates it into a raw SQL string: mysqlquery"select from userlists where username='' and password='' limit 1". An unauthenticated attacker can submit a payload...

CVE-2026-71231 IOTSmartHome - Unauthenticated SQL Injection via lastLogin Cookie

IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT FROM users WHERE ID='' after base64-decoding the client-supplied lastLogin cookie via safedecode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated...

Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - IoT Component uses...

Cheap Android TV Boxes Pose as Phones and Turn Owners’ Broadband Into Proxies

Bitsight says some cheap Android TV boxes have shipped with apps that rewrite their hardware identity to mimic Samsung, Huawei, Xiaomi, or Vivo phones, then click ads on websites run by the same operators. Researchers named the operation Fuyao and attributed it to Zhejiang Fengwo IoT Technology...

Buffalo WSR-2533DHPL2 - Path Traversal

Buffalo WSR-2533DHPL2 firmware version = 1.02 and WSR-2533DHP3 firmware version = 1.24 are susceptible to a path traversal vulnerability that could allow unauthenticated remote attackers to bypass authentication in their web interfaces. id: CVE-2021-20090 info: name: Buffalo WSR-2533DHPL2 - Path...

Malicious code in iot-kfh-s3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c402827c1e00592a8936a9304c2cccc45189126fc447038f67350a8a9124c81 The package's preinstall script executes node examples/verify.js, which initializes Sentry against a hardcoded author-controlled DSN at...

MAL-2026-10921 Malicious code in iot-kfh-s3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c402827c1e00592a8936a9304c2cccc45189126fc447038f67350a8a9124c81 The package's preinstall script executes node examples/verify.js, which initializes Sentry against a hardcoded author-controlled DSN at...

CVE-2026-40006 Apache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap pipe receiver

Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits or Throttling, Missing Authentication for Critical Function vulnerability in Apache IoTDB. When pipeairgapreceiverenabled=true, the IoTDB AirGap pipe receiver accepts raw TCP connections on port 9780 with no...

EUVD-2026-42833

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache IoTDB. An attacker can write arbitrary files anywhere the IoTDB process has write permissions with unsafe API. This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to...

When checking the URL isn’t enough: a Device Code Phishing attack via a Microsoft website

One of the most common pieces of anti-phishing advice is to double-check the website's domain name before providing your credentials. Typically, a fraudulent domain stands out to the trained eye, differing from the official URL by at least a few characters. Recently, however, we encountered a...

PT-2026-55878

Name of the Vulnerable Software and Affected Versions Apache IoTDB versions 1.3.3 through 2.0.7 Description An uncontrolled resource consumption issue exists where certain interfaces do not impose reasonable limits on the time span and aggregation interval of queries. An attacker can send a reque...

CVE-2026-13768

CVE-2026-13768 affects Gardyn Home Kit and Gardyn Studio. The root cause is exposure of a privileged iothubowner credential, which enables a malicious user to invoke IoTHub Registry Manager functions to obtain connection information for all Gardyn devices and to execute commands on a specific dev...

Several network storage devices of Hangzhou Hikvision Digital Technology Co., Ltd. have logical defects and vulnerabilities.

Hangzhou Hikvision Digital Technology Co., Ltd. is a provider of IoT sensing, artificial intelligence, and big data technology services, with a focus on video technologies. Several of Hangzhou Hikvision Digital Technology Co., Ltd.'s network storage devices have logical defects and vulnerabilitie...

NETGEAR Routers - Remote Code Execution

NETGEAR routers R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before 1.0.1.8.Beta, R8000 before 1.0.3.26.Beta, D6220, D6400, D7000, and possibly others allow...

CVE-2026-50244 Naxclow IoT Platform Missing Authorization

The Naxclow platform exposes a registration endpoint that accepts signed requests containing a batch prefix and an arbitrary caller-supplied account identifier, without validating any ownership relationship. Each call mints a new sequential device identifier and returns the current high-water...

CVE-2026-42932

The CVE-2026-42932 entry concerns the Naxclow IoT Platform where identifier generation uses fixed manufacturing prefixes with sequential counters, creating a fully predictable and enumerable identifier space. An exposed endpoint reveals the current identifier high-water mark, enabling enumeration...

CVE-2026-50108 Naxclow IoT Platform Missing Authorization

The Naxclow platform API that returns device relay registration details exposes a persistent credential without verifying that the requester is the legitimate device or owner. An actor able to present a platform-valid request signature can retrieve credentials for arbitrary devices and register o...

CVE-2026-50101 Naxclow IoT Platform Not using password aging

Naxclow devices use a server-side, per-device relay credential that never rotates and is re-issued to the device on each boot. Because this credential remains valid indefinitely and cannot be reset or revoked by the legitimate owner, any party that obtains it through any exposure path can maintai...

CVE-2026-45328

ESF-IDF is the Espressif Internet of Things IOT Development Framework. In versions 5.5.4 and 6.0, the esptee component exposes secure-service wrappers in espsecureservices.c and espsecureservicesiram.c that bridge calls from the user application i.e. the REE to TEE-protected hardware peripherals...