6096 matches found
EUVD-2026-95405
TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability in the HTTPS JSON API dispatcher on TCP port 443. An attacker on the adjacent network can append an onboarding-scoped object to a JSON request to bypass session verification and invoke privileged actions without...
CVE-2026-105674
TP-Link Tapo C325WB V2 generates the pre-shared key used by its local media streaming service with a time-seeded pseudo-random number generator, making the key predictable and recoverable. An unauthenticated attacker on the adjacent network can recover the key and authenticate to the media...
CVE-2026-105672
TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability in the HTTPS JSON API dispatcher on TCP port 443. An attacker on the adjacent network can append an onboarding-scoped object to a JSON request to bypass session verification and invoke privileged actions without...
CVE-2026-105674 Predictable Media Stream Pre-Shared Key Vulnerability in TP-Link Tapo C325WB
TP-Link Tapo C325WB V2 generates the pre-shared key used by its local media streaming service with a time-seeded pseudo-random number generator, making the key predictable and recoverable. An unauthenticated attacker on the adjacent network can recover the key and authenticate to the media...
CVE-2026-105674
The TP-Link Tapo C325WB V2 is vulnerable to a predictable media stream pre-shared key generation. The device uses a time-seeded pseudo-random number generator to create keys for its local media streaming service, allowing an unauthenticated attacker on the adjacent network to recover the key. Suc...
CVE-2026-105672 Unauthenticated JSON API Authorization Bypass Vulnerability in TP-Link Tapo C325WB
TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability in the HTTPS JSON API dispatcher on TCP port 443. An attacker on the adjacent network can append an onboarding-scoped object to a JSON request to bypass session verification and invoke privileged actions without...
CVE-2026-105672
The TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability within the HTTPS JSON API dispatcher on TCP port 443. An attacker located on the adjacent network can exploit this by appending an onboarding-scoped object to a JSON request, effectively bypassing session ve...
CVE-2026-105673 Unauthenticated RTSP Tunnel Denial-of-Service Vulnerability in TP-Link Tapo C325WB
An unauthenticated denial-of-service vulnerability exists in Tapo C325WB v2 in the RTSP streaming service on TCP port 554 when the Camera Account feature is enabled. A crafted pair of RTSP-over-HTTP tunneling requests can cause memory corruption and crash the streaming daemon. Successful...
cn.vertxup:vertx-co (0.4.9), cn.vertxup:vertx-ifx (0.4.9) +67 more potentially affected by CVE-2026-107726 via com.hazelcast:hazelcast (3.11.1)
com.hazelcast:hazelcast MAVEN version 3.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - cn.vertxup:vertx-co 0.4.9 - cn.vertxup:vertx-ifx 0.4.9 - cn.vertxup:vertx-import 0.4.9 - cn.vertxup:vertx-rx 0.4...
CVE-2026-105674: Use of Insufficiently Random Values
TP-Link Tapo C325WB V2 generates the pre-shared key used by its local media streaming service with a time-seeded pseudo-random number generator, making the key predictable and recoverable. An unauthenticated attacker on the adjacent network can recover the key and authenticate to the media...
CVE-2026-105672: Improper Authentication
TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability in the HTTPS JSON API dispatcher on TCP port 443. An attacker on the adjacent network can append an onboarding-scoped object to a JSON request to bypass session verification and invoke privileged actions without...
PT-2026-108282
Name of the Vulnerable Software and Affected Versions TP-Link Tapo C325WB V2 affected versions not specified Description An unauthenticated authorization bypass exists in the HTTPS JSON API dispatcher on TCP port 443. An attacker on the adjacent network can bypass session verification and execute...
PT-2026-108284
Name of the Vulnerable Software and Affected Versions TP-Link Tapo C325WB V2 affected versions not specified Description The local media streaming service generates a pre-shared key using a time-seeded pseudo-random number generator, which makes the key predictable and recoverable. An...
CVE-2026-104944
TP-Link Tapo C500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP TP-Link Device Protocol daemon. A single unauthenticated UDP datagram can cause an invalid indirect call, crashing the main service and resulting in a denial-of-service condition. Successful exploitation may all...
CVE-2026-104945
TP-Link Tapo C500 v2.0 contains an out-of-bounds stack write vulnerability in its ONVIF PTZ SOAP handlers. An authenticated ONVIF client can submit an excessive number of preset-related elements, causing writes beyond the bounds of fixed-size stack arrays and resulting in a crash of the affected...
CVE-2026-104945
The TP-Link Tapo C500 v2.0 is vulnerable to an out-of-bounds stack write within its ONVIF PTZ SOAP handlers . An authenticated ONVIF client can trigger this by submitting an excessive number of preset-related elements, causing writes beyond the boundaries of fixed-size stack arrays. This flaw lea...
CVE-2026-104945 Authenticated ONVIF PTZ Out-of-Bounds Stack Write Denial of Service in TP-Link Tapo C500
TP-Link Tapo C500 v2.0 contains an out-of-bounds stack write vulnerability in its ONVIF PTZ SOAP handlers. An authenticated ONVIF client can submit an excessive number of preset-related elements, causing writes beyond the bounds of fixed-size stack arrays and resulting in a crash of the affected...
EUVD-2026-93839
TP-Link Tapo C500 v2.0 contains an out-of-bounds stack write vulnerability in its ONVIF PTZ SOAP handlers. An authenticated ONVIF client can submit an excessive number of preset-related elements, causing writes beyond the bounds of fixed-size stack arrays and resulting in a crash of the affected...
CVE-2026-104944 Unauthenticated TDP Function Pointer Dispatch Denial of Service in TP-Link Tapo C500
TP-Link Tapo C500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP TP-Link Device Protocol daemon. A single unauthenticated UDP datagram can cause an invalid indirect call, crashing the main service and resulting in a denial-of-service condition. Successful exploitation may all...
CVE-2026-104944 Unauthenticated TDP Function Pointer Dispatch Denial of Service in TP-Link Tapo C500
TP-Link Tapo C500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP TP-Link Device Protocol daemon. A single unauthenticated UDP datagram can cause an invalid indirect call, crashing the main service and resulting in a denial-of-service condition. Successful exploitation may all...