Iot

D-Link DIR-820L `get_set.ccp` LAN Configuration OS Command Injection (CVE-2022-26258) new KEV EPSS 80%CVE-2022-26258networkCRITICAL 9.8Unverified2026-07-11Xiongmai XM530 IP Camera ONVIF Authentication Bypass (CVE-2025-65856) newCVE-2025-65856hardwareCRITICAL 9.8Unverified2026-07-06ThingsBoard IoT Platform SSRF via SVG Image Upload (CVE-2025-34282) newCVE-2025-34282webCRITICAL 9.1Patched2026-07-06Tenda AC9 `AdvSetMacMtuWan` Stack-Based Buffer Overflow (CVE-2025-29384) newCVE-2025-29384networkCRITICAL 9.8Unpatched2026-07-06D-Link AX1500 SetDeviceSettings `DeviceName` OS Command Injection (CVE-2025-60854) newCVE-2025-60854networkCRITICAL 9.8Patched2026-07-06Zyxel VMG3625-T50B Authenticated Command Injection to Root SSH Access (CVE-2026-1459) newCVE-2026-1459networkHIGHUnverified2026-07-05ZTE ZXHN H298A / H108N Router Unauthenticated Credential Disclosure (CVE-2026-34474) new EPSS 25%CVE-2026-34474networkHIGHUnverified2026-07-05ZTE ZXHN H188A Unauthenticated Wizard Handler Credential Disclosure / Auth Bypass (CVE-2026-34472) newCVE-2026-34472networkCRITICALUnverified2026-07-05ZTE Router Unauthenticated Oversized-POST Denial of Service (CVE-2026-34473) newCVE-2026-34473networkHIGHUnverified2026-07-05Wyze Cam Pan v3 / TUTK SDK — tutk_packet_alloc Heap Overflow (CVE-2026-38698) newCVE-2026-38698networkCRITICALUnverified2026-07-05TP-Link Tapo C260 Unauthenticated-to-Root RCE Chain — CVE-2026-0651 newCVE-2026-0651networkCRITICALUnverified2026-07-05TP-Link DHCP Option 66 Unauthenticated RCE — CVE-2026-11834 newCVE-2026-11834networkCRITICALUnverified2026-07-05TP-Link Archer C64 Web UI Rate-Limit Bypass via Residual Debug SSH Service (CVE-2026-8697) newCVE-2026-8697networkCRITICAL 9.3Unverified2026-07-05Tenda HG7/HG9/HG10 Router Stack-Based Buffer Overflow — CVE-2026-11499 newCVE-2026-11499networkHIGHUnverified2026-07-05Tasmota fetch_jpg() strcpy() Buffer Overflow in boundary[40] (CVE-2026-38426) newCVE-2026-38426networkCRITICAL 9.8Patched2026-07-05Tasmota fetch_jpg() Integer Wraparound to Heap Corruption (CVE-2026-38427) newCVE-2026-38427networkCRITICAL 9.8Patched2026-07-05Tasmota fetch_jpg() Combined Buffer Overflow RCE Chain (CVE-2026-38422) newCVE-2026-38422networkCRITICAL 9.8Patched2026-07-05OpenRemote — Expression Injection RCE in Rules Engine (CVE-2026-39842) newCVE-2026-39842 / GHSA-7mqr-33rv-p3mpwebCRITICAL 10Patched2026-07-05MR9600 Router Bluetooth/JNAP Management Interface RCE Injection (CVE-2026-6992) newCVE-2026-6992networkHIGHUnverified2026-07-05GeoVision GV-I/O Box 4E DVRSearch Unauthenticated Stack Buffer Overflow RCE (CVE-2026-12485) newCVE-2026-12485networkCRITICAL 10Patched2026-06-30