CVE-2026-86555

Hardcoded Key Vulnerability in ZTE SmartLife APP

The ZTE SmartLife application has a hardcoded key. The key used to decrypt account server information is stored in plaintext in the code. Once the key is obtained, the server information can be decrypted, thus exposing it.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Zte

Products

Smartlife

CVE-2026-86554

Email enumeration and account ID leakage vulnerabilities in ZTE SmartLife APP

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained SmartLife application authentication parameters, attackers can directly invoke the backend interface /account/verify.serv to determine whether a target email address is registered for a SmartLife account. If the account exists, the real backend account ID can also be retrieved.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Zte

Products

Ztesw

CVE-2026-86553

A password reset vulnerability in ZTE SmartLife APP

SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface /account/verify.serv to obtain the real account ID corresponding to a registered email address. By spoofing the application authentication information together with the target account ID, the attacker can reset the password of the target account.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Zte

Products

Ztesw

CVE-2026-86552

A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APP

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface /account/person/signup.serv. Email ownership is not verified prior to registration.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Zte

Products

Ztesw

CVE-2026-86551

Wi-Fi MAC Address Obtainment by Non-privileged Program Vulnerability in ZTE Z80Ultra (NX741J) product

The Z80Ultra (NX741J) product contains a vulnerability where non-privileged programs can retrieve the Wi-Fi MAC address by querying the read-only field factory_mac_address in the Settings.Secure database.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Zte

Products

Nx741j

CVE-2026-85497

CareCam CM2507 Use of Password Hash With Insufficient Computational Effort

CareCam CM2507 IP cameras store the device's root-account password using a fixed legacy password hash that provides insufficient resistance to offline cracking. An attacker who obtains the firmware image or password database could recover the associated credential, which may also be reusable across other devices running the same firmware.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Carecam

Products

Hmt.cm2507 Firmware

CVE-2026-85478

CareCam CM2507 Missing Authentication for Critical Function

A CM2507 IP camera running firmware version HMT.CM2507 v251211.1507 exposes an interactive bootloader through a physical debug interface without requiring authentication. An attacker with physical access could interrupt the normal boot process and access functionality that permits inspection or modification of boot configuration, firmware data, and software loaded by the device.

CVSS 4.0 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Carecam

Products

Hmt.cm2507 Firmware

CVE-2026-84298

Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.95.3, the V1 DurableTask stream handler stores worker-supplied task_external_id values in the durableInvocations routing map before tenant ownership is verified, and callback delivery resolves that map by task UUID without tenant identity. An authenticated tenant worker that knows another tenant's durable task UUID and keeps a stream open on the same dispatcher process can receive that task's durable callback result payload. UUIDv4 values are not enumerable, and single-tenant deployments are unaffected in practice. This issue is fixed in version 0.95.3.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Hatchet-dev

Products

Hatchet

CVE-2026-82672

Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on a pooled connection, enabling response-queue poisoning against subsequent requests that share the connection. Mint.HTTP1.Parse.chunk_size/1 in lib/mint/http1/parse.ex stops at the first non-hexadecimal byte of a chunked response's chunk-size line and returns the remainder unexamined. Mint.HTTP1.decode_body/5 in lib/mint/http1.ex then discards every byte up to the CRLF with Parse.ignore_until_crlf/1, so the accepted grammar is a run of hex digits followed by arbitrary bytes, where RFC 9112 permits only a ;-introduced chunk extension. Lines such as 5ZZZZZ and 5 9 are accepted as chunk size 5, and 0ZZZZ is accepted as the terminating chunk that ends the message body. An RFC-strict intermediary rejects such a line while Mint accepts it, so the two disagree on chunk boundaries and on where the response ends. This issue affects mint: from 0.1.0 before 1.10.1.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Elixir-mint

Products

Mint

CVE-2026-81669

IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is vulnerable to a command injection vulnerability in the create csr wildcard CLI command. An authenticated privileged CLI user can inject arbitrary shell commands through the alias input, resulting in command execution with root privileges.

CVSS 3.1 · 7.2 High EPSS 1.3% KEV · Not listed

Vendors

Ibm

Products

Guardium Data Protection

CVE-2026-79920

Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task

Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin construct a pip package specification from unvalidated name and version fields, and the task worker invokes pip while running as root. A low-privileged user can therefore select or manipulate a package installed with root privileges and can install, remove, or upgrade plugins without administrative permission, resulting in root code execution and full host compromise. This issue is fixed in version 2.2.16.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Ajenti

Products

Ajenti

CVE-2026-77972

safeurl validated address is not bound to the request, allowing DNS rebinding

Time-of-check Time-of-use (TOCTOU) Race Condition in Slab safeurl allows an attacker who controls a hostname's DNS responses to reach internal network destinations that validation rejected. Validation returns a verdict and not the address it approved, so the HTTP clients the library ships receive the original hostname and resolve it a second time when the request is made. An attacker who controls the authoritative DNS for a name can answer the first lookup with a permitted address and the second with a blocked one, and the request then reaches a destination validation never approved. The same window opens without an attacker whenever a name legitimately resolves to different addresses across lookups, such as short record lifetimes or rotation between several addresses. This issue affects safeurl: from 0.1.0 onward.

CVSS 4.0 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Slab

Products

Safeurl

CVE-2026-77866

SSRF protection bypass in safeurl via IPv6 addresses and unresolvable hosts

Server-Side Request Forgery (SSRF) vulnerability in Slab safeurl allows an attacker who controls a validated URL to reach internal network destinations the library is configured to block. Only IPv4 addresses are matched against the reserved ranges and the blocklist. Every other address is treated as matching nothing, so a destination that is rejected in its IPv4 form is accepted when written as an IPv6 address, IPv6 entries in the blocklist never match, and a host that resolves to no IPv4 address is accepted regardless of where it points. Deployments that rely on the allowlist instead are unaffected, because there an unmatched address is rejected. This issue affects safeurl: from 0.1.0 onward.

CVSS 4.0 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Slab

Products

Safeurl

CVE-2026-77166

Inadequate Input Validation in Emoji Update Endpoint Causes Layout Breakage

The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items.

CVSS 3.0 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Nextcloud

Products

Collectives

CVE-2026-77165

Permanent File Locks due to Improper Access Control in Nextcloud Server

File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Nextcloud

Products

Server

CVE-2026-76861

Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in ntools_tcpdump_start_set.cgi

Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in ntools_tcpdump_start_set.cgi caused by an unsized sprintf call when processing form values. An attacker can submit crafted input to this cgi endpoint to overflow the stack buffer and potentially execute arbitrary code.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Netcore

Products

Nr255-v

CVE-2026-76856

Netcore NR255-V 1.5.130703 Cross-Site Request Forgery in WAN/LAN Configuration Endpoints

Netcore NR255-V firmware version 1.5.130703 contains a cross-site request forgery vulnerability affecting the wan_config_set_cgi, wan_num_set_cgi, and lan_ip_change_cgi endpoints. Attackers can craft forged requests to trick authenticated administrators into modifying WAN or LAN network configuration settings without consent.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Netcore

Products

Nr255-v

CVE-2026-75894

Reachable assertion at ranap_handle_co_dt()

In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was found in the ranap_handle_co_dt() function via a arbitrarily sized NAS-PDU that leads to process crash and remote denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Osmocom

Products

Osmo-iuh

CVE-2026-75893

Heap based buffer overflow at ipaccess_proxy_read_msg()

In osmo-bsc from 1.0.1 through 1.14.1 a heap based buffer overflow issue was found in the ipaccess_proxy_read_msg()  function via IPA frame lengths.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Osmocom

Products

Osmo-bsc

CVE-2026-75892

Out of bounds write in PDP ctx GSN-Address decode

In osmo-ggsn 1.14.0 an out of bounds write issue was found in the gtp_decode_pdp_ctx() function through the PDP context GSN-Address sub-field, leading to memory corruption.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Osmocom

Products

Osmo-ggsn