CVE-2026-71274

OpenBK7231T Stored XSS via Unsanitized MQTT-Set Channel Labels

OpenBK7231T's CHANNEL_SetLabel (src/cmnds/cmd_channels.c) stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNEL_GetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/http_fns.c with no HTML encoding.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Openshwprojects

Products

Openbk7231t App

CVE-2026-71273

OpenBK7231T CSRF in /cfg_wifi_set Leading to Implicit Web Password Disable and WiFi Hijack

OpenBK7231T's /cfg_wifi_set endpoint (src/httpserver/http_fns.c) accepts configuration changes via a plain GET request with no CSRF token. If the parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Openshwprojects

Products

Openbk7231t App

CVE-2026-71272

Memos Webhook DNS Rebinding TOCTOU SSRF in safeDialContext()

Memos' webhook dispatch function safeDialContext (internal/webhook/webhook.go) resolves the target hostname via net.DefaultResolver.LookupHost and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPort(host, port) using the original hostname rather than the already-validated IP address.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Usememos

Products

Memos

CVE-2026-71271

Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass

Memos' webhook URL validation, isReservedIP (internal/webhook/validate.go), checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified — unlike the correctly implemented sibling function isInternalIP in internal/httpgetter/html_meta.go, which does.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Usememos

Products

Memos

CVE-2026-71270

Stirling-PDF Server-Side Request Forgery via /api/v1/convert/url/pdf WeasyPrint Subprocess

Stirling-PDF's POST /api/v1/convert/url/pdf endpoint (ConvertWebsiteToPDF.java) was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints (html/pdf, file/pdf, markdown/pdf).

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Stirling

Products

Stirling Pdf

CVE-2026-71268

OpenPLC Runtime v3 Path Traversal in Structured Text FILE Directive Leading to Arbitrary File Write

OpenPLC Runtime v3's compile_program function (webserver/openplc.py) parses directives from uploaded Structured Text (.st) program files and writes the referenced content to with no validation that file_path stays within the ./core directory. A path-validation function, validate_file_path, exists elsewhere in the codebase (webserver/credentials.py) but is never invoked from compile_program, leaving the sink unprotected.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Thiagoralves

Products

Openplc V3

CVE-2026-71267

microtar Stack Buffer Overflow in mtar_write_file_header() and mtar_write_dir_header()

microtar's mtar_write_file_header and mtar_write_dir_header functions (src/microtar.c) copy a caller-supplied entry name into the 100-byte field of a stack-allocated mtar_header_t via strcpy(h.name, name), with no check that strlen(name) is less than 100 before the copy.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Rxi

Products

Microtar

CVE-2026-71266

tinyobjloader-c Stack Buffer Overflow in MTL Material File Line Parsing

tinyobjloader-c's tinyobj_parse_and_index_mtl_file (tinyobj_loader_c.h) reads each line of a .mtl material file into a fixed 4096-byte stack buffer via memcpy(linebuf, p, p_len), guarded only by . The identical vulnerable pattern is duplicated in a second function in the same file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Syoyo

Products

Tinyobjloader-c

CVE-2026-71265

Domoticz MochadTCP Stack Buffer Overflow via MOCHAD_RFSEC strcpy()

Domoticz's MochadTCP::MatchLine handler for MOCHAD_RFSEC messages (hardware/MochadTCP.cpp) copies network-received data from the up-to-1028-byte m_mochadbuffer into a fixed 50-byte stack buffer tempRFSECbuf using strcpy with no length check, across three separate code branches (DS10A/KR10A/MS10A device types).

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Domoticz

Products

Domoticz

CVE-2026-71264

WLED Unauthenticated Configuration Disclosure via /json/cfg and Global Settings-PIN Lock State

WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration (network, hardware, LED setup) to any unauthenticated client on the network.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Aircoookie

Products

Wled

CVE-2026-71263

FreeModbus LINUXTCP Port Off-by-One Global Buffer Overflow in xMBPortTCPPool()

The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool (demo/LINUXTCP/port/porttcp.c). The check uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MB_TCP_BUF_SIZE limit.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Cwalter-at

Products

Freemodbus

CVE-2026-71262

IoTSharp BlobStorageController Missing Authentication and Path Traversal

IoTSharp BlobStorageController.cs lacks the [Authorize] attribute applied to every other controller in the application (DevicesController, CustomersController, TenantsController, etc.), and no global authorization FallbackPolicy is configured in Startup.cs, leaving its Upload/Download/List/Modify/Delete endpoints reachable by unauthenticated remote attackers.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Iotsharp

Products

Iotsharp

CVE-2026-71261

dr_wav.h W64 CUE Chunk Metadata Parsing Integer Overflow Leading to Heap Buffer Overflow on 32-bit Builds

dr_libs dr_wav.h (all versions through current master) contains an integer overflow in W64 CUE chunk metadata parsing. In drwav__metadata_process_chunk, a stage-1 capacity estimate truncates the 64-bit W64 chunk sizeInBytes to size_t before dividing by DRWAV_CUE_POINT_BYTES; on 32-bit builds this truncation causes the pre-allocated extra metadata capacity to be computed incorrectly.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Mackron

Products

Dr Libs

CVE-2026-71260

ESPHome web_server Plaintext Password Disclosure via JSON "value" Field

ESPHome through 2026.7.0-dev discloses plaintext passwords via its web_server component. In WebServer::text_json_ (esphome/components/web_server/web_server.cpp), a text entity configured with mode: password (TEXT_MODE_PASSWORD) has its JSON "state" field correctly masked as "********", but the same serialization path unconditionally writes the raw password into the JSON "value" field via set_json_icon_state_value/set_json_value.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Esphome

Products

Esphome

CVE-2026-71259

ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/config_validation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the external_components YAML directive's git source schema, which is passed to (git supports file:// natively).

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Esphome

Products

Esphome

CVE-2026-71256

nanoMODBUS Client-Side Out-of-Bounds Read Leading to Wild-Pointer Write via object_id

nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbs_read_device_identification_basic / recv_read_device_identification_res in nanomodbus.c. A fixed 3-element stack array order[3] = {0,1,2} maps object IDs to buffer indices. The server-supplied object_id field (0-255, read directly from the wire) is used without any bounds check as buf_index = order[object_id].

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Debevv

Products

Nanomodbus

CVE-2026-71255

nanoMODBUS Client-Side Out-of-Bounds Write via object_length in recv_read_device_identification_res()

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recv_read_device_identification_res function (FC 0x2B/MEI 0x0E, Read Device Identification) in nanomodbus.c. The server-supplied object_length field (0-246) is validated only against the remaining PDU size (res_size_left) and is never validated against the caller-supplied buffers_length parameter.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Debevv

Products

Nanomodbus

CVE-2026-71254

nanoMODBUS Server-Side Out-of-Bounds Write in handle_read_file_record()

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server-side handle_read_file_record function (FC 0x14, Read File Record) in nanomodbus.c. The function validates that the total request size does not exceed 245 bytes and that each sub-request's record_length is at most 124, but it never validates the CUMULATIVE response size across all sub-requests before processing them.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Debevv

Products

Nanomodbus

CVE-2026-71252

toner-management - Unauthenticated State-Changing Admin Actions

toner-management's admin state-changing handlers (add.php, edit.php, delete.php under admin/toners, admin/toner-brands, admin/printers, and related admin subdirectories) executed INSERT/UPDATE/DELETE database operations with no authentication or authorization check, while access control was enforced only in listing views.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Raghav993

Products

Toner-management

CVE-2026-71251

Akaunting - Cross-Company Media IDOR in Customer Portal Download Endpoint

Akaunting's shared download route (app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/{id}/download behind only generic auth middleware) fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any authenticated portal customer to download any other company's uploaded files by guessing or enumerating media IDs.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Akaunting

Products

Akaunting