Vulnerabilities
Summary — last 7 days
New vulnerabilities5,279▲ 2,571 vs. last week
Critical / high2,962▲ 1,655 vs. last week
New active exploitation (KEV)6▼ 2 vs. last week
Unscored (no CVSS)242▲ 69 vs. last week
3 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | High (8.7) | 0.20% | — | Tp-link Tapo C325wbAI | 10/8/2026 | 10/9/2026 | TP-Link Tapo C325WB V2 generates the pre-shared key used by its local media streaming service with a time-seeded pseudo-random number generator, making the key predictable and recoverable. An unauthenticated attacker on the adjacent network can recover the key and authenticate to the media streaming service without… | |
| Deferred | High (7.1) | 0.20% | — | Tp-link Tapo C325wbAI | 10/8/2026 | 10/9/2026 | An unauthenticated denial-of-service vulnerability exists in Tapo C325WB v2 in the RTSP streaming service on TCP port 554 when the Camera Account feature is enabled. A crafted pair of RTSP-over-HTTP tunneling requests can cause memory corruption and crash the streaming daemon. Successful exploitation may allow an… | |
| Deferred | High (8.7) | 0.24% | — | Tp-link Tapo C325wbAI | 10/8/2026 | 10/9/2026 | TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability in the HTTPS JSON API dispatcher on TCP port 443. An attacker on the adjacent network can append an onboarding-scoped object to a JSON request to bypass session verification and invoke privileged actions without authentication.… |