Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2025-64770 | 7.0 high | 0.00% | no CPE yet | The affected products allow unauthenticated access to Open Network Video Interface Forum (ONVIF) services, which may allow an attacker unauthorized access to camera configuration information. | 18 Oct |
| CVE-2026-85803 | 7.0 high | 0.00% | microsoft, windows_11_23h2, windows_11_24h2, windows_11_25h2 | Use after free in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally. | 16 Oct |
| CVE-2026-12060 | 6.9 medium | 0.00% | no CPE yet | Heptabase developed by Hepta Platforms has a Exposed Dangerous Method or Function vulnerability, allowing unauthenticated remote attackers to leverage social engineering techniques to trick a victim into opening or loading a malicious webpage within the Heptabase application, thereby gaining unauthorized access to camera and microphone permissions. | Mon 26 Oct |
| CVE-2026-53986 | 6.9 medium | 0.00% | no CPE yet | Girafit camera app (Android and iOS) version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials vulnerability that allows attackers to obtain the shared TURN relay username by decompiling the app or intercepting unencrypted network traffic during live view registration. Attackers can extract the static TURN username and session token, which are identical across all installs and not tied to any user or device, potentially enabling tracking, impersonation, or further exploitation if combined with the TURN relay password. | 22 Oct |
| CVE-2025-54860 | 6.9 medium | 0.00% | no CPE yet | Cognex In-Sight Explorer and In-Sight Camera Firmware expose a telnet-based service on port 23 in order to allow management operations on the device such as firmware upgrades and device reboot requiring an authentication. A wrong management of login failures of the service allows a denial-of-service attack, leaving the telnet service into an unreachable state. | 18 Oct |
| CVE-2025-41017 | 6.9 medium | 0.00% | no CPE yet | Inadequate access control vulnerability in Davantis DDFUSION v6.177.7, which allows unauthorised actors to retrieve perspective parameters from security camera settings by accessing “/cameras/<CAMERA_ID>/perspective”. | 8 Oct |
| CVE-2025-12351 | 6.8 medium | 0.00% | no CPE yet | Honeywell S35 Series Cameras contains an authorization bypass Vulnerability through User controller key. An attacker could potentially exploit this vulnerability, leading to Privilege Escalation to admin privileged functionalities . Honeywell also recommends updating to the most recent version of this product, service or offering (S35 Pinhole/Kit Camera to version 2025.08.28, S35 AI Fisheye & Dual Sensor/Micro Dome/Full Color Eyeball & Bullet Camera to version 2025.08.22, S35 Thermal Camera to version 2025.08.26). | 18 Oct |
| CVE-2026-25273 | 6.7 medium | 0.00% | qualcomm, congo_firmware, cq8845s_firmware, cq8850ns_firmware | Memory Corruption when processing camera operations due to out-of-bounds write during driver updates. | 9 Oct |
| CVE-2026-25272 | 6.7 medium | 0.00% | qualcomm, snapdragon_g1_gen_2_gaming_platform_firmware, cologne_firmware, cq2390m_firmware | Memory Corruption when processing camera CRE driver operations with improper handling of buffer limits during hardware update preparation. | 9 Oct |
| CVE-2026-25270 | 6.7 medium | 0.00% | qualcomm, snapdragon_g1_gen_2_gaming_platform_firmware, cologne_firmware, congo_firmware | Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver. | 9 Oct |
| CVE-2026-25269 | 6.7 medium | 0.00% | qualcomm, snapdragon_g1_gen_2_gaming_platform_firmware, cologne_firmware, cq2390m_firmware | Memory corruption when processing camera requests with excessive batch and IO buffer configurations exceeds allocated memory size. | 9 Oct |
| CVE-2026-51598 | 6.5 medium | 0.00% | no CPE yet | An input validation vulnerability in the RTSP service of MERCURY MIPC252W IP Camera v1.0.5 Build 230306 Rel.79931n) allows an unauthenticated, network-adjacent attacker to cause a denial of service via a crafted DESCRIBE request with a malformed URL in the request line. | Sun 25 Oct |
| CVE-2025-11649 | 6.4 medium | 0.00% | furbo, furbo_mini_firmware, furbo_360_dog_camera_firmware | A vulnerability was found in Tomofun Furbo 360 and Furbo Mini. The affected element is an unknown function of the component Root Account Handler. Performing manipulation results in use of hard-coded password. The attack must be initiated from a local position. The attack is considered to have high complexity. The exploitability is described as difficult. The exploit has been made public and could be used. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way. | 18 Oct |
| CVE-2025-11633 | 6.3 medium | 0.00% | furbo, furbo_mini_firmware, furbo_360_dog_camera_firmware | A vulnerability was identified in Tomofun Furbo 360 and Furbo Mini. Affected by this issue is the function upload_file_to_s3 of the file collect_logs.sh of the component HTTP Traffic Handler. The manipulation leads to improper certificate validation. The attack may be initiated remotely. The attack is considered to have high complexity. The exploitation is known to be difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way. | 18 Oct |
| CVE-2025-11643 | 6.3 medium | 0.00% | furbo, furbo_mini_firmware, furbo_360_dog_camera_firmware | A security flaw has been discovered in Tomofun Furbo 360 and Furbo Mini. Affected by this vulnerability is an unknown functionality of the file /squashfs-root/furbo_img of the component MQTT Client Certificate. Performing manipulation results in hard-coded credentials. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitation appears to be difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way. | 18 Oct |
| CVE-2025-11636 | 6.3 medium | 0.00% | furbo, furbo_360_dog_camera_firmware | A security vulnerability has been detected in Tomofun Furbo 360 up to FB0035_FW_036. This issue affects some unknown processing of the component Account Handler. Such manipulation leads to server-side request forgery. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The vendor was contacted early about this disclosure but did not respond in any way. | 8 Oct |
| CVE-2025-52516 | 6.2 medium | 0.00% | samsung, exynos_1330_firmware, exynos_1380_firmware, exynos_1480_firmware | An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500. An invalid kernel address dereference in the issimian device driver leads to a denial of service. | 19 Oct |
| CVE-2026-40333 | 6.1 medium | 0.00% | no CPE yet | libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, two functions in camlibs/ptp2/ptp-pack.c accept a data pointer but no length parameter, performing unbounded reads. Their callers in ptp_unpack_EOS_events() have xsize available but never pass it, leaving both functions unable to validate reads against the actual buffer boundary. Commit 1817ecead20c2aafa7549dac9619fe38f47b2f53 patches the issue. | Mon 26 Oct |
| CVE-2026-40340 | 6.1 medium | 0.00% | no CPE yet | libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read vulnerability in `ptp_unpack_OI()` in `camlibs/ptp2/ptp-pack.c` (lines 530–563). The function validates `len < PTP_oi_SequenceNumber` (i.e., len < 48) but subsequently accesses offsets 48–56, up to 9 bytes beyond the validated boundary, via the Samsung Galaxy 64-bit objectsize detection heuristic. Commit 7c7f515bc88c3d0c4098ac965d313518e0ccbe33 fixes the issue. | Mon 26 Oct |
| CVE-2026-12527 | 6.0 medium | 0.00% | no CPE yet | A broken authorization boundary in the RTSP media delivery pipeline of Shenzhen Liandian Communication Technology LTD V380 IP Camera firmware AppFHE1_V1.0.6.020230803 enables unauthenticated network actors to bypass the device’s credential-enforced live-view workflow and directly retrieve real-time video stream data. | Mon 26 Oct |
| CVE-2026-111374 | 6.0 medium | 0.00% | freerdp | FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client that lets malicious RDP servers request unadvertised camera media types. Attackers can send a StartStreamsRequest with oversized dimensions to force large pending-sample allocations and reconfigure the local camera through the HAL. | 20 Oct |
| CVE-2026-16755 | 6.0 medium | 0.00% | no CPE yet | A potential vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an unauthorized remote user to disclose sensitive information. | 16 Oct |
| CVE-2026-16754 | 5.9 medium | 0.00% | no CPE yet | A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications. | 16 Oct |
| CVE-2025-62570 | 5.5 medium | 0.00% | microsoft, windows_11_24h2, windows_11_25h2, windows_server_2025 | Improper access control in Windows Camera Frame Server Monitor allows an authorized attacker to disclose information locally. | 14 Oct |
| CVE-2025-58277 | 5.5 medium | 0.00% | huawei, harmonyos | Permission verification bypass vulnerability in the Camera app. Successful exploitation of this vulnerability may affect service confidentiality. | 8 Oct |
| CVE-2025-58282 | 5.5 medium | 0.00% | huawei, harmonyos | Permission control vulnerability in the camera module. Successful exploitation of this vulnerability may affect service confidentiality. | 8 Oct |
| CVE-2026-33093 | 5.3 medium | 0.00% | anviz, cx7_firmware | Anviz CX7 Firmware is vulnerable to an unauthenticated POST to the device that captures a photo with the front facing camera, exposing visual information about the deployment environment. | Sun 25 Oct |
| CVE-2026-105814 | 5.3 medium | 0.00% | no CPE yet | TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API. A crafted JSON request containing both a protected operation and public onboarding-related fields may cause module-level authorization checks to be applied inconsistently, allowing protected camera operations, including pan-tilt-zoom control, to be executed without a valid authenticated session. Successful exploitation may allow an unauthenticated attacker on the adjacent network to perform protected camera operations, including pan-tilt-zoom (PTZ) control, without a valid authenticated session. This could result in unauthorized manipulation of camera functionality. | 20 Oct |
| CVE-2025-11638 | 5.3 medium | 0.00% | furbo, furbo_mini_firmware, furbo_360_dog_camera_firmware | A flaw has been found in Tomofun Furbo 360 and Furbo Mini. The affected element is an unknown function of the component Bluetooth Handler. Executing manipulation can lead to denial of service. The attacker needs to be present on the local network. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way. | 18 Oct |
| CVE-2026-108165 | 5.3 medium | 0.00% | no CPE yet | Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata because sync queries do not exclude Locked visibility. Attackers with an active partner relationship can call POST /api/sync/stream with PartnerAssetsV2 and PartnerAssetExifsV1 types to obtain GPS coordinates, capture times, descriptions and camera details. | 18 Oct |
| CVE-2025-11635 | 5.3 medium | 0.00% | furbo, furbo_360_dog_camera_firmware | A weakness has been identified in Tomofun Furbo 360 up to FB0035_FW_036. This vulnerability affects unknown code of the component File Upload. This manipulation causes resource consumption. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way. | 8 Oct |
| CVE-2025-11637 | 5.3 medium | 0.00% | furbo, furbo_360_dog_camera_firmware | A vulnerability was detected in Tomofun Furbo 360 up to FB0035_FW_036. Impacted is an unknown function of the component Audio Handler. Performing manipulation results in race condition. The attack is possible to be carried out remotely. The vendor was contacted early about this disclosure but did not respond in any way. | 8 Oct |
| CVE-2026-40338 | 5.2 medium | 0.00% | no CPE yet | libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in the PTP_DPFF_Enumeration case of `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack.c` (line 856). The function reads a 2-byte enumeration count N via `dtoh16o(data, *poffset)` without verifying that 2 bytes remain in the buffer. The standard `ptp_unpack_DPD()` at line 704 has this exact check, confirming the Sony variant omitted it by oversight. Commit 3b9f9696be76ae51dca983d9dd8ce586a2561845 fixes the issue. | Mon 26 Oct |
| CVE-2026-40335 | 5.2 medium | 0.00% | no CPE yet | libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in `ptp_unpack_DPV()` in `camlibs/ptp2/ptp-pack.c` (lines 622–629). The UINT128 and INT128 cases advance `*offset += 16` without verifying that 16 bytes remain in the buffer. The entry check at line 609 only guarantees `*offset < total` (at least 1 byte available), leaving up to 15 bytes unvalidated. Commit 433bde9888d70aa726e32744cd751d7dbe94379a patches the issue. | Sun 25 Oct |
| CVE-2026-40339 | 5.2 medium | 0.00% | no CPE yet | libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack.c` (line 842). The function reads the FormFlag byte via `dtoh8o(data, *poffset)` without a prior bounds check. The standard `ptp_unpack_DPD()` at lines 686–687 correctly validates `*offset + sizeof(uint8_t) > dpdlen` before this same read, but the Sony variant omits this check entirely. Commit 09f8a940b1e418b5693f5c11e3016a1ad2cea62d fixes the issue. | Sun 25 Oct |
| CVE-2026-55644 | 5.1 medium | 0.00% | no CPE yet | Element X iOS is a Matrix iOS Client provided by Element. Element X iOS before version 26.05.0 fails to check the URL allowlist when parsing io.element.call://. If an attacker is able to trick the user into opening a maliciously crafted io.element.call:// URL, they are able to load an attacker-controlled origin inside the call screen's WKWebView which will be granted device microphone and camera permissions (provided the user has previously granted these permissions to Element X iOS). This issue has been patched in version 26.05.0. | 22 Oct |
| CVE-2025-11639 | 4.8 medium | 0.00% | furbo, furbo_mini_firmware, furbo_360_dog_camera_firmware | A vulnerability has been found in Tomofun Furbo 360 and Furbo Mini. The impacted element is an unknown function of the file collect_logs.sh of the component Debug Log S3 Bucket Handler. The manipulation leads to insecure storage of sensitive information. An attack has to be approached locally. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way. | 18 Oct |
| CVE-2025-11642 | 4.1 medium | 0.00% | furbo, furbo_mini_firmware, furbo_360_dog_camera_firmware | A vulnerability was identified in Tomofun Furbo 360 and Furbo Mini. Affected is an unknown function of the component Registration Handler. Such manipulation leads to denial of service. The attack can be executed directly on the physical device. The attack requires a high level of complexity. The exploitability is told to be difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way. | 18 Oct |
| CVE-2026-0158 | 4.0 medium | 0.00% | google, android | In Camera, there is a possible unauthorized way to access photos due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | Sun 25 Oct |
| CVE-2026-40334 | 3.5 low | 0.00% | no CPE yet | libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, a missing null terminator exists in ptp_unpack_Canon_FE() in camlibs/ptp2/ptp-pack.c (line 1377). The function copies a filename into a 13-byte buffer using strncpy without explicitly null-terminating the result. If the source data is exactly 13 bytes with no null terminator, the buffer is left unterminated, leading to out-of-bounds reads in any subsequent string operation. Commit 259fc7d3bfe534ce4b114c464f55b448670ab873 patches the issue. | Mon 26 Oct |
| CVE-2026-40341 | 3.5 low | 0.00% | no CPE yet | libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, an out of bound read in ptp_unpack_EOS_FocusInfoEx could be used to crash libgphoto2 when processing input from untrusted USB devices. Commit c385b34af260595dfbb5f9329526be5158985987 contains a patch. No known workarounds are available. | Mon 26 Oct |
| CVE-2026-28957 | 3.3 low | 0.00% | apple, ipados, iphone_os, visionos | An issue with app access to camera metadata was addressed with improved logic. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, visionOS 26.5. An app may be able to capture a user's screen. | Mon 26 Oct |
| CVE-2026-116114 | 2.9 low | 0.00% | no CPE yet | A weakness has been identified in Yoosee GM8135S Camera 21.00.01.36. This affects an unknown function of the file /npc/npc of the component Live UDP H.264 Video Stream Handler. This manipulation causes cleartext transmission of sensitive information. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | Mon 26 Oct |
| CVE-2025-11648 | 2.9 low | 0.00% | furbo, furbo_mini_firmware, furbo_360_dog_camera_firmware | A vulnerability has been found in Tomofun Furbo 360 and Furbo Mini. Impacted is an unknown function of the file TF_FQDN.json of the component GATT Interface URL Handler. Such manipulation leads to server-side request forgery. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is considered difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way. | 18 Oct |
| CVE-2026-40336 | 2.4 low | 0.00% | no CPE yet | libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have a memory leak in `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack.c` (lines 884–885). When processing a secondary enumeration list (introduced in 2024+ Sony cameras), the function overwrites dpd->FORM.Enum.SupportedValue with a new calloc() without freeing the previous allocation from line 857. The original array and any string values it contains are leaked on every property descriptor parse. Commit 404ff02c75f3cb280196fc260a63c4d26cf1a8f6 fixes the issue. | Mon 26 Oct |
| CVE-2025-11634 | 2.4 low | 0.00% | furbo, furbo_mini_firmware, furbo_360_dog_camera_firmware | A security flaw has been discovered in Tomofun Furbo 360 and Furbo Mini. This affects an unknown part of the component UART Interface. The manipulation results in information disclosure. An attack on the physical device is feasible. The exploit has been released to the public and may be exploited. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way. | 18 Oct |
| CVE-2025-11640 | 2.3 low | 0.00% | furbo, furbo_mini_firmware, furbo_360_dog_camera_firmware | A vulnerability was found in Tomofun Furbo 360 and Furbo Mini. This affects an unknown function of the component Bluetooth Low Energy. The manipulation results in cleartext transmission of sensitive information. Access to the local network is required for this attack. Attacks of this nature are highly complex. The exploitability is reported as difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way. | 18 Oct |
| CVE-2026-116115 | 1.3 low | 0.00% | no CPE yet | A security vulnerability has been detected in Yoosee GM8135S Camera 21.00.01.36. This impacts an unknown function of the file wpa_supplicantX.conf of the component WiFi Configuration. Such manipulation leads to improper initialization. The attack can only be initiated within the local network. This attack is characterized by high complexity. The exploitability is said to be difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | Mon 26 Oct |
| CVE-2025-9383 | 1.1 low | 0.00% | no CPE yet | A security vulnerability has been detected in FNKvision Y215 CCTV Camera 10.194.120.40. This issue affects the function crypt of the file /etc/passwd. The manipulation leads to use of weak hash. The attack can only be performed from a local environment. The complexity of an attack is rather high. The exploitability is assessed as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | 18 Oct |
| CVE-2025-11641 | 1.0 low | 0.00% | furbo, furbo_mini_firmware, furbo_360_dog_camera_firmware | A vulnerability was determined in Tomofun Furbo 360 and Furbo Mini. This impacts an unknown function of the component Trial Restriction Handler. This manipulation causes improper access controls. It is feasible to perform the attack on the physical device. The attack is considered to have high complexity. The exploitability is said to be difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way. | 18 Oct |
Download these 103 as CSV · subscribe to this list.
EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.