runZero practices coordinated vulnerability disclosure. See our disclosure policy here.

2026

CVE-2026-65208

October 13, 2026

HPE iLO 5 JSON dispatcher mutex leak

Vendors: HPE

Products: HPE Integrated Lights-Out 5 (iLO 5)

CVE-2026-65198

October 13, 2026

Huawei Default SNMPv3 USM key

Vendors: Huawei

Products: Huawei openUBMC 26.06

CVE-2026-65199

October 13, 2026

Huawei openUBMC low-privilege SNMP to administrator privilege escalation

Vendors: Huawei

Products: Huawei openUBMC 26.06

CVE-2026-65197

October 13, 2026

H3C G3/G5 HDM Firmware Verification Key Replacement

Vendors: H3C

Products: H3C HDM Family-A G3, H3C HDM Family-A G5

CVE-2026-65209

October 13, 2026

HPE iLO 4/5 Redfish deeply nested JSON denial-of-service

Vendors: HPE

Products: HPE Integrated Lights-Out 4 (iLO 4), HPE Integrated Lights-Out 5 (iLO 5)

CVE-2026-65205

October 13, 2026

HPE iLO 2/3/4 missing RMCP+ integrity enforcement allows IPMI session injection

Vendors: HPE

Products: HPE Integrated Lights-Out 2 (iLO 2), HPE Integrated Lights-Out 3 (iLO 3) ... (+1 more)

CVE-2026-65206

October 13, 2026

HPE iLO 2/3/4 RMCP+ type confusion enables passwordless administrator sessions

Vendors: HPE

Products: HPE Integrated Lights-Out 2 (iLO 2), HPE Integrated Lights-Out 3 (iLO 3) ... (+1 more)

CVE-2026-65207

October 13, 2026

HPE iLO 4/5 truncated JSON unicode escape denial-of-service

Vendors: HPE

Products: HPE Integrated Lights-Out 4 (iLO 4), HPE Integrated Lights-Out 5 (iLO 5)

CVE-2026-65204

October 13, 2026

HPE iLO 4/5/6 pre-authentication stack overflow in SSH packet processor

Vendors: HPE

Products: HPE Integrated Lights-Out 4 (iLO 4), HPE Integrated Lights-Out 5 (iLO 5) ... (+1 more)

CVE-2026-16141

September 15, 2026

CVE-2026-16140

September 15, 2026

OpenBMC IPMI Privilege Escalation via Retargeted RAKP 1

Vendors: OpenBMC

Products: phosphor-net-ipmid

CVE-2026-81846

September 1, 2026

runZero Platform MCP 'Findings summaries' Data Leak

Vendors: runZero

Products: runZero Platform

CVE-2026-6688

June 30, 2026

CVE-2026-6687

June 30, 2026

CVE-2026-6684

June 30, 2026

FatFS GPT partition-scan loop DoS (pre-R0.16)

Vendors: ChaN

Products: FatFs

CVE-2026-6683

June 30, 2026

FatFs exFAT divide-by-zero in sync/write paths

Vendors: ChaN

Products: FatFs

CVE-2026-6682

June 30, 2026

FatFS FAT32 integer overflow in mount_volume()

Vendors: ChaN

Products: FatFs

CVE-2026-10303

June 16, 2026

ServerCo getssl ACME shell script path injection

Vendors: ServerCo

Products: ServerCo getssl

CVE-2026-50086

June 12, 2026

Aqara unauthenticated AES oracle

Vendors: Aqara

Products: Aqara IAM/SSO Gateway

CVE-2026-50091

June 12, 2026

Aqara Home Android SDK hardcoded keys

Vendors: Aqara

Products: Aqara Home Android (com.lumiunited.aqarahome) 6.0.0.

CVE-2026-50090

June 12, 2026

Aqara OAuth redirect_uri validation bypass

Vendors: Aqara

Products: Aqara Cloud OAuth Authorization Endpoint

CVE-2026-50089

June 12, 2026

Aqara IAM/SSO Gateway open redirect

Vendors: Aqara

Products: Aqara IAM/SSO Gateway

CVE-2026-50088

June 12, 2026

Aqara Developer Portal cross-origin resource sharing

Vendors: Aqara

Products: Aqara Developer Portal, Aqara Developer Test Portal

CVE-2026-50087

June 12, 2026

Aqara IAM/SSO Gateway cross-origin resource sharing

Vendors: Aqara

Products: Aqara IAM/SSO Gateway

CVE-2026-50085

June 12, 2026

Aqara Board IoT insecure debug API

Vendors: Aqara

Products: Aqara Board service

CVE-2026-50084

June 12, 2026

Aqara API cross-account access

Vendors: Aqara

Products: Aqara Cloud Production API

CVE-2026-50083

June 12, 2026

Aqara hardcoded OAuth client credentials

Vendors: Aqara

Products: Aquara IAM/SSO Gateway

CVE-2026-50082

June 12, 2026

Aqara Developer Portal insecure authentication token

Vendors: Aqara

Products: Aqara Cloud Developer Portal

CVE-2026-33362

May 11, 2026

Meari SDK hardcoded cryptographic keys

Vendors: Meari

Products: Meari IoT SDK (com.meari.sdk) (firmID=8)

CVE-2026-33361

May 11, 2026

Meari weak XOR obfuscation

Vendors: Meari

Products: Meari IoT SDK (com.meari.sdk) (firmID=8)

CVE-2026-33359

May 11, 2026

Meari unauthenticated alert image access in cloud object storage

Vendors: Meari

Products: Alibaba OSS (April 2026 hosted)

CVE-2026-33357

May 11, 2026

Meari OpenAPI device status IDOR

Vendors: Meari

Products: Meari IoT SDK (com.meari.sdk) (firmID=8)

CVE-2026-33356

May 11, 2026

Meari MQTT broker missing per-device subscribe ACL

Vendors: Meari

Products: Meari IoT Cloud MQTT Broker EMQX 4.x

CVE-2026-7778

May 5, 2026

runZero Platform dashboard configuration exposure

Vendors: runZero

Products: Platform

CVE-1970-1234

April 7, 2026

runZero Platform user creation leak

Vendors: runZero

Products: runZero Platform

CVE-2026-5380

April 7, 2026

runZero Platform cleartext secret exposure

Vendors: runZero

Products: runZero Platform

CVE-2026-5383

April 7, 2026

runZero Explorer missing authorization check

Vendors: runZero

Products: runZero Explorer

CVE-2026-5382

April 7, 2026

runZero Platform MCP endpoint information leak

Vendors: runZero

Products: runZero Platform

CVE-2026-5379

April 7, 2026

runZero Platform MCP certification information leak

Vendors: runZero

Products: runZero Platform

CVE-2026-5372

April 7, 2026

runZero Platform SQL injection in saved queries

Vendors: runZero

Products: runZero Platform

CVE-2026-5381

April 7, 2026

runZero Platform taks information leak

Vendors: runZero

Products: runZero Platform

CVE-2026-5376

April 7, 2026

runZero Platform session timeout failure

Vendors: runZero

Products: runZero Platform

CVE-2026-5374

April 7, 2026

runZero Platform MCP information leak

Vendors: runZero

Products: runZero Platform

CVE-2026-5375

April 7, 2026

runZero Platform API credential information leak

Vendors: runZero

Products: runZero Platform

CVE-2026-5373

April 7, 2026

runZero Platform superuser privilege escalation

Vendors: runZero

Products: runZero Platform

CVE-2026-5384

April 7, 2026

runZero Platform incorrect credential scope

Vendors: runZero

Products: runZero Platform

2025

CVE-2025-35021

November 3, 2025

Abilis CPX authentication bypass

Products: Abilis CPX series telcom appliances

CVE-2025-11534

October 21, 2025

Raisecom SSH authentication bypass

Products: Raisecom RAX series devices

CVE-2025-8452

August 12, 2025

Brother Printer serial number disclosure

Products: Multiple multi-function printers

See Results in Minutes

See & secure your total attack surface. Even the unknowns & unmanageable.