On 16 October 2026 OPSWAT published the last part of its research into TP-Link's Tapo C200 and C120 cameras. The main flaw, CVE-2026-102369, is a command injection in a factory diagnostic service. On its own it needs administrator access, but an authentication bypass disclosed in August provides exactly that. Chained together, the two let an attack
Security researcher Quentin Kaiser presented a flaw in Broadcom's Wi-Fi software at the Hexacon conference in Paris on 16 October 2026 and published a full write-up the same day. The bug is in the code that reassembles fragmented WPS (Wi-Fi Protected Setup) EAP messages in Broadcom's proprietary 802.11 stack. An attacker within radio range can trig
CISA published advisory ICSA-26-288-02 on 15 October 2026 about three vulnerabilities in EseeCloud, the app and camera firmware from Guangzhou Juan IoT Technology. According to CISA, exploiting them could let an attacker take control of affected IP cameras. The advisory covers the EseeCloud app up to version 4.9.6 and EseeCloud firmware up to 4.9.8
On 15 October 2026 NVD published CVE-2026-111281 against Jooan JA-A12 IP cameras on firmware builds 009_20171107 and 05.02.31.105. VulnCheck rates it 9.3 on CVSS v4.0. Anyone who can reach the camera's local HTTP interface can enable a vendor diagnosis mode with credentials baked into the Cam720 Android app, then feed shell commands to the jooandia
Eufy, Anker's smart home brand, has launched the E10 Window Camera, a small wired camera that sticks to the inside of a window and watches the driveway, front garden or entrance from indoors. TechRadar and T3 reported the launch on 14 October 2026. The camera costs $79.99 or £69.99, and a two-pack costs $149.99 or £129.99. It is already on sale in
TP-Link published a security advisory on 14 October 2026 for CVE-2026-108473, a missing-authentication flaw (CWE-306) in the local device-management protocol of 24 Kasa smart plugs, power strips, wall switches, bulbs and light strips. An attacker on the same local network can send management commands without logging in and change a device's state o
TP-Link published a security advisory on 14 October 2026 for CVE-2026-109506, an authentication flaw in the web management of its RE-series Wi-Fi range extenders. Someone on the same local network who captures a legitimate administrator login can derive a credential that the extender accepts, and log in to its management page with administrator rig
Ubiquiti has published Security Advisory Bulletin 070 for the UniFi Protect AI Key, the add-on box that runs object, person and licence plate detection and footage search locally for UniFi Protect cameras. The bulletin covers six vulnerabilities. According to the records published in the US National Vulnerability Database (NVD) on 14 October 2026,
Theengs Gateway 1.8.0 was released on 13 October 2026. Theengs Gateway is a Python program that listens for Bluetooth Low Energy advertisements from sensors such as Xiaomi thermometers, SwitchBot meters, scales and Victron battery monitors, decodes them and publishes the readings to an MQTT broker. It runs on a Raspberry Pi or any other Linux, macO
