Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
20 results
Oct 26, 2026TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allows an attacker withinCVE-2026-112345 · Other software · Sciener · reported by VulnCheckHigh 8.6
TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allows an attacker within Bluetooth range to decrypt the per-pairing session key transmitted during BLE pairing. Attackers can observe the pairing exchange, recover the persistent session key using the embedded defaultKey, and forge authenticated BLE requests to unlock the device, add fingerprints or access codes, and perform administrative actions without authentication or user interaction.
- Product
- TTLock
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddamiri.frvulncheck.com
Jul 28, 2026In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulnerability could allow an unauthorized actoCVE-2026-16581 · Other software · igloohome · reported by ics-cert@hq.dhs.govMedium 6.9
In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulnerability could allow an unauthorized actor to access functions or backend services that were not sufficiently protected by authentication controls.
- Product
- Smart Lock Mobile Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2024The APK file in Cloud Smart Lock v2.0.1 has a leaked a URL that can call an API for binding physical devices.CVE-2024-48548 · Other software · cloud_smart_lock · reported by MITRECritical 9.3
The APK file in Cloud Smart Lock v2.0.1 has a leaked a URL that can call an API for binding physical devices. This vulnerability allows attackers to arbitrarily construct a request to use the app to bind to unknown devices by finding a valid serial number via a bruteforce attack.
- Product
- cloud_smart_lock_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcloudsmartlock.comgithub.com
May 14, 2024An issue was discovered on certain Nuki Home Solutions devices.CVE-2022-32509 · Other software · nuki · reported by MITREHigh 8.8
An issue was discovered on certain Nuki Home Solutions devices. Lack of certificate validation on HTTP communications allows attackers to intercept and tamper data. This affects Nuki Smart Lock 3.0 before 3.3.5, Nuki Bridge v1 before 1.22.0 and Nuki Bridge v2 before 2.13.2.
- Product
- smart_lock_v3_pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlatesthackingnews.comnuki.io
May 14, 2024An issue was discovered on certain Nuki Home Solutions devices.CVE-2022-32507 · Other software · nuki · reported by MITREHigh 8.8
An issue was discovered on certain Nuki Home Solutions devices. Some BLE commands, which should have been designed to be only called from privileged accounts, could also be called from unprivileged accounts. This demonstrates that no access controls were implemented for the different BLE commands across the different accounts. This affects Nuki Smart Lock 3.0 before 3.3.5 and Nuki Smart Lock 2.0 before 2.12.4.
- Product
- smart_lock_v3_pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlatesthackingnews.comnuki.io
May 14, 2024An issue was discovered on certain Nuki Home Solutions devices.CVE-2022-32506 · Other software · nuki · reported by MITREMedium 6.4
An issue was discovered on certain Nuki Home Solutions devices. An attacker with physical access to the circuit board could use the SWD debug features to control the execution of code on the processor and debug the firmware, as well as read or alter the content of the internal and external flash memory. This affects Nuki Smart Lock 3.0 before 3.3.5, Nuki Smart Lock 2.0 before 2.12.4, as well as Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2.
- Product
- smart_lock
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlatesthackingnews.comnuki.io
May 14, 2024An issue was discovered on certain Nuki Home Solutions devices.CVE-2022-32505 · Other software · nuki · reported by MITREHigh 7.1
An issue was discovered on certain Nuki Home Solutions devices. It is possible to send multiple BLE malformed packets to block some of the functionality and reboot the device. This affects Nuki Smart Lock 3.0 before 3.3.5 and Nuki Smart Lock 2.0 before 2.12.4.
- Product
- smart_lock_v3_pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlatesthackingnews.comnuki.io
May 14, 2024An issue was discovered on certain Nuki Home Solutions devices.CVE-2022-32504 · Other software · nuki · reported by MITRECritical 9.8
An issue was discovered on certain Nuki Home Solutions devices. The code used to parse the JSON objects received from the WebSocket service provided by the device leads to a stack buffer overflow. An attacker would be able to exploit this to gain arbitrary code execution on a KeyTurner device. This affects Nuki Smart Lock 3.0 before 3.3.5 and 2.0 before 2.12.4, as well as Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2.
- Product
- nuki_smart_lock
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlatesthackingnews.comnuki.io
May 14, 2024An issue was discovered on certain Nuki Home Solutions devices.CVE-2022-32502 · Other software · nuki · reported by MITREMedium 6.3
An issue was discovered on certain Nuki Home Solutions devices. There is a buffer overflow over the encrypted token parsing logic in the HTTP service that allows remote code execution. This affects Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2.
- Product
- nuki_smart_lock
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlatesthackingnews.comnuki.io
Jan 11, 2024Missing encryption in the NFC tags of the Flient Smart Door Lock v1.0 allows attackers to create a cloned tag via brief physical proximity to the original tags,CVE-2023-50129 · Other software · Flient · reported by MITREMedium 6.5
Missing encryption in the NFC tags of the Flient Smart Door Lock v1.0 allows attackers to create a cloned tag via brief physical proximity to the original tags, which results in an attacker gaining access to the perimeter.
- Product
- Smart Lock Advanced Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2024Flient Smart Door Lock v1.0 is vulnerable to Use of Default Credentials.CVE-2023-50124 · Other software · flient · reported by MITREMedium 6.8
Flient Smart Door Lock v1.0 is vulnerable to Use of Default Credentials. Due to default credentials on a debug interface, in combination with certain design choices, an attacker can unlock the Flient Smart Door Lock by replacing the fingerprint that is stored on the scanner.
- Product
- smart_lock_advanced_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2023Weak encryption mechanisms in RFID Tags in Yale Keyless Lock v1.0 allows attackers to create a cloned tag via physical proximity to the original.CVE-2023-26943 · Other software · Assaabloy · reported by MITREMedium 6.5
Weak encryption mechanisms in RFID Tags in Yale Keyless Lock v1.0 allows attackers to create a cloned tag via physical proximity to the original.
- Product
- Yale Keyless Smart Lock Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarxiv.orgresearchgate.net
Dec 4, 2023Incorrect Session Management and Credential Re-use in the Bluetooth LE stack of the Ultraloq UL3 2nd Gen Smart Lock Firmware 02.27.0012 allows an attacker to snCVE-2022-46480 · Other software · U-tec · reported by MITREHigh 8.1
Incorrect Session Management and Credential Re-use in the Bluetooth LE stack of the Ultraloq UL3 2nd Gen Smart Lock Firmware 02.27.0012 allows an attacker to sniff the unlock code and unlock the device whilst within Bluetooth range.
- Product
- Ultraloq Ul3 BT Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarxiv.orgresearchgate.net
Jun 22, 2023An issue was discovered in WAFU Keyless Smart Lock v1.0 allows attackers to unlock a device via code replay attack.CVE-2023-34553 · Other software · Wafucn · reported by MITREMedium 6.5
An issue was discovered in WAFU Keyless Smart Lock v1.0 allows attackers to unlock a device via code replay attack.
- Product
- Wafu Keyless Smart Lock Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordashallen.netashallen.net
Mar 25, 2022Incorrect permissions in the Bluetooth Services in the Fortessa FTBTLD Smart Lock as of 12-13-2022 allows a remote attacker to disable the lock via an unauthentCVE-2021-44905 · Other software · CEF · reported by MITREHigh 8.2
Incorrect permissions in the Bluetooth Services in the Fortessa FTBTLD Smart Lock as of 12-13-2022 allows a remote attacker to disable the lock via an unauthenticated edit to the lock name.
- Product
- Fortessa Ftbtld Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordashallen.netonline.fliphtml5.com
Sep 30, 2020Use of hard-coded cryptographic key vulnerability in August Connect Wi-Fi Bridge App, Connect Firmware allows an attacker to decrypt an intercepted payload contCVE-2019-17098 · Other software · August · reported by cve-requests@bitdefender.comLow 3.5
Use of hard-coded cryptographic key vulnerability in August Connect Wi-Fi Bridge App, Connect Firmware allows an attacker to decrypt an intercepted payload containing the Wi-Fi network authentication credentials. This issue affects: August Connect Wi-Fi Bridge App version v10.11.0 and prior versions on Android. August Connect Firmware version 2.2.12 and prior versions.
- Product
- Smart Lock and Connect Wi-Fi Bridge App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.bitdefender.comlabs.bitdefender.com
Oct 15, 2019Glue Smart Lock 2.7.8 devices do not properly block guest access in certain situations where the network connection is unavailable.CVE-2019-12944 · Other software · Gluehome · reported by MITREHigh 7.5
Glue Smart Lock 2.7.8 devices do not properly block guest access in certain situations where the network connection is unavailable.
- Product
- Glue Smart Lock Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2018oBike relies on Hangzhou Luoping Smart Locker to lock bicycles, which allows attackers to bypass the locking mechanism by using Bluetooth Low Energy (BLE) to reCVE-2018-16242 · Other software · O.bike · reported by MITREMedium 5.3
oBike relies on Hangzhou Luoping Smart Locker to lock bicycles, which allows attackers to bypass the locking mechanism by using Bluetooth Low Energy (BLE) to replay ciphertext based on a predictable nonce used in the locking protocol.
- Product
- Smart Locker Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Apr 21, 2017Akerun - Smart Lock Robot App for iOS before 1.2.4 does not verify SSL certificates.CVE-2016-1148 · Other software · Photosynth · reported by vultures@jpcert.or.jpHigh 8.1
Akerun - Smart Lock Robot App for iOS before 1.2.4 does not verify SSL certificates.
- Product
- Akerun
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2017An elevation of privilege vulnerability in Smart Lock could enable a local malicious user to access Smart Lock settings without a PIN.CVE-2016-6769 · Computers, phones & browsers · Google Inc. · reported by security@android.comMedium 4.6
An elevation of privilege vulnerability in Smart Lock could enable a local malicious user to access Smart Lock settings without a PIN. This issue is rated as Moderate because it first requires physical access to an unlocked device where Smart Lock was the last settings pane accessed by the user. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1. Android ID: A-29055171.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsource.android.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.