Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 05:05 UTC

Critical in the last 24 hours

1602 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

160-73% vs 7-day avg of 598

2 critical, 46 high, 62 medium, 30 low

Expand	Severity	Score	Advisory	Title	Source	Flags	Published
	Low	2.9	CVE-2026-116114	A weakness has been identified in Yoosee GM8135S Camera 21.00.01.36 Yoosee, Shenzhen Gwell Times Technology, Grain MediaYoosee GM8135S Camera, Shenzhen Gwell Times Technology Yoosee GM8135S Camera, Grain Media GM8135S	NVD		Oct 26 04:17 UTC
CVE-2026-116114A weakness has been identified in Yoosee GM8135S Camera 21.00.01.36 Executive summary A smart camera sold under the Yoosee name, the GM8135S Camera running firmware 21.00.01.36 and possibly other versions, sends live video over the network without encryption, so someone positioned on the network path or nearby could watch the stream. The advisory describes this as a serious privacy risk, and the vendor has not released a firmware fix; the advisory recommends isolating the camera on a separate network with no outbound internet access, using a local stream routed through a secured recorder or proxy, or replacing the device. Technical summary The advisory classifies the issues as cleartext transmission of sensitive information (CWE-319), insecure default initialization of resources (CWE-1188), and insufficient verification of data authenticity (CWE-345). The /npc/npc binary sends live UDP video frames unencrypted during an active stream, and the attacker must be able to observe traffic on the network path, which the advisory says requires no authentication on the camera. The device is also configured to auto-connect to open WiFi SSIDs Free-AP0 through Free-AP3 without a password, which the advisory says enables proximity-based interception via deauthentication. The advisory states that firmware is not verified on the SPI flash and that a telnet backdoor was set up during testing. Affected versions are stated as up to and including 21.00.01.36, possibly others. The fixed version is not stated because the vendor has not released a firmware update. Recommended workarounds are network isolation, local RTSP access with a secured proxy, and wired Ethernet connection. No detection guidance or CVSS score is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from akosibrylle.me/writeups/yoosee-cve Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Yoosee Shenzhen Gwell Times Technology Grain Media Gwell Times (HK) Co., Limited Yoosee GM8135S Camera Shenzhen Gwell Times Technology Yoosee GM8135S Camera Grain Media GM8135S NIST National Vulnerability DatabasePublished Oct 26, 2026 04:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Search syntax

Welcome to CVEsee.org

What is CVEsee.org?

Disclaimer

You are leaving CVEsee.org

Install CVEsee