Skip to content
Threat Feed
Subscribe

Product

Tasmota (<= 16.0.0)

2 briefs RSS
high advisory

Tasmota: Cross-site request forgery via Referer header bypass (CVE-2026-119755)

Tasmota through 16.0.0 contains a cross-site request forgery vulnerability in HttpCheckPriviledgedAccess() allowing Referer-based protection bypass.

Tasmota
1c
critical advisory

Tasmota: Heap out-of-bounds write in SendReceiveDeviceGroupMessage (CVE-2026-119756)

Tasmota versions through 16.0.0 contain a heap out-of-bounds write vulnerability in the SendReceiveDeviceGroupMessage() function that allows unauthenticated local network attackers to trigger memory corruption via crafted UDP packets.

Tasmota
1c