CVE-2026-84941Omada Controller XML External Entity (XXE) Injection in SAML IdP Metadata Parsing Leading to Arbitrary Local File Read Exploitation status Not confirmed Fix Affected product O Omada Software Controller (Windows) Published 09/10/2026 Severity Medium CVE-2026-17176OS command injection Vulnerability in Deco BE11000 Exploitation status Not confirmed Fix Affected product D Deco BE11000 V2 Published 09/10/2026 Severity High CVE-2026-76652Authenticated Directory Traversal Vulnerability in File Upload Functionality in TP-Link TL-MR6400 and Archer MR600 Exploitation status Not known exploited Fix Affected product T TL-MR6400 v8 Published 09/10/2026 Severity Medium CVE-2026-76653Missing Authentication in VPN Configuration Management in TP-Link TL-MR6400 and Archer MR600 Exploitation status Not known exploited Fix Affected product T TL-MR6400 v8 Published 09/10/2026 Severity Medium CVE-2026-85384Authenticated Stack-Based Buffer Overflow in RE210 AC750 Configuration Import Exploitation status Not known exploited Fix Affected product R RE210 AC750 Published 09/08/2026 Severity High CVE-2026-81531Unauthenticated Account Information Disclosure in Multiple Omada Controllers Exploitation status Not known exploited Fix Affected product O OC200 V1 Published 09/08/2026 Severity Medium CVE-2026-18167Stack-based buffer overflow in TP-Link Archer AX55 v4 Exploitation status Not known exploited Fix Affected product A Archer AX55 v4 Published 09/03/2026 Severity High CVE-2026-18330Hardcoded Shared RSA-1024 Private Key in TP-Link Archer AX55 v4 Exploitation status Not known exploited Fix Affected product A Archer AX55 v4 Published 09/03/2026 Severity Medium CVE-2026-75118http_gdpr_decrypt Pre-Authentication Stack-Based Buffer Overflow Exploitation status Not known exploited Fix Affected product T TL-MR100 v3.20 Published 08/28/2026 Severity High CVE-2026-76784Insufficient Cryptographic Protections in Local Device Communication Protocol on Multiple TP-Link Kasa Smart Home Devices Exploitation status Not known exploited Fix Affected product H HS103P3 / HS103P4 v5 Published 08/26/2026 Severity High CVE-2026-78541Command Injection in Parent Control of TP-Link Archer BE3600 v1 Exploitation status Not known exploited Fix Affected product A Archer BE3600 v1 Published 08/24/2026 Severity High CVE-2026-16348Command Injection Vulnerability in VPN connection of Archer BE800 Exploitation status Not known exploited Fix Affected product A Archer BE800 v1 Published 08/24/2026 Severity High CVE-2026-9254Command Injection Vulnerability in Parent Control of Multiple TP-Link Archer Devices Exploitation status Not known exploited Fix Affected product A Archer BE800 V1 Published 08/24/2026 Severity High CVE-2026-15469Hard-coded Mesh Group Private Key in TP-Link Deco XE75, XE5300, and WE10800 Exploitation status Not known exploited Fix Affected product D Deco XE75 v3 / XE5300 v3.6/ WE10800 v3.6 Published 08/24/2026 Severity High CVE-2026-17252Unauthenticated Denial of Service via Composed HTTP Parsing and Stack-Based Out-of-Bounds Write Vulnerability in TL-MR6400 Web Management Interface Exploitation status Not known exploited Fix Affected product T TL-MR6400 v7.0 Published 08/21/2026 Severity High CVE-2026-17251Unauthenticated Denial of Service via Null Pointer Dereference in HTTP Request Parsing Exploitation status Not known exploited Fix Affected product T TL-MR6400 v7.0 Published 08/21/2026 Severity High CVE-2026-17250Authenticated Remote Code Execution via Stack-Based Buffer Overflow in Firmware Update Handling Exploitation status Not known exploited Fix Affected product T TL-MR6400 v7.0 Published 08/21/2026 Severity High CVE-2026-19683Unencrypted Credential Transmission in Omada Gateway Dynamic DNS Authentication in Omada Gateways Exploitation status Not known exploited Fix Affected product E ER7212PC v2 Published 08/20/2026 Severity Medium CVE-2026-19586Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways Exploitation status Not known exploited Fix Affected product E ER7212PC v2 Published 08/20/2026 Severity Critical CVE-2026-9033Unauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways Exploitation status Not known exploited Fix Affected product E ER7212PC v2 Published 08/20/2026 Severity Medium CVE-2026-8619Unauthenticated Denial-of-Service Vulnerability in HTTP Service in TP-Link TL-MR100, TL-MR150, TL-MR6400 and Archer MR600 Exploitation status Not known exploited Fix Affected product T TL-MR100 v3.2 Published 08/19/2026 Severity High CVE-2026-75616Command Injection in Router Web Management Interface Exploitation status Not known exploited Fix Affected product A Archer C20 v6 Published 08/19/2026 Severity High CVE-2026-75619RTSP Heap Buffer Overflow Denial-of-Service Vulnerability on TP-Link Tapo C100 and C101 Exploitation status Not known exploited Fix Affected product T Tapo C100 v5 Published 08/19/2026 Severity Medium CVE-2026-75618RTSP Null Pointer Dereference Denial-of-Service Vulnerability on TP-Link Tapo C100 and C101 Exploitation status Not known exploited Fix Affected product T Tapo C100 v5 Published 08/19/2026 Severity High CVE-2026-15316Denial-of-Service via Oversized Encrypted Credential Input in TP-Link Tapo C200 Exploitation status Not known exploited Fix Affected product T Tapo C200 v5 Published 08/18/2026 Severity High CVE-2026-15315Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200 Exploitation status Not known exploited Fix Affected product T Tapo C200 v5 Published 08/18/2026 Severity High CVE-2026-15141Referer Validation Bypass in TL-WR820N Web Management Interface Exploitation status Not known exploited Fix Affected product T TL-WR820N v2 Published 08/12/2026 Severity Medium CVE-2025-30241OS Command Injection in Web Interface in Multiple TP-Link Aginet Devices Exploitation status Not known exploited Fix Affected product H HB810(US2) V1.0/1.6/2.0/2.6 Published 08/10/2026 Severity High CVE-2025-30240Arbitrary File Read via Improper Symlink Handling in USB HTTPS Access Path in multiple TP-Link Aginet Devices Exploitation status Not known exploited Fix Affected product H HB810(US2) V1.0/1.6/2.0/2.6 Published 08/10/2026 Severity Medium CVE-2025-30239Sensitive Data Exposure due to Hardcoded Cryptographic Keys in Multiple TP-Link Aginet Devices Exploitation status Not known exploited Fix Affected product H HB810(US2) V1.0/1.6/2.0/2.6 Published 08/10/2026 Severity High CVE-2025-30238Privilege Escalation via Improper Authorization in User Management in multiple TP-Link Aginet Devices Exploitation status Not known exploited Fix Affected product H HB810(US2) V1.0/1.6/2.0/2.6 Published 08/10/2026 Severity High CVE-2025-30237Authentication Bypass via Broken Access Control in Web Server in Multiple TP-Link Aginet Devices Exploitation status Not known exploited Fix Affected product H HB810(US2) V1.0/1.6/2.0/2.6 Published 08/10/2026 Severity High CVE-2026-12339Authenticated Arbitrary File Write Vulnerability in multiple devices Exploitation status Not known exploited Fix Affected product T TL-MR6400 v5.3 Published 08/10/2026 Severity Medium CVE-2026-9031Authenticated Denial-of-Service in HTTPD Service in TP-Link Archer A6 Exploitation status Not known exploited Fix Affected product A Archer A6 v4 Published 08/07/2026 Severity Medium CVE-2026-9030Authenticated Denial-of-Service in HTTPD Service in TP-Link Archer A6 Exploitation status Not known exploited Fix Affected product A Archer A6 v4 Published 08/07/2026 Severity Medium CVE-2026-15314Authenticated Denial-of-Service Vulnerability in TP-Link Tapo P110 Exploitation status Not known exploited Fix Affected product P P110 v1 Published 08/04/2026 Severity High CVE-2025-15631Weak Credential Storage in TP-Link Omada Devices Exploitation status Not known exploited Fix Affected product O Omada gateways Published 08/03/2026 Severity Medium CVE-2025-15630Device Provisioning Race Condition in TP-Link Omada Adoption Workflow Exploitation status Not known exploited Fix Affected product O Omada gateways Published 08/03/2026 Severity Medium CVE-2025-15629Weak Session Key Generation in TP-Link Omada Adoption Protocol Exploitation status Not known exploited Fix Affected product O Omada gateways Published 08/03/2026 Severity Medium CVE-2025-15628Hardcoded Certificates in TP-Link Omada Device Communications Exploitation status Not known exploited Fix Affected product O Omada gateways Published 08/03/2026 Severity High CVE-2025-15627Hardcoded Cryptographic Keys in TP-Link Omada Adoption Protocol Authentication Exploitation status Not known exploited Fix Affected product O Omada gateways Published 08/03/2026 Severity Medium CVE-2025-15544Weak Credential Protection During TP-Link Omada Device Adoption Exploitation status Not known exploited Fix Affected product O Omada gateways Published 08/03/2026 Severity Medium CVE-2025-9291Improper Certificate Validation in TP-Link Omada Cloud Communications Exploitation status Not known exploited Fix Affected product O Omada gateways Published 08/03/2026 Severity High CVE-2026-9044Command Injection Vulnerability in OpenVPN of TP-Link Archer AXE75 Exploitation status Not known exploited Fix Affected product A AXE75 V1 Published 07/31/2026 Severity High CVE-2026-12935Unauthenticated Remote Code Execution in TP-Link TL-WR940N RTSP Conntrack Feature Exploitation status Not known exploited Fix Affected product T TL-WR940N v6 Published 07/29/2026 Severity High CVE-2026-12001Hardcoded Credential Vulnerability in Multiple TP-Link Router Models Exploitation status Not known exploited Fix Affected product T TL-WR850N v3 Published 07/27/2026 Severity Medium CVE-2026-13230Information Disclosure Vulnerability in Local Discovery Response in TP-Link Kasa EC70 and EC71 Exploitation status Not known exploited Fix Affected product K Kasa EC71 v4 Published 07/15/2026 Severity Medium CVE-2026-9770Hardcoded Cryptographic Key Information Disclosure Vulnerability on TP-Link Kasa EC70 and EC71 Exploitation status Not known exploited Fix Affected product K Kasa EC71 v4 Published 07/15/2026 Severity High CVE-2026-5040Weak Password Hashing Mechanism in TP-Link Deco M5 Exploitation status Not known exploited Fix Affected product D Deco M5 Deco M5 V1 Published 07/14/2026 Severity High CVE-2026-15429Privilege Escalation via Improper Input Sanitization in TP-Link Archer VX1800v Exploitation status Not known exploited Fix Affected product A Archer VX1800v v1 Published 07/14/2026 Severity Medium CVE-2026-15428OS Command Injection in TR-069 (CWMP) Management Interface in TP-Link Archer VX1800v Exploitation status Not known exploited Fix Affected product A Archer VX1800v v1 Published 07/14/2026 Severity High CVE-2026-15427OS Command Injection in TR-069 (CWMP) Management Interface in TP-Link Archer VX1800v Exploitation status Not known exploited Fix Affected product A Archer VX1800v v1 Published 07/14/2026 Severity High CVE-2026-8699Stored Cross-Site Scripting (XSS) in TP-Link Archer C5 Web Management Interface Exploitation status Not known exploited Fix Affected product A Archer C5 v6.8 Published 07/02/2026 Severity High CVE-2026-10562Unauthenticated Open Redirect Vulnerability on TP-Link Archer AX20 Web Interface Exploitation status Not known exploited Fix Affected product A Archer AX20 V2.0 Published 06/30/2026 Severity Medium CVE-2026-9105Authenticated Stack-Based Buffer Overflow in TP-Link TL-WR841N Web Interface Exploitation status Not known exploited Fix Affected product T TL-WR841N v14 Published 06/29/2026 Severity Medium CVE-2026-12760Denial-of-Service Vulnerability via Malformed IPv4 Fragmentation Handling in TP-Link Tapo C200 Exploitation status Not known exploited Fix Affected product T Tapo C200 v3 Published 06/24/2026 Severity High CVE-2026-11834Unauthenticated Command Injection via DHCP Option Handling in Multiple TP-Link Routers Exploitation status Not known exploited Fix Affected product A Archer MR200 v07 Published 06/22/2026 Severity High CVE-2026-11409OS Command Injection in IPv6 PPPoE Configuration in TP-Link TL-WR940N Exploitation status Not known exploited Fix Affected product T TL-WR940N v6 Published 06/16/2026 Severity High CVE-2026-11410OS Command Injection in BigPond Cable (BPA) Configuration in TP-Link TL-WR940N Exploitation status Not known exploited Fix Affected product T TL-WR940N v6 Published 06/16/2026 Severity High CVE-2026-6250Authenticated Format String Injection on TP-Link Tapo C110 Exploitation status Not known exploited Fix Affected product T Tapo C110 v2 Published 06/11/2026 Severity High CVE-2026-9151Command Injection Vulnerability in OpenVPN on Multiple TP-Link Archer Routers Exploitation status Not known exploited Fix Affected product A Archer AX12 V1 Published 06/10/2026 Severity High CVE-2026-8913Command Injection in TP-Link's Archer MR600 WireGuard Client Configuration Exploitation status Not known exploited Fix Affected product A Archer MR600 v5 Published 06/08/2026 Severity High CVE-2026-6242Authenticated Format String Vulnerability in ONVIF Subscribe Service on TP-Link Tapo C520WS Exploitation status Not known exploited Fix Affected product T Tapo C520WS v2 Published 06/05/2026 Severity Medium CVE-2026-6241Authenticated Format String Vulnerability in ONVIF AddScopes Method on TP-Link Tapo C520WS Exploitation status Not known exploited Fix Affected product T Tapo C520WS v2 Published 06/05/2026 Severity Medium CVE-2026-6240Authenticated Stack-based Buffer Overflow in ONVIF DeleteUsers Service on TP-Link Tapo C520WS Exploitation status Not known exploited Fix Affected product T Tapo C520WS v2 Published 06/05/2026 Severity Medium CVE-2026-6239Authenticated Stack-based Buffer Overflow in ONVIF CreateUsers Service in TP-Link Tao C520WS Exploitation status Not known exploited Fix Affected product T Tapo C520WS v2 Published 06/05/2026 Severity Medium CVE-2026-34123Whitelist Validation Bypass in TP-Link Tapo C520WS Exploitation status Not known exploited Fix Affected product T Tapo C520WS v2 Published 06/05/2026 Severity High CVE-2026-8714Denial-of-Service Vulnerability in RTSP Input Handling on TP-Link's Tapo C520WS Exploitation status Not known exploited Fix Affected product T Tapo C520WS v2 Published 06/05/2026 Severity High CVE-2026-1871Authenticated Stack-based Buffer Overflow in RTSP Authentication of Tapo C200 Exploitation status Not known exploited Fix Affected product T Tapo C200 v5 Published 06/02/2026 Severity High CVE-2026-34127Stored Cross-Site Scripting (XSS) via Configuration File Import on TP-Link's TL-SG108PE Exploitation status Not known exploited Fix Affected product T TL-SG108PE v5 Published 05/29/2026 Severity Medium CVE-2026-34126Bluetooth Communication Uses Unencrypted Transmission During Initial Setup on TP-Link's Tapo L535E, P300 and D100C Exploitation status Not known exploited Fix Affected product T Tapo L535E v1.0, v3.0 Published 05/28/2026 Severity High CVE-2026-8697Improper Authentication Rate Limiting on TP-Link's Archer C64 Exploitation status Not known exploited Fix Affected product A Archer C64 v1.0 Published 05/28/2026 Severity High CVE-2026-5509Arbitrary Command Injection via Browser Developer Console in TP-Link Archer BE450 and BE7200 Exploitation status Not known exploited Fix Affected product A Archer BE7200 V1 Published 05/27/2026 Severity High CVE-2026-3294Authentication Logic Vulnerability on Multiple TP-Link Range Extenders Exploitation status Not known exploited Fix Affected product A Archer RE650 v1 Published 05/22/2026 Severity High CVE-2026-5511Information Disclosure via Diagnostic Interface Due to Improper Input Validation on TP-Link's Archer AX72 Exploitation status Not known exploited Fix Affected product A Archer AX72 (SG) v1.0 Published 05/19/2026 Severity Medium CVE-2026-5039Predictable Default Cryptographic Key Used for DES Encryption in TP-Link TL-WL841N Exploitation status Not known exploited Fix Affected product T TL-WL841N v13 Published 04/23/2026 Severity Medium CVE-2026-5363Use of weak cryptographic key in TP-Link Archer C7 Exploitation status Not known exploited Fix Affected product A Archer C7 v5 and v5.8 Published 04/15/2026 Severity Medium CVE-2026-30818OS Command Injection Vulnerability in dnsmasq Module in TP-Link AX53 Exploitation status Not known exploited Fix Affected product A AX53 v1.0 Published 04/08/2026 Severity High CVE-2026-30817Arbitrary File Reading Vulnerability in dnsmasq Module in TP-Link AX53 Exploitation status Not known exploited Fix Affected product A AX53 v1.0 Published 04/08/2026 Severity Medium CVE-2026-30816Arbitrary File Reading Vulnerability in OpenVPN Module in TP-Link AX53 Exploitation status Not known exploited Fix Affected product A AX53 v1.0 Published 04/08/2026 Severity Medium CVE-2026-30815OS Command Injection Vulnerability in OpenVPN Module in TP-Link AX53 Exploitation status Not known exploited Fix Affected product A AX53 v1.0 Published 04/08/2026 Severity High CVE-2026-30814Buffer Overflow Vulnerability in TP-Link AX53 Exploitation status Not known exploited Fix Affected product A AX53 v1.0 Published 04/08/2026 Severity High CVE-2026-34124Denial of Service via Path Expansion Overflow in HTTP Service in TP-Link Tapo C520WS Exploitation status Not known exploited Fix Affected product T Tapo C520WS v2.6 Published 04/02/2026 Severity High CVE-2026-34122Stack-based Buffer Overflow Leading to Denial of Service in TP-Link Tapo C520WS Exploitation status Not known exploited Fix Affected product T Tapo C520WS v2.6 Published 04/02/2026 Severity High CVE-2026-34121Authentication Bypass in DS Configuration Service via HTTP Request Parsing Differential of TP-Link Tapo C520WS Exploitation status Not known exploited Fix Affected product T Tapo C520WS v2.6 Published 04/02/2026 Severity High CVE-2026-34120Heap-based Buffer Overflow Vulnerability Leading to Denial-of-Service in TP-Link Tapo C520WS Exploitation status Not known exploited Fix Affected product T Tapo C520WS v2.6 Published 04/02/2026 Severity High CVE-2026-34119Heap-based Buffer Overflow Vulnerability Leading to Denial-of-Service in TP-Link Tapo C520WS Exploitation status Not known exploited Fix Affected product T Tapo C520WS v2.6 Published 04/02/2026 Severity High CVE-2026-34118Heap-based Buffer Overflow Vulnerability Leading to Denial-of-Service in TP-Link Tapo C100, C101 & C520WS Exploitation status Not known exploited Fix Affected product T Tapo C520WS v2.6 Published 04/02/2026 Severity High CVE-2026-4346Cleartext Storage of Administrative and Wi-Fi Credentials via Accessible Serial Interface in TP Link's TL-WR850N Exploitation status Not known exploited Fix Affected product T TL-WR850N v3 Published 03/26/2026 Severity Medium CVE-2026-3622Denial-of-Service Vulnerability in UPnP Component of TP Link's TL-WR841N Exploitation status Not known exploited Fix Affected product T TL-WR841N v14 Published 03/26/2026 Severity High CVE-2025-15606Denial of Service (DoS) in HTTPD Input Handling on TP-Link TD-W8961N Exploitation status Not known exploited Fix Affected product T TD-W8961N v4.0 Published 03/23/2026 Severity High CVE-2025-15605Hardcoded Cryptographic Key in Configuration Encryption Mechanism on TP-Link Archer NX200, NX210, NX500 and NX600 Exploitation status Not known exploited Fix Affected product A Archer NX600 v3.0 Published 03/23/2026 Severity High CVE-2025-15519Command Injection in Modem Management CLI on TP-Link Archer NX200, NX210, NX500 and NX600 Exploitation status Not known exploited Fix Affected product A Archer NX600 v3.0 Published 03/23/2026 Severity High CVE-2025-15518Command Injection in Wireless Control CLI on TP-Link Archer NX200, NX210, NX500 and NX600 Exploitation status Not known exploited Fix Affected product A Archer NX600 v3.0 Published 03/23/2026 Severity High CVE-2025-15517Authorization Bypass in HTTP Server Endpoints on TP-Link Archer NX200, NX210, NX500 and NX600 Exploitation status Not known exploited Fix Affected product A Archer NX600 v3.0 Published 03/23/2026 Severity High CVE-2025-15608Buffer Overflow in Network Probe Handling Function of TP-Link Archer AX53 + Archer AX55 Exploitation status Not known exploited Fix Affected product A AX53 v1 Published 03/20/2026 Severity High CVE-2025-15607Authenticated Command Injection in mcsd Service of TP-Link Archer AX53 Exploitation status Not known exploited Fix Affected product A AX53 v1 Published 03/20/2026 Severity High CVE-2026-3227Authenticated Command Injection on TP-Link TL-WR802N, TL-WR841N and TL-WR840N Exploitation status Public exploit Fix Affected product T TL-WR802N v4 Published 03/13/2026 Severity High CVE-2026-1668Input Validation Vulnerability on Multiple Omada Switches Exploitation status Not known exploited Fix Affected product S SG2008P 3.2x Published 03/13/2026 Severity High CVE-2026-3841Command Injection Vulnerability in Telnet CLI on TP-Link TL-MR6400 Exploitation status Not known exploited Fix Affected product T TL-MR6400 v5.3 Published 03/12/2026 Severity High 
.svg){kind=icon}
%20V1.0%2F1.6%2F2.0%2F2.6.svg){kind=icon}
%20v1.0.svg){kind=icon}
