Tuya vulnerabilities

Products

• App 11
• Arduino-tuyaopen 4
• Sdk 2
• Tuya 2

Newest

• octo-sts app Octo STS discloses trust policy contents to unauthorized callers via Exchange error messages CVE-2026-105770 5.3 MediumNovember 3, 2026
• topluyo app Topluyo Desktop for Linux has an OS Command Injection issue CVE-2026-115904 Public exploit 9.6 CriticalOctober 28, 2026
• @tinacms app, tinacms +1 more TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment CVE-2026-108261 Fix available 9.3 CriticalOctober 9, 2026
• tuya arduino-tuyaopen arduino-TuyaOpen WiFiUDP Null Pointer Dereference Denial of Service CVE-2026-28522 7.1 HighMarch 15, 2026
• tuya arduino-tuyaopen arduino-TuyaOpen DnsServer Heap-Based Buffer Overflow Remote Code Execution CVE-2026-28519 8.7 HighMarch 15, 2026
• tuya arduino-tuyaopen arduino-TuyaOpen TuyaIoT Out-of-Bounds Memory Read Information Disclosure CVE-2026-28521 7.0 HighMarch 15, 2026
• tuya arduino-tuyaopen arduino-TuyaOpen WiFiMulti Single-Byte Buffer Overflow Remote Code Execution CVE-2026-28520 8.6 HighMarch 15, 2026
• redwoodjs sdk, tuya app +1 more Tuya App/SDK JSON Data Point denial of service CVE-2026-3465 Disputed 2.3 LowMarch 3, 2026
• tuya smartlife, tuya, tuya smart +2 more Cross-Site Request Forgery (CSRF) vulnerability in the OAuth implementation of the Tuya SDK 6.5.0... CVE-2025-56400 8.8 HighNovember 24, 2025
• tuya An issue discovered in the Tuya Smart Life App 5.6.1 allows attackers to unprivileged control... CVE-2025-56557 9.1 CriticalSeptember 16, 2025
• octo-sts app Octo-STS Vulnerable to Unauthenticated SSRF with HTTP Response Reflection in OIDC Flow CVE-2025-52477 Fix available 8.6 HighJune 26, 2025
• signal app, signal +1 more Signal App Biometric Authentication missing critical step in authentication CVE-2025-5715 1.0 LowJune 6, 2025
• blackvue app BlackVue App API deviceDelete get request method with sensitive query strings CVE-2025-2356 6.3 MediumMarch 17, 2025
• blackvue app BlackVue App API Endpoint credentials storage CVE-2025-2355 4.8 MediumMarch 17, 2025
• octo-sts app octo-sts allows unauthenticated attackers to cause unbounded CPU and memory usage CVE-2024-34079 Fix available 3.7 LowMay 10, 2024
• redwoodjs sdk Tuya SDK MQTT Packet denial of service CVE-2024-3764 Disputed 2.7 LowApril 14, 2024
• klapp app Klapp App JSON Web Token improper authentication CVE-2020-36533 3.7 LowJune 3, 2022
• klapp app Klapp App Authorization Credentials information disclosure CVE-2020-36532 4.3 MediumJune 3, 2022