CVE-2026-79394High· 7.5▾ TwilightAn insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier ships with authentication disabled, allowing remote unauthentica…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
— → 7.5
none → high
Last analysed / modified upstream
0.2% → 0.6%
An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier ships with authentication disabled, allowing remote unauthenticated attackers to access live H.264 video and G.711 audio feeds in cleartext over unencrypted RTP/UDP.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2022-2196Medium· 5.8A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after running L2 due to KVM (L0) adv…
CVE-2026-116273NoneMIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion
CVE-2026-110952NoneApache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default
CVE-2026-116672High· 8.8Authlib RFC 7592 examples omit registration-access-token client binding
CVE-2026-25784Critical· 9.8bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop
CVE-2026-114618Medium· 6.8Authlib: Default JWT bearer grant accepts assertions for the wrong audience