https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-11T01:47:19.184956+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-119755 CVE-2026-119755 — Tasmota 16.0.0 CSRF via Referer Header Validation Bypass 2026-11-11T01:47:19.186086+00:00

Affected: arendst Tasmota

Tasmota through 16.0.0, fixed in commit 1cb7ebc, contains a cross-site request forgery vulnerability that allows unauthenticated attackers to bypass Referer-based CSRF protection in HttpCheckPriviledgedAccess() by crafting a Referer header where the device hostname or IP appears as a substring immediately after http://.evil.com/. Attackers can lure an administrator on the device's network to a malicious page to issue arbitrary console commands and reconfigure Wi-Fi, MQTT, settings, or firmware on devices lacking a WebPassword.