CVE-2026-0919

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The HTTP parser of Tapo C210 v3, C220 v1 and C520WS v2 cameras improperly handles requests containing an excessively long URL path. An invalid‑URL error path continues into cleanup code that assumes allocated buffers exist, leading to a crash and service restart. An unauthenticated attacker can force repeated service crashes or device reboots, causing denial of service.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Jan 27, 2026
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-09209.8The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Administrative User Creation in all versions up to, and includ CVE-2026-09247.0BuhoCleaner contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via insecure functio CVE-2026-09254.9Tanium addressed an improper input validation vulnerability in Discover.CVE-2026-09269.8The Prodigy Commerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'paramet CVE-2026-09275.3The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to arbitrary file uploads due to missing authoriz CVE-2026-09294.3The RegistrationMagic WordPress plugin before 6.0.7.2 does not have proper capability checks, allowing subscribers and above to create form CVE-2026-09304.3Potential read out of bounds case with wolfSSHd on Windows while handling a terminal resize request. An authenticated user could trigger the CVE-2026-09316.9Denial-of-service vulnerability in M-Files Server versions before 26.5.16015.3 allows an authenticated admin user to cause the M-Files Serve CVE-2026-09327.3Blind server-side request forgery (SSRF) vulnerability in legacy connection methods of document co-authoring features in M-Files Server befo CVE-2026-09339.9SummaryA command injection vulnerability (CWE-78) has been found to exist in the `wrangler pages deploy` command. The issue occurs because t CVE-2026-09343.8GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that CVE-2026-09365.0An Insertion of Sensitive Information into Log File vulnerability in B&R PVI client versions prior to 6.5 may be abused by an authenticated