CVE-2026-33268

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Nanoleaf Lines 12.3.2 does not authenticate firmware file uploads. A remote, unauthenticated attacker can upload firmware files on the device and consume storage resources. Fixed in 12.3.6.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-400

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Mar 25, 2026
Last modified
Jun 17, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-33274.8Authenticated Iframe Injection in Dato CMS Web Previews plugin. This vulnerability permits a malicious authenticated user to circumvent the CVE-2026-332706.8Improper input validation for some Intel(R) Graphics Software within Ring 3: User Applications may allow a denial of service. Unprivileged sCVE-2026-332716.7Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis True Image (Windows) before builCVE-2026-332724.9A malicious user with physical access to the device can boot the switch from factory settings without authentication, use the default adminiCVE-2026-332737.2Unrestricted upload of file with dangerous type issue exists in MATCHA INVOICE 2.6.6 and earlier. If this vulnerability is exploited, an arbCVE-2026-332756.8Improper resource shutdown or release for some Intel(R) PROSet/Wireless Wi-Fi Software for Windows within Ring 3: User Applications may alloCVE-2026-332765.4Stored cross-site scripting (XSS) in Checkmk 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create hosts or serviCVE-2026-332778.7An OS command Injection issue exists in LogonTracer prior to v2.0.0. An arbitrary OS command may be executed by a logged-in user.CVE-2026-332789.8NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and CVE-2026-332796.9Out-of-bounds write for the Intel(R) VTune(TM) Profiler software before version 2026.0.0 within Ring 1: Device Drivers may allow a denial ofCVE-2026-33287.2The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to PHP Object Injection via deserialization of the 'post_content' of admCVE-2026-332809.8Hidden functionality issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to gain access to the product’s debugging fu