CVE-2026-66282

In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can result in a recursive function call that will never reach its end condition. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted.

• CWE-674

• https://github.com/SiliconLabsSoftware/docs-security-advisories/blob/main/Advisories/500-599/A-00000590.mdMitigation, Patch, Vendor Advisory

Published

Oct 22, 2026

Last Modified

Oct 29, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-66276An authenticated attacker can craft a disposition frame with…6.5
• CVE-2026-66277It was not possible to govern the maximum number of transfer…6.5
• CVE-2026-66279In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earl…7.2
• CVE-2026-6628A flaw has been found in phili67 Ecclesia CRM up to 8.0.0. T…6.3
• CVE-2026-66280Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-66281In EmberZNet 9.1.1 and earlier, a malformed Discover Attribu…7.5
• CVE-2026-6629A vulnerability has been found in Metasoft 美特软件 MetaCRM up t…7.3
• CVE-2026-66293XML injection in the encoder of Saxy. Saxy.Encoder does not …2.1
• CVE-2026-66294XML injection in the Saxy XML encoder. Saxy.Encoder.cdata/1 …2.1
• CVE-2026-66295Saxy's XML encoder writes the target and the content of a pr…2.1
• CVE-2026-66296Improper Neutralization of Input During Web Page Generation …6.1
• CVE-2026-66297Improper Neutralization of Special Elements used in an OS Co…8