Castle Rock Computing SNMPc before 2015-12-17 has XSS via SNMP.

OXID eShop before 2016-06-13 allows remote attackers to execute arbitrary code via a GET or POST request to the oxuser class. Fixed versions are Enterprise Edition v5.1.12, Enterprise Edition v5.2.9, Professional Edition v4.8.12, Professional Edition v4.9.9, Community Edition v4.8.12, Community Edition v4.9.9.

AXIS Communications products with firmware through 5.80.x allow remote attackers to modify arbitrary files as root via vectors involving Open Script Editor, aka a “resource injection vulnerability.”

OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 allows attackers to obtain sensitive information by reading screenshots under /private/var/mobile/Containers/Data/Application.

Dell Integrated Remote Access Controller (iDRAC) 7/8 before 2.21.21.21 has XXE.

Jive before 2016.3.1 has an open redirect from the external-link.jspa page.

iBaby M3S has a password of admin for the backdoor admin account.

OpenCV 3.0.0 has a double free issue that allows attackers to execute arbitrary code.

TRENDnet WiFi Baby Cam TV-IP743SIC has a password of admin for the backdoor root account.

OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 allows Zigbee replay.