https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-28522.htmlhttps://patchthecve.com/cve/CVE-2026-28522.htmlWed, 17 Jun 2026 10:28:47 +0000MEDIUM 6.5: arduino-TuyaOpen before version 1.2.1 contains a null pointer dereference vulnerability in the WiFiUDP component. An attacker on the same local area network can send a large volume of malicious UDP packets that trigger a null pointer dereference, resulting in a denial-of-service condition.https://patchthecve.com/cve/CVE-2026-28521.htmlhttps://patchthecve.com/cve/CVE-2026-28521.htmlWed, 17 Jun 2026 10:28:47 +0000HIGH 7.7: arduino-TuyaOpen before version 1.2.1 contains an out-of-bounds memory read vulnerability in the TuyaIoT component. An attacker who hijacks or controls the Tuya cloud service can issue malicious DP event data to victim devices, causing out-of-bounds memory access that may result in information disclhttps://patchthecve.com/cve/CVE-2026-28520.htmlhttps://patchthecve.com/cve/CVE-2026-28520.htmlWed, 17 Jun 2026 10:28:47 +0000HIGH 8.4: arduino-TuyaOpen before version 1.2.1 contains a single-byte buffer overflow vulnerability in the WiFiMulti component. When the victim's smart hardware connects to an attacker-controlled AP hotspot, the attacker can exploit the overflow to execute arbitrary code on the affected embedded device.https://patchthecve.com/cve/CVE-2026-28519.htmlhttps://patchthecve.com/cve/CVE-2026-28519.htmlWed, 17 Jun 2026 10:28:47 +0000HIGH 8.8: arduino-TuyaOpen before version 1.2.1 contains a heap-based buffer overflow vulnerability in the DnsServer component. An attacker on the same local area network who controls the LAN DNS server can send malicious DNS responses to overflow the heap buffer, potentially allowing execution of arbitrary c