Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (25 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-88289 1 Geovision Inc. 1 Gv-lpc2011 Lpc2211 2026-09-10 7.5 High
GeoVision GV-LPC2211 V1.14 (260903) fails to validate attacker-controlled variable-length fields before copying them into fixed-size stack buffers in multiple VLSVR request handlers, allowing an unauthenticated remote attacker to crash the VLSVR service.
CVE-2026-88288 1 Geovision Inc. 1 Gv-lpc2011 Lpc2211 2026-09-10 6.5 Medium
GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary files accessible to the root-run web service.
CVE-2026-88287 1 Geovision Inc. 1 Gv-lpc2011 Lpc2211 2026-09-10 7.5 High
GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker to corrupt stack control state and crash the discovery process.
CVE-2026-88286 1 Geovision Inc. 1 Gv-lpc2011 Lpc2211 2026-09-10 7.5 High
GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remote client to block the accept loop and prevent new PTZ connections.
CVE-2026-88285 1 Geovision Inc. 1 Gv-lpc2011 Lpc2211 2026-09-10 9.4 Critical
GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication, allowing remote clients to retrieve PTZ information and issue PTZ or raw serial commands.
CVE-2026-88284 1 Geovision Inc. 1 Gv-lpc2011 Lpc2211 - 2026-09-10 4.9 Medium
GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF SetUser requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker.
CVE-2026-88283 1 Geovision Inc. 1 Gv-lpc2011 Lpc2211 2026-09-10 4.9 Medium
GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker.
CVE-2026-88281 1 Geovision Inc. 1 Gv-lpc2011 Lpc2211 2026-09-10 4.9 Medium
GeoVision GV-LPC2211 V1.13 fails to limit repeated Username elements in ONVIF DeleteUsers requests, allowing an authenticated administrator to overflow a stack array and crash the ONVIF worker.
CVE-2026-88280 1 Geovision Inc. 1 Gv-lpc2011 Lpc2211 2026-09-10 4.9 Medium
GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fixed stack field, allowing an authenticated administrator to crash the ONVIF worker.
CVE-2026-88279 1 Geovision Inc. 1 Gv-lpc2011 Lpc2211 2026-09-10 4.9 Medium
GeoVision GV-LPC2211 V1.13 copies oversized ONVIF CreateUsers username or password values into fixed stack fields, allowing an authenticated administrator to crash the ONVIF worker.
CVE-2026-88275 1 Geovision Inc. 1 Gv-lpc2011 Lpc2211 2026-09-10 7.2 High
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled WPA-PSK containing shell syntax to execute arbitrary commands as root when wireless configuration is applied.
CVE-2026-88290 1 Geovision Inc. 1 Gv-lpc2011 Lpc2211 2026-09-10 7.5 High
GeoVision GV-LPC2211 V1.14 (260903) allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, allowing remote exhaustion of memory, connection, and worker resources.
CVE-2026-88269 1 Geovision Inc. 1 Gv-lpc2011 Lpc2211 2026-09-10 6.5 Medium
GeoVision GV-LPC2211 V1.13 allows a Guest user to retrieve persistent device configuration containing plaintext administrative and user credentials through SSVR.
CVE-2026-88274 1 Geovision Inc. 1 Gv-lpc2011 Lpc2211 2026-09-10 7.2 High
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled wireless SSID containing shell syntax to execute arbitrary commands as root.
CVE-2026-88273 1 Geovision Inc. 1 Gv-lpc2011 Lpc2211 2026-09-10 7.2 High
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute arbitrary commands as root.
CVE-2026-88272 1 Geovision Inc. 1 Gv-lpc2011 Lpc2211 2026-09-10 7.2 High
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containing shell metacharacters to be executed as arbitrary root commands when the stored username is later deleted.
CVE-2026-88271 1 Geovision Inc. 1 Gv-lpc2011 Lpc2211 2026-09-10 8.8 High
GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device configuration and replace the administrator password through SSVR.
CVE-2026-88270 1 Geovision Inc. 1 Gv-lpc2011 Lpc2211 2026-09-10 6.5 Medium
GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any firmware image is validated.
CVE-2026-57872 1 Geovision Inc. 2 Gv-lpc2011 Lpc2211, Gv-lpclpc2011 2211 2026-06-29 7.5 High
An unauthenticated directory traversal vulnerability exists in get_fcont.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient validation of user-supplied file path input before the requested file is accessed by the CGI component. A remote attacker may exploit this vulnerability by sending a crafted request to read arbitrary files accessible to the affected process, resulting in information disclosure.
CVE-2026-42368 2 Geovision, Geovision Inc. 5 Gv-lpc2011, Gv-lpc2011 Firmware, Gv-lpc2211 and 2 more 2026-06-15 9.9 Critical
A privilege escalation vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted HTTP request can lead to execute priviledged operation. An attacker can visit a webpage to trigger this vulnerability.