GV

Latest CVEs · RSS

• CVE-2026-107437 2026-10-12 · CVSS 6.2
  GV-E-Map Server V18.2.0A contains a plaintext database password embedded within an application component. The credential can be recovered through static analysi
• CVE-2026-103098 2026-10-02 · CVSS 7.5
  Transmission of a sensitive key in the URL over an unencrypted HTTP connection.  The request is sent over HTTP rather than HTTPS, meaning the key is transmitted
• CVE-2026-103097 2026-10-02 · CVSS 7.5
  An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials
• CVE-2026-103096 2026-10-02 · CVSS 7.5
  API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials dir
• CVE-2026-92838 2026-09-17 · CVSS 7.8
  A DLL hijacking vulnerability exists in the GeoVision GV-Remote E-Map desktop application. The application loads one or more dynamic-link libraries (DLLs) from
• CVE-2026-88290 2026-09-10 · CVSS 7.5
  GeoVision GV-LPC2211 V1.14 (260903) allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, allowing r
• CVE-2026-88289 2026-09-10 · CVSS 7.5
  GeoVision GV-LPC2211 V1.14 (260903) fails to validate attacker-controlled variable-length fields before copying them into fixed-size stack buffers in multiple V
• CVE-2026-88288 2026-09-10 · CVSS 6.5
  GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary fi
• CVE-2026-88287 2026-09-10 · CVSS 7.5
  GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker to corrup
• CVE-2026-88286 2026-09-10 · CVSS 7.5
  GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remote client to block the accept loop and prevent new PTZ conne
• CVE-2026-88285 2026-09-10 · CVSS 9.4
  GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication, allowing remote clients to retrieve PTZ information and issu
• CVE-2026-88284 2026-09-10 · CVSS 4.9
  GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF SetUser requests, allowing an authenticated administrator to overwrite stack control s
• CVE-2026-88283 2026-09-10 · CVSS 4.9
  GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to overwrite stack contr
• CVE-2026-88282 2026-09-10 · CVSS 7.2
  GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a su
• CVE-2026-88281 2026-09-10 · CVSS 4.9
  GeoVision GV-LPC2211 V1.13 fails to limit repeated Username elements in ONVIF DeleteUsers requests, allowing an authenticated administrator to overflow a stack
• CVE-2026-88280 2026-09-10 · CVSS 4.9
  GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fixed stack field, allowing an authenticated administrator to crash the ONVIF worke
• CVE-2026-88279 2026-09-10 · CVSS 4.9
  GeoVision GV-LPC2211 V1.13 copies oversized ONVIF CreateUsers username or password values into fixed stack fields, allowing an authenticated administrator to cr
• CVE-2026-88278 2026-09-10 · CVSS 9.8
  GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection, allowing a captured PasswordDigest token to be replay
• CVE-2026-88277 2026-09-10 · CVSS 8.8
  GeoVision GV-LPC2211 V1.13 allows an authenticated ONVIF user to inject shell commands through ConsumerReference.Address and execute arbitrary commands as root.
• CVE-2026-88276 2026-09-10 · CVSS 7.2
  GeoVision GV-LPC2211 V1.13 allows administrator-controlled WEP key values containing shell syntax to execute arbitrary commands as root.
• CVE-2026-88275 2026-09-10 · CVSS 7.2
  GeoVision GV-LPC2211 V1.13 allows an administrator-controlled WPA-PSK containing shell syntax to execute arbitrary commands as root when wireless configuration
• CVE-2026-88274 2026-09-10 · CVSS 7.2
  GeoVision GV-LPC2211 V1.13 allows an administrator-controlled wireless SSID containing shell syntax to execute arbitrary commands as root.
• CVE-2026-88273 2026-09-10 · CVSS 7.2
  GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute arbitrary commands a
• CVE-2026-88272 2026-09-10 · CVSS 7.2
  GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containing shell metacharacters to be executed as arbitrary root commands when the stored
• CVE-2026-88271 2026-09-10 · CVSS 8.8
  GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device configuration and replace the administrator password through SSVR.