Total
413906 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-88859 | 2026-09-10 | N/A | 6.3 MEDIUM | ||
| A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content. | |||||
| CVE-2026-88290 | 2026-09-10 | N/A | 7.5 HIGH | ||
| GeoVision GV-LPC2211 V1.14 (260903) allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, allowing remote exhaustion of memory, connection, and worker resources. | |||||
| CVE-2026-88289 | 2026-09-10 | N/A | 7.5 HIGH | ||
| GeoVision GV-LPC2211 V1.14 (260903) fails to validate attacker-controlled variable-length fields before copying them into fixed-size stack buffers in multiple VLSVR request handlers, allowing an unauthenticated remote attacker to crash the VLSVR service. | |||||
| CVE-2026-88288 | 2026-09-10 | N/A | 6.5 MEDIUM | ||
| GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary files accessible to the root-run web service. | |||||
| CVE-2026-88287 | 2026-09-10 | N/A | 7.5 HIGH | ||
| GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker to corrupt stack control state and crash the discovery process. | |||||
| CVE-2026-88286 | 2026-09-10 | N/A | 7.5 HIGH | ||
| GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remote client to block the accept loop and prevent new PTZ connections. | |||||
| CVE-2026-88285 | 2026-09-10 | N/A | 9.4 CRITICAL | ||
| GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication, allowing remote clients to retrieve PTZ information and issue PTZ or raw serial commands. | |||||
| CVE-2026-88284 | 2026-09-10 | N/A | 4.9 MEDIUM | ||
| GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF SetUser requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker. | |||||
| CVE-2026-88283 | 2026-09-10 | N/A | 4.9 MEDIUM | ||
| GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker. | |||||
| CVE-2026-88282 | 2026-09-10 | N/A | 7.2 HIGH | ||
| GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update. | |||||
| CVE-2026-88281 | 2026-09-10 | N/A | 4.9 MEDIUM | ||
| GeoVision GV-LPC2211 V1.13 fails to limit repeated Username elements in ONVIF DeleteUsers requests, allowing an authenticated administrator to overflow a stack array and crash the ONVIF worker. | |||||
| CVE-2026-88280 | 2026-09-10 | N/A | 4.9 MEDIUM | ||
| GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fixed stack field, allowing an authenticated administrator to crash the ONVIF worker. | |||||
| CVE-2026-88279 | 2026-09-10 | N/A | 4.9 MEDIUM | ||
| GeoVision GV-LPC2211 V1.13 copies oversized ONVIF CreateUsers username or password values into fixed stack fields, allowing an authenticated administrator to crash the ONVIF worker. | |||||
| CVE-2026-88278 | 2026-09-10 | N/A | 9.8 CRITICAL | ||
| GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection, allowing a captured PasswordDigest token to be replayed for subsequent ONVIF operations. | |||||
| CVE-2026-88276 | 2026-09-10 | N/A | 7.2 HIGH | ||
| GeoVision GV-LPC2211 V1.13 allows administrator-controlled WEP key values containing shell syntax to execute arbitrary commands as root. | |||||
| CVE-2026-88275 | 2026-09-10 | N/A | 7.2 HIGH | ||
| GeoVision GV-LPC2211 V1.13 allows an administrator-controlled WPA-PSK containing shell syntax to execute arbitrary commands as root when wireless configuration is applied. | |||||
| CVE-2026-88274 | 2026-09-10 | N/A | 7.2 HIGH | ||
| GeoVision GV-LPC2211 V1.13 allows an administrator-controlled wireless SSID containing shell syntax to execute arbitrary commands as root. | |||||
| CVE-2026-88273 | 2026-09-10 | N/A | 7.2 HIGH | ||
| GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute arbitrary commands as root. | |||||
| CVE-2026-87649 | 1 Google | 1 Chrome | 2026-09-10 | N/A | 5.4 MEDIUM |
| UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-87640 | 1 Google | 2 Android, Chrome | 2026-09-10 | N/A | 6.1 MEDIUM |
| Out of bounds read in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | |||||