Total
396399 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-88281 | 2026-09-10 | N/A | 4.9 MEDIUM | ||
| GeoVision GV-LPC2211 V1.13 fails to limit repeated Username elements in ONVIF DeleteUsers requests, allowing an authenticated administrator to overflow a stack array and crash the ONVIF worker. | |||||
| CVE-2026-88280 | 2026-09-10 | N/A | 4.9 MEDIUM | ||
| GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fixed stack field, allowing an authenticated administrator to crash the ONVIF worker. | |||||
| CVE-2026-88279 | 2026-09-10 | N/A | 4.9 MEDIUM | ||
| GeoVision GV-LPC2211 V1.13 copies oversized ONVIF CreateUsers username or password values into fixed stack fields, allowing an authenticated administrator to crash the ONVIF worker. | |||||
| CVE-2026-88278 | 2026-09-10 | N/A | 9.8 CRITICAL | ||
| GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection, allowing a captured PasswordDigest token to be replayed for subsequent ONVIF operations. | |||||
| CVE-2026-88276 | 2026-09-10 | N/A | 7.2 HIGH | ||
| GeoVision GV-LPC2211 V1.13 allows administrator-controlled WEP key values containing shell syntax to execute arbitrary commands as root. | |||||
| CVE-2026-88275 | 2026-09-10 | N/A | 7.2 HIGH | ||
| GeoVision GV-LPC2211 V1.13 allows an administrator-controlled WPA-PSK containing shell syntax to execute arbitrary commands as root when wireless configuration is applied. | |||||
| CVE-2026-88274 | 2026-09-10 | N/A | 7.2 HIGH | ||
| GeoVision GV-LPC2211 V1.13 allows an administrator-controlled wireless SSID containing shell syntax to execute arbitrary commands as root. | |||||
| CVE-2026-88273 | 2026-09-10 | N/A | 7.2 HIGH | ||
| GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute arbitrary commands as root. | |||||
| CVE-2026-87649 | 1 Google | 1 Chrome | 2026-09-10 | N/A | 5.4 MEDIUM |
| UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-87640 | 1 Google | 2 Android, Chrome | 2026-09-10 | N/A | 6.1 MEDIUM |
| Out of bounds read in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-87570 | 1 Google | 1 Chrome | 2026-09-10 | N/A | 8.8 HIGH |
| Incorrect authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted file. (Chromium security severity: Medium) | |||||
| CVE-2026-87569 | 1 Google | 1 Chrome | 2026-09-10 | N/A | 8.8 HIGH |
| Missing authorization in Views in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-87557 | 1 Google | 1 Chrome | 2026-09-10 | N/A | 4.3 MEDIUM |
| Missing authorization in LocalNetworkAccess in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-87552 | 1 Google | 2 Android, Chrome | 2026-09-10 | N/A | 5.5 MEDIUM |
| Missing authorization in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to obtain sensitive information via a co-installed app. (Chromium security severity: High) | |||||
| CVE-2026-87549 | 1 Google | 1 Chrome | 2026-09-10 | N/A | 6.5 MEDIUM |
| Incomplete cleanup in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-87548 | 1 Google | 1 Chrome | 2026-09-10 | N/A | 4.3 MEDIUM |
| Improper state validation in Installer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-87450 | 1 Google | 1 Chrome | 2026-09-10 | N/A | 7.5 HIGH |
| Incorrect authorization in Permissions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Medium) | |||||
| CVE-2026-87433 | 1 Google | 1 Chrome | 2026-09-10 | N/A | 8.8 HIGH |
| Race condition in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-86734 | 1 Snipeitapp | 1 Snipe-it | 2026-09-10 | N/A | 6.5 MEDIUM |
| Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/{acceptance} endpoint, allowing authenticated users to submit unbounded input that reaches synchronous CommonMark rendering. Attackers can submit large note values to exhaust PHP worker CPU and cause denial of service through resource exhaustion in the markdown parsing pipeline. | |||||
| CVE-2026-86729 | 2026-09-10 | N/A | 7.4 HIGH | ||
| WWBN AVideo through commit e01e41ecc (no patched version available) exposes get_api_preauthorize in plugin/API/API.php as a second, undocumented login path. Unlike get_api_signIn, which enforces a rate limit of 10 attempts per 5 minutes via checkRateLimit(), get_api_preauthorize performs the same credential check with no throttling for any client, allowing unlimited remote password guessing against arbitrary accounts, including admin. The endpoint also acts as a credential oracle: it returns the message "Invalid credentials" for both correct and incorrect passwords, while the users_id field in the response body discloses the authenticated identity (users_id:1 on success, users_id:0 on failure), and a correct password establishes a session cookie that remains usable for authenticated API requests. Together these issues permit unauthenticated brute-force account takeover. | |||||