Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,454 results · page 3 of 30
Sep 17, 2026In the Linux kernel, the following vulnerability has been resolved: md/raid5: round bitmap stripes with sector division raid5_bitmap_sector_map() aligns the aCVE-2026-90279 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: md/raid5: round bitmap stripes with sector division raid5_bitmap_sector_map() aligns the array range to full RAID5 stripe widths before converting it to component sectors. That width is chunk_sectors multiplied by the number of data disks, and it is not always a power of two. Reproduce with a 4-disk RAID5, 1024-sector chunks, and three data disks. The full-stripe width is 3072 sectors. For a one-sector write at array sector 3072, correct rounding gives array range [3072, 6144), which maps to component range [1024, 2048). The old round_down()/round_up() logic instead gives [1024, 4096), which maps to [0, 1024). Use sector_div() based arithmetic so the rounded range is aligned to the actual RAID5 stripe width. The deterministic mapper test now reports the fixed component range as [1024, 2048), while the old mask-based range was [0, 1024).
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 16, 2026A DLL hijacking vulnerability exists in the GeoVision GV-Remote E-Map desktop application.CVE-2026-92838 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9High 7.8
A DLL hijacking vulnerability exists in the GeoVision GV-Remote E-Map desktop application. The application loads one or more dynamic-link libraries (DLLs) from an unsafe search path, allowing a local attacker to place a malicious DLL in a location searched before the legitimate library location. If successfully exploited, an attacker with local write access to the affected directory could achieve arbitrary code execution in the security context of the GV-Remote E-Map process.
- Product
- GV-Remote E-map
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-dataCVE-2026-92594 · Other software · craftcms · reported by VulnCheckHigh 8.7
Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-data scope enforced by Gql::canQueryUsers() (usergroups.*:read), these fields are gated only on the elements.drafts:read / elements.revisions:read scopes, and their resolver returns a raw User element whose email, username, fullName, and addresses fields have no per-field authorization. A client holding only the drafts or revisions scope — including an unauthenticated client when the operator has enabled the public GraphQL schema with those scopes — can therefore harvest the email addresses, usernames, full names, and postal addresses of all draft/revision creators (typically site editors and administrators). The issue is fixed in 5.11.0.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 16, 2026AVideo through 29.0 (current revision e01e41ecc) contains a stored cross-site scripting vulnerability.CVE-2026-92584 · Other software · WWBN · reported by VulnCheckMedium 5.3
AVideo through 29.0 (current revision e01e41ecc) contains a stored cross-site scripting vulnerability. The unauthenticated view-counter endpoint objects/videoAddViewCount.json.php reaches VideoStatistic::save(), which writes the caller's User-Agent (via getUserAgentInfo(), which returns unrecognized agent strings verbatim) directly into the `app` column of the videos_statistics table without invoking the sanitizing setter setApp(); normalizeApp() only truncates the value to 45 characters. The video owner's and administrator's statistics page (view/videoViewsInfo.php) renders this field in a DataTables 1.12.1 column with an unescaped renderer, and DataTables assigns cell content using innerHTML, so attacker-supplied HTML is parsed and executed in the privileged user's authenticated session when the statistics page is viewed. No patched version was available at the time of the advisory.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 16, 2026A vulnerability in the client provisioning download feature of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to access protected fCVE-2026-76433 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.3
A vulnerability in the client provisioning download feature of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to access protected files on an affected device. This vulnerability is due to insufficient validation of directory traversal character sequences in a user-supplied path when the software processes provisioning resource requests. An attacker could exploit this vulnerability by sending a crafted request to the provisioning download service. A successful exploit could allow the attacker to access protected files without authentication, potentially exposing sensitive information.
- Product
- Cisco Identity Services Engine Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Sep 16, 2026In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix division by zero in get_estimated_bw() get_estimated_bw() divides by CVE-2026-90035 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix division by zero in get_estimated_bw() get_estimated_bw() divides by link->dpia_bw_alloc_config.bw_granularity, which is zeroed by reset_bw_alloc_struct() and only populated once DP_TUNNELING_BW_ALLOC_CAP_CHANGED has been handled. link_dp_dpia_handle_bw_alloc_status(), the DPCD interrupt handler, calls get_estimated_bw() whenever DP_TUNNELING_ESTIMATED_BW_CHANGED is set, independently of whether DP_TUNNELING_BW_ALLOC_CAP_CHANGED has ever fired for that link. A connected USB4/DPIA tunneling device that reports an estimated-bandwidth change before ever reporting a capability change drives a division by zero in this IRQ path. link_dpia_send_bw_alloc_request() already guards the same bw_granularity division; add the identical guard here rather than introducing a new pattern. (cherry picked from commit f2a961457c33dc34223aad5c9e8971de34a4eed3)
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 15, 2026Coder allows organizations to provision remote development environments via Terraform.CVE-2026-63443 · Other software · coder · reported by GitHubHigh 8.3
Coder allows organizations to provision remote development environments via Terraform. Prior to 2.29.19, 2.32.9, 2.33.10, and 2.34.4, agentConn.apiClient() follows redirects while its custom transport accepts the host from the redirected request URL when the port is the workspace agent HTTP API port 4. An authenticated user who controls a modified workspace agent and knows another online agent's UUID can derive the victim's tailnet address and redirect control-plane requests to that agent. HTTP 301, 302, and 303 redirects can redirect read requests, while HTTP 307 and 308 preserve replayable write and process-start requests. The redirected workspace agent file APIs can read or write files as the victim workspace user, and affected versions exposing the workspace agent process API can execute commands after a redirected file write, crossing workspace and tenant boundaries. This issue is fixed in versions 2.29.19, 2.32.9, 2.33.10, and 2.34.4.
- Product
- coder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2026vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loadCVE-2026-90553 · Other software · vllm-project · reported by VulnCheckHigh 8.5
vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loading remote processor classes. Attackers can craft a malicious model with arbitrary code in processing_llava_onevision2.py that executes with vLLM process authority even when trust_remote_code is set to False.
- Product
- vLLM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 11, 2026ZoneMinder is a free, open source closed-circuit television software application.CVE-2026-54258 · Other software · ZoneMinder · reported by GitHubMedium 6.5
ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse `Events=View` and/or `Snapshots=View` permissions to directly fetch media for events belonging to monitors they are not allowed to access. The normal UI correctly hides the restricted monitor and its events, but direct event media views accept an arbitrary `eid` and stream media from the event path without enforcing the event/monitor-level ACL. This exposes private surveillance footage across monitor boundaries. Versions 1.36.39, 1.38.4, and 1.39.11 fix the issue.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/PlayerSkins/seo.php that allows unauthCVE-2026-88876 · Other software · WWBN · reported by VulnCheckHigh 8.7
AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/PlayerSkins/seo.php that allows unauthenticated attackers to access password-protected video sources by calling getSources() without password validation. Attackers can request the seo.php endpoint with a video ID to obtain the direct MP4 URL and read protected media bytes without supplying the configured password.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 10, 2026AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) incompletely sanitizes sensitive user fields in the APIName=video responseCVE-2026-88875 · Other software · WWBN · reported by VulnCheckMedium 5.3
AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) incompletely sanitizes sensitive user fields in the APIName=video response. Video rows include columns joined from the video owner's user record, and API::get_api_video() calls removeSensitiveUserFields() only when the caller is neither authenticated nor using a valid API secret; it never compares User::getId() with the row's users_id. As a result, any low-privilege authenticated account can request another user's video and receive the owner's email address, account name (user), and isAdmin, canUpload and canStream flags, which are removed for guests and should be returned only to the owner or to callers with a valid API secret. No patched version was available at the time of the advisory.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 10, 2026AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) does not enforce the Live stream password check on the stats endpoint or oCVE-2026-88874 · Other software · WWBN · reported by VulnCheckHigh 8.7
AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) does not enforce the Live stream password check on the stats endpoint or on the HLS origin. Live::_getStats() (plugin/Live/Live.php) returns a password-protected transmission's RTMP stream key, its isPasswordProtected flag, and its HLS (m3u8) URL to unauthenticated callers, in both the public applications list and the hidden_applications branch used when canSeeLiveFromLiveKey() fails. Separately, the shipped NGINX configuration (deploy/nginx/nginx.conf) serves the .m3u8 playlist, the AES-128 key, and the transport-stream segments from the /live location without any auth_request (the auth_key_check directive in the .key location is commented out). A remote, unauthenticated attacker can therefore retrieve the stream key and decryption key and watch a password-protected live transmission without supplying the configured password. No patched version was available at the time of the advisory.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 10, 2026There is an Vulnerability in some HikCentral Access Control versions.CVE-2026-85545 · Network & remote access · Hikvision · reported by hsrc@hikvision.comHigh 7.1
There is an Vulnerability in some HikCentral Access Control versions. Authenticated low-privilege users can invoke API interfaces that their role is not authorized to access.
- Product
- HikCentral Access Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026Some Hikvision intercom products utilize an immutable factory value which should be obtained from local network or physical interaction with the device within tCVE-2026-85544 · Network & remote access · Hikvision · reported by hsrc@hikvision.comMedium 6.1
Some Hikvision intercom products utilize an immutable factory value which should be obtained from local network or physical interaction with the device within their main card, which may allow attackers to forge a legitimate main card, thereby gaining the permission to issue cards.
- Product
- DS-KV9503
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, allowing authenticated low-privileged users to obtain device WiCVE-2026-85543 · Network & remote access · Hikvision · reported by hsrc@hikvision.comMedium 4.3
Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, allowing authenticated low-privileged users to obtain device Wi-Fi configuration information through these interfaces.
- Product
- Wi-Fi series camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026GeoVision GV-LPC2211 V1.14 (260903) allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, allowing rCVE-2026-88290 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9High 7.5
GeoVision GV-LPC2211 V1.14 (260903) allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, allowing remote exhaustion of memory, connection, and worker resources.
- Product
- GV-LPC2011/LPC2211
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026GeoVision GV-LPC2211 V1.14 (260903) fails to validate attacker-controlled variable-length fields before copying them into fixed-size stack buffers in multiple VCVE-2026-88289 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9High 7.5
GeoVision GV-LPC2211 V1.14 (260903) fails to validate attacker-controlled variable-length fields before copying them into fixed-size stack buffers in multiple VLSVR request handlers, allowing an unauthenticated remote attacker to crash the VLSVR service.
- Product
- GV-LPC2011/LPC2211
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary fiCVE-2026-88288 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9Medium 6.5
GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary files accessible to the root-run web service.
- Product
- GV-LPC2011/LPC2211
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker to corrupCVE-2026-88287 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9High 7.5
GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker to corrupt stack control state and crash the discovery process.
- Product
- GV-LPC2011/LPC2211
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remote client to block the accept loop and prevent new PTZ conneCVE-2026-88286 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9High 7.5
GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remote client to block the accept loop and prevent new PTZ connections.
- Product
- GV-LPC2011/LPC2211
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication, allowing remote clients to retrieve PTZ information and issuCVE-2026-88285 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9Critical 9.4
GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication, allowing remote clients to retrieve PTZ information and issue PTZ or raw serial commands.
- Product
- GV-LPC2011/LPC2211
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF SetUser requests, allowing an authenticated administrator to overwrite stack control sCVE-2026-88284 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9Medium 4.9
GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF SetUser requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker.
- Product
- GV-LPC2011/LPC2211 -
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to overwrite stack contrCVE-2026-88283 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9Medium 4.9
GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker.
- Product
- GV-LPC2011/LPC2211
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a suCVE-2026-88282 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9High 7.2
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update.
- Product
- GV-LPCLPC2011/2211
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026GeoVision GV-LPC2211 V1.13 fails to limit repeated Username elements in ONVIF DeleteUsers requests, allowing an authenticated administrator to overflow a stack CVE-2026-88281 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9Medium 4.9
GeoVision GV-LPC2211 V1.13 fails to limit repeated Username elements in ONVIF DeleteUsers requests, allowing an authenticated administrator to overflow a stack array and crash the ONVIF worker.
- Product
- GV-LPC2011/LPC2211
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fixed stack field, allowing an authenticated administrator to crash the ONVIF workeCVE-2026-88280 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9Medium 4.9
GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fixed stack field, allowing an authenticated administrator to crash the ONVIF worker.
- Product
- GV-LPC2011/LPC2211
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026GeoVision GV-LPC2211 V1.13 copies oversized ONVIF CreateUsers username or password values into fixed stack fields, allowing an authenticated administrator to crCVE-2026-88279 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9Medium 4.9
GeoVision GV-LPC2211 V1.13 copies oversized ONVIF CreateUsers username or password values into fixed stack fields, allowing an authenticated administrator to crash the ONVIF worker.
- Product
- GV-LPC2011/LPC2211
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection, allowing a captured PasswordDigest token to be replayCVE-2026-88278 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9Critical 9.8
GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection, allowing a captured PasswordDigest token to be replayed for subsequent ONVIF operations.
- Product
- GV-LPCLPC2011/2211
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026GeoVision GV-LPC2211 V1.13 allows an authenticated ONVIF user to inject shell commands through ConsumerReference.Address and execute arbitrary commands as root.CVE-2026-88277 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9High 8.8
GeoVision GV-LPC2211 V1.13 allows an authenticated ONVIF user to inject shell commands through ConsumerReference.Address and execute arbitrary commands as root.
- Product
- GV-LPCLPC2011/2211
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026GeoVision GV-LPC2211 V1.13 allows administrator-controlled WEP key values containing shell syntax to execute arbitrary commands as root.CVE-2026-88276 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9High 7.2
GeoVision GV-LPC2211 V1.13 allows administrator-controlled WEP key values containing shell syntax to execute arbitrary commands as root.
- Product
- GV-LPCLPC2011/2211
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026GeoVision GV-LPC2211 V1.13 allows an administrator-controlled WPA-PSK containing shell syntax to execute arbitrary commands as root when wireless configuration CVE-2026-88275 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9High 7.2
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled WPA-PSK containing shell syntax to execute arbitrary commands as root when wireless configuration is applied.
- Product
- GV-LPC2011/LPC2211
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026GeoVision GV-LPC2211 V1.13 allows an administrator-controlled wireless SSID containing shell syntax to execute arbitrary commands as root.CVE-2026-88274 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9High 7.2
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled wireless SSID containing shell syntax to execute arbitrary commands as root.
- Product
- GV-LPC2011/LPC2211
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute arbitrary commands aCVE-2026-88273 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9High 7.2
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute arbitrary commands as root.
- Product
- GV-LPC2011/LPC2211
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containing shell metacharacters to be executed as arbitrary root commands when the storedCVE-2026-88272 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9High 7.2
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containing shell metacharacters to be executed as arbitrary root commands when the stored username is later deleted.
- Product
- GV-LPC2011/LPC2211
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device configuration and replace the administrator password through SSVR.CVE-2026-88271 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9High 8.8
GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device configuration and replace the administrator password through SSVR.
- Product
- GV-LPC2011/LPC2211
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any firmware image is validated.CVE-2026-88270 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9Medium 6.5
GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any firmware image is validated.
- Product
- GV-LPC2011/LPC2211
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026GeoVision GV-LPC2211 V1.13 allows a Guest user to retrieve persistent device configuration containing plaintext administrative and user credentials through SSVRCVE-2026-88269 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9Medium 6.5
GeoVision GV-LPC2211 V1.13 allows a Guest user to retrieve persistent device configuration containing plaintext administrative and user credentials through SSVR.
- Product
- GV-LPC2011/LPC2211
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026GeoVision GV-LPC2211 V1.13 contains an authenticated stack buffer overflow in SSVR fragment reassembly that allows a valid user to crash the SSVR service.CVE-2026-88268 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9Medium 6.5
GeoVision GV-LPC2211 V1.13 contains an authenticated stack buffer overflow in SSVR fragment reassembly that allows a valid user to crash the SSVR service.
- Product
- GV-LPCLPC2011/2211
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026An attacker could impersonate the camera and place themselves in a man-in-the-middle or device-emulation position.CVE-2026-82563 · Other software · Softish · reported by ics-cert@hq.dhs.govHigh 8.4
An attacker could impersonate the camera and place themselves in a man-in-the-middle or device-emulation position. This permits manipulation of device status responses, observation of application requests, and potential triggering of firmware-update behavior.
- Product
- EarVision Android application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.com
Sep 9, 2026An attacker could derive the camera's Wi-Fi password and connect to its wireless network.CVE-2026-81640 · Other software · Softish · reported by ics-cert@hq.dhs.govHigh 8.7
An attacker could derive the camera's Wi-Fi password and connect to its wireless network. This weakens or eliminates the security value of the access-point password and may expose the live video stream, device services, status interfaces, and firmware-update functionality.
- Product
- EarVision Android application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.com
Sep 9, 2026The C6 ear camera transmits live video to the EarVision Android application over unencrypted UDP streams.CVE-2026-81330 · Other software · Softish · reported by ics-cert@hq.dhs.govHigh 7.1
The C6 ear camera transmits live video to the EarVision Android application over unencrypted UDP streams. The application manifest permits cleartext traffic, and captured network traffic contains reconstructable JPEG or WEBP video frames transmitted over UDP. An attacker within local wireless range may capture and reconstruct the live video stream without transport encryption.
- Product
- EarVision Android application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.com
Sep 9, 2026After spoofing the device and obtaining one user confirmation, an attacker may be able to cause the application to transmit firmware through an unauthenticated CVE-2026-77974 · Other software · Softish · reported by ics-cert@hq.dhs.govHigh 8.5
After spoofing the device and obtaining one user confirmation, an attacker may be able to cause the application to transmit firmware through an unauthenticated and unsigned update channel.
- Product
- EarVision Android application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.com
Sep 3, 2026XG VisionTerminal, XG-X VisionTerminal, LJ Series Terminal-Software and WI Series Terminal-Software provided by Keyence Corporation improperly restrict XML exteCVE-2026-82918 · Other software · Keyence Corporation · reported by vultures@jpcert.or.jpMedium 6.7
XG VisionTerminal, XG-X VisionTerminal, LJ Series Terminal-Software and WI Series Terminal-Software provided by Keyence Corporation improperly restrict XML external entity references. If a user opens a specially crafted setting file, the sensitive information stored in the system where the affected product is installed may be disclosed.
- Product
- XG-X VisionTerminal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026In the Linux kernel, the following vulnerability has been resolved: ata: pata_sl82c105: fix bridge revision use-after-free pci_get_slot() returns a referencedCVE-2026-80732 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: ata: pata_sl82c105: fix bridge revision use-after-free pci_get_slot() returns a referenced PCI device. Commit 44c10138fd4b ("PCI: Change all drivers to use pci_device->revision") replaced a configuration-space read with direct access to the cached revision field, but left that access after pci_dev_put(). The bridge may therefore be freed before its revision is read. Read the revision before dropping the reference.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 1, 2026GROWI contains an access control vulnerability in the GET /_api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revisiCVE-2026-84205 · Other software · growilabs · reported by VulnCheckHigh 7.1
GROWI contains an access control vulnerability in the GET /_api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revision identified by the path parameter without confirming they reference the same page. Authenticated attackers can pair a page identifier they can access with an arbitrary revision identifier to read revision content from pages they lack permission to view.
- Product
- growi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026A security flaw has been discovered in vidIQ Vision for YouTube Extension 3.199.0 on Chrome.CVE-2026-82809 · Other software · vidIQ · reported by VulDBLow 2.1
A security flaw has been discovered in vidIQ Vision for YouTube Extension 3.199.0 on Chrome. The affected element is the function window.addEventListener of the component postMessage Handler. Performing a manipulation of the argument vidiqEvent results in information disclosure. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor explains: "At this time, vidIQ does not accept security vulnerability submissions, and we do not have a bug bounty program in place."
- Product
- Vision for YouTube Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026Incorrect access control in the setWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter upstream provisioning and connCVE-2026-51690 · Other software · reported by MITRECritical 9.1
Incorrect access control in the setWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter upstream provisioning and connectivity via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a DenCVE-2026-38345 · Other software · reported by MITREMedium 6.5
A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.ffmpeg.orgcode.ffmpeg.org
Aug 27, 2026Unitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow unauthenticated prCVE-2026-76640 · Other software · Unitree Robotics · reported by VulnCheckHigh 7.7
Unitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow unauthenticated proximate attackers to achieve root code execution without pairing or credentials by exploiting an unquoted heredoc variable in the WiFi provisioning script and a buffer overflow in the SSID chunk accumulator. Attackers can send crafted BLE writes to overflow a fixed BSS buffer across BLE connections, corrupting an adjacent mainloop function pointer dispatch entry that is subsequently invoked by the cleanup path passing attacker-controlled data to system() as uid 0.
- Product
- G1 EDU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026Improper input validation in the HandleUpdate function (/sbi/parameter_provision.go) of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via aCVE-2026-30068 · Other software · reported by MITREHigh 7.5
Improper input validation in the HandleUpdate function (/sbi/parameter_provision.go) of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.