Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
9 results
Oct 18, 2026A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .CVE-2026-108984 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9High 7.5
A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .
- Product
- GV-ASManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .CVE-2026-108983 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9Critical 9.8
A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .
- Product
- GV-ASManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026A DLL hijacking vulnerability in GeoVision GV-ASManager allows a local attacker with write access to an unsafe search directory to execute arbitrary code.CVE-2026-18755 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9High 7.3
A DLL hijacking vulnerability in GeoVision GV-ASManager allows a local attacker with write access to an unsafe search directory to execute arbitrary code. By placing a crafted dynamic-link library (DLL) file into the application search path prior to the legitimate library, the malicious code is loaded and executed under the security privileges of the GV-ASManager process.
- Product
- GV-ASManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2026A remote code execution vulnerability exists in Notification Settings on GeoVision GV-ASWeb 6.2.0.CVE-2026-7841 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9High 8.8
A remote code execution vulnerability exists in Notification Settings on GeoVision GV-ASWeb 6.2.0. An authenticated user with System Setting permissions can execute arbitrary commands on the server by sending a crafted HTTP POST request to the ASWebCommon.srf backend endpoint to bypass the frontend restrictions.
- Product
- ASManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2025GeoVision ASManager Windows desktop application with the version 6.1.2.0 or less (fixed in 6.2.0), is vulnerable to credentials disclosure due to improper memorCVE-2025-26263 · Other software · reported by MITREMedium 5.1
GeoVision ASManager Windows desktop application with the version 6.1.2.0 or less (fixed in 6.2.0), is vulnerable to credentials disclosure due to improper memory handling in the ASManagerService.exe process.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgeovision.com.tw
Feb 3, 2025Information disclosure vulnerability in Geovision GV-ASManager web application with the version v6.1.0.0 or less, which discloses account information, includingCVE-2024-56902 · Other software · reported by MITREHigh 7.5
Information disclosure vulnerability in Geovision GV-ASManager web application with the version v6.1.0.0 or less, which discloses account information, including cleartext password.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2024GeoVision GV-ASManager Missing Authorization Information Disclosure Vulnerability.CVE-2024-12553 · Other software · GeoVision · reported by zdi-disclosures@trendmicro.comMedium 6.5
GeoVision GV-ASManager Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of GeoVision GV-ASManager. Although authentication is required to exploit this vulnerability, default guest credentials may be used. The specific flaw exists within the GV-ASWeb service. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-25394.
- Product
- GV-ASManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2024GV-ASManager V6.0.1.0 contains a Local File Inclusion vulnerability in GeoWebServer via Path.CVE-2022-46070 · Other software · gv_asmanager · reported by MITREHigh 7.5
GV-ASManager V6.0.1.0 contains a Local File Inclusion vulnerability in GeoWebServer via Path.
- Product
- gv_asmanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD records3.amazonaws.coms3.amazonaws.com
Dec 5, 2012Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the CVE-2011-2731 · Other software · VMware · reported by Red HatMedium 5.1
Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows attackers to gain privileges via a crafted thread.
- Product
- Springsource Spring Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orgsecunia.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.