Updated 32 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

353new WordPress flaws this week

390,080entries in the database

24 results

Sep 10, 2026GeoVision GV-LPC2211 V1.14 (260903) allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, allowing rCVE-2026-88290 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9High 7.5
GeoVision GV-LPC2211 V1.14 (260903) allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, allowing remote exhaustion of memory, connection, and worker resources.
Product
GV-LPC2011/LPC2211
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record geovision.com.tw
Sep 10, 2026GeoVision GV-LPC2211 V1.14 (260903) fails to validate attacker-controlled variable-length fields before copying them into fixed-size stack buffers in multiple VCVE-2026-88289 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9High 7.5
GeoVision GV-LPC2211 V1.14 (260903) fails to validate attacker-controlled variable-length fields before copying them into fixed-size stack buffers in multiple VLSVR request handlers, allowing an unauthenticated remote attacker to crash the VLSVR service.
Product
GV-LPC2011/LPC2211
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record geovision.com.tw
Sep 10, 2026GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary fiCVE-2026-88288 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9Medium 6.5
GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary files accessible to the root-run web service.
Product
GV-LPC2011/LPC2211
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record geovision.com.tw
Sep 10, 2026GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker to corrupCVE-2026-88287 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9High 7.5
GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker to corrupt stack control state and crash the discovery process.
Product
GV-LPC2011/LPC2211
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record geovision.com.tw
Sep 10, 2026GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remote client to block the accept loop and prevent new PTZ conneCVE-2026-88286 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9High 7.5
GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remote client to block the accept loop and prevent new PTZ connections.
Product
GV-LPC2011/LPC2211
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record geovision.com.tw
Sep 10, 2026GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication, allowing remote clients to retrieve PTZ information and issuCVE-2026-88285 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9Critical 9.4
GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication, allowing remote clients to retrieve PTZ information and issue PTZ or raw serial commands.
Product
GV-LPC2011/LPC2211
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record geovision.com.tw
Sep 10, 2026GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF SetUser requests, allowing an authenticated administrator to overwrite stack control sCVE-2026-88284 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9Medium 4.9
GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF SetUser requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker.
Product
GV-LPC2011/LPC2211 -
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record geovision.com.tw
Sep 10, 2026GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to overwrite stack contrCVE-2026-88283 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9Medium 4.9
GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker.
Product
GV-LPC2011/LPC2211
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record geovision.com.tw
Sep 10, 2026GeoVision GV-LPC2211 V1.13 fails to limit repeated Username elements in ONVIF DeleteUsers requests, allowing an authenticated administrator to overflow a stack CVE-2026-88281 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9Medium 4.9
GeoVision GV-LPC2211 V1.13 fails to limit repeated Username elements in ONVIF DeleteUsers requests, allowing an authenticated administrator to overflow a stack array and crash the ONVIF worker.
Product
GV-LPC2011/LPC2211
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record geovision.com.tw
Sep 10, 2026GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fixed stack field, allowing an authenticated administrator to crash the ONVIF workeCVE-2026-88280 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9Medium 4.9
GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fixed stack field, allowing an authenticated administrator to crash the ONVIF worker.
Product
GV-LPC2011/LPC2211
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record geovision.com.tw
Sep 10, 2026GeoVision GV-LPC2211 V1.13 copies oversized ONVIF CreateUsers username or password values into fixed stack fields, allowing an authenticated administrator to crCVE-2026-88279 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9Medium 4.9
GeoVision GV-LPC2211 V1.13 copies oversized ONVIF CreateUsers username or password values into fixed stack fields, allowing an authenticated administrator to crash the ONVIF worker.
Product
GV-LPC2011/LPC2211
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record geovision.com.tw
Sep 10, 2026GeoVision GV-LPC2211 V1.13 allows an administrator-controlled WPA-PSK containing shell syntax to execute arbitrary commands as root when wireless configuration CVE-2026-88275 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9High 7.2
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled WPA-PSK containing shell syntax to execute arbitrary commands as root when wireless configuration is applied.
Product
GV-LPC2011/LPC2211
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record geovision.com.tw
Sep 10, 2026GeoVision GV-LPC2211 V1.13 allows an administrator-controlled wireless SSID containing shell syntax to execute arbitrary commands as root.CVE-2026-88274 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9High 7.2
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled wireless SSID containing shell syntax to execute arbitrary commands as root.
Product
GV-LPC2011/LPC2211
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record geovision.com.tw
Sep 10, 2026GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute arbitrary commands aCVE-2026-88273 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9High 7.2
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute arbitrary commands as root.
Product
GV-LPC2011/LPC2211
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record geovision.com.tw
Sep 10, 2026GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containing shell metacharacters to be executed as arbitrary root commands when the storedCVE-2026-88272 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9High 7.2
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containing shell metacharacters to be executed as arbitrary root commands when the stored username is later deleted.
Product
GV-LPC2011/LPC2211
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record geovision.com.tw
Sep 10, 2026GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device configuration and replace the administrator password through SSVR.CVE-2026-88271 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9High 8.8
GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device configuration and replace the administrator password through SSVR.
Product
GV-LPC2011/LPC2211
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record geovision.com.tw
Sep 10, 2026GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any firmware image is validated.CVE-2026-88270 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9Medium 6.5
GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any firmware image is validated.
Product
GV-LPC2011/LPC2211
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record geovision.com.tw
Sep 10, 2026GeoVision GV-LPC2211 V1.13 allows a Guest user to retrieve persistent device configuration containing plaintext administrative and user credentials through SSVRCVE-2026-88269 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9Medium 6.5
GeoVision GV-LPC2211 V1.13 allows a Guest user to retrieve persistent device configuration containing plaintext administrative and user credentials through SSVR.
Product
GV-LPC2011/LPC2211
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record geovision.com.tw
May 3, 2026Multiple reflected cross-site scripting (xss) vulnerabilities exist in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 1.10.CVE-2026-7371 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9High 7.4
Multiple reflected cross-site scripting (xss) vulnerabilities exist in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted malicious url can lead to an arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability. Reflected XXS via the error message for requesting non-existing page.
Product
GV-LPC2011/LPC2211
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com geovision.com.tw
May 3, 2026A privilege escalation vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10.CVE-2026-42368 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9Critical 9.9
A privilege escalation vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted HTTP request can lead to execute priviledged operation. An attacker can visit a webpage to trigger this vulnerability.
Product
GV-LPC2011/LPC2211
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record https geovision.com.tw
May 3, 2026A privilege escalation vulnerability exists in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 1.10.CVE-2026-42367 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9Medium 6.5
A privilege escalation vulnerability exists in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted HTTP request can lead to credentials leak. An attacker can visit a webpage to trigger this vulnerability.
Product
GV-LPC2011/LPC2211
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com geovision.com.tw
May 3, 2026Multiple reflected cross-site scripting (xss) vulnerabilities exist in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 1.10.CVE-2026-42366 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9High 7.4
Multiple reflected cross-site scripting (xss) vulnerabilities exist in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted malicious url can lead to an arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability.
Product
GV-LPC2011/LPC2211
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com geovision.com.tw
May 3, 2026A guessable session cookie vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10.CVE-2026-42365 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9High 8.6
A guessable session cookie vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted series of HTTP requests can lead to an authentication bypas. An attacker can bruteforce session cookies to trigger this vulnerability.
Product
GV-LPC2011/LPC2211
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com geovision.com.tw
May 3, 2026An os command injection vulnerability exists in the DdnsSetting.cgi functionality of GeoVision LPC2011/LPC2211 1.10.CVE-2026-42364 · Other software · GeoVision Inc. · reported by 0df08a0e-a200-4957-9bb0-084f562506f9Critical 9.9
An os command injection vulnerability exists in the DdnsSetting.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted DDNS configuration can lead to arbitrary command execution. An attacker can modify a configuration value to trigger this vulnerability.
Product
GV-LPC2011/LPC2211
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com geovision.com.tw

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.