Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-73763 | high | 8.8 | No | A vulnerability exists in a management component that could allow an unauthenticated adjacent attacker to execute arbitrary commands. Succes... | 2026-09-10 |
| CVE-2026-73778 | critical | 9.8 | No | A vulnerability exists in the Credential Manager component that may allow for unauthorized administrative access. An unauthenticated remote... | 2026-09-10 |
| CVE-2026-8323 | critical | 9.3 | No | URL redirection to untrusted site ('open redirect') vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows F... | 2026-09-10 |
| CVE-2026-88898 | medium | 6.5 | No | AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against the workspace in the bulk publish endpoint path, allowing aut... | 2026-09-10 |
| CVE-2026-88874 | high | 7.5 | No | AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) does not enforce the Live stream password check on the... | 2026-09-10 |
| CVE-2026-88869 | critical | 9.3 | No | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the AD_Server plugin'... | 2026-09-10 |
| CVE-2026-88859 | medium | 6.3 | No | A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoof... | 2026-09-10 |
| CVE-2026-88290 | high | 7.5 | No | GeoVision GV-LPC2211 V1.14 (260903) allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking... | 2026-09-10 |
| CVE-2026-88289 | high | 7.5 | No | GeoVision GV-LPC2211 V1.14 (260903) fails to validate attacker-controlled variable-length fields before copying them into fixed-size stack b... | 2026-09-10 |
| CVE-2026-88288 | medium | 6.5 | No | GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials... | 2026-09-10 |
| CVE-2026-88287 | high | 7.5 | No | GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remot... | 2026-09-10 |
| CVE-2026-88286 | high | 7.5 | No | GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remote client to block the accept loop and p... | 2026-09-10 |
| CVE-2026-88285 | critical | 9.4 | No | GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication, allowing remote clients to retrieve PTZ... | 2026-09-10 |
| CVE-2026-88284 | medium | 4.9 | No | GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF SetUser requests, allowing an authenticated administrator to overw... | 2026-09-10 |
| CVE-2026-88283 | medium | 4.9 | No | GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to o... | 2026-09-10 |
| CVE-2026-88282 | high | 7.2 | No | GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root... | 2026-09-10 |
| CVE-2026-88281 | medium | 4.9 | No | GeoVision GV-LPC2211 V1.13 fails to limit repeated Username elements in ONVIF DeleteUsers requests, allowing an authenticated administrator... | 2026-09-10 |
| CVE-2026-88280 | medium | 4.9 | No | GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fixed stack field, allowing an authenticated administrator to c... | 2026-09-10 |
| CVE-2026-88279 | medium | 4.9 | No | GeoVision GV-LPC2211 V1.13 copies oversized ONVIF CreateUsers username or password values into fixed stack fields, allowing an authenticated... | 2026-09-10 |
| CVE-2026-88278 | critical | 9.8 | No | GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection, allowing a captured PasswordDiges... | 2026-09-10 |