https://vulnogram.org/ Most recent CVEs assigned by GeoVision Inc. (gv). https://vulnogram.org/seaview/icons/gv.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-108984 https://vulnogram.org/CVE-2026-108984 A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe . High Network Exploitable Mon, 19 Oct 2026 00:52:19 GMT https://vulnogram.org/CVE-2026-108983 https://vulnogram.org/CVE-2026-108983 A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe . Critical Network Exploitable Mon, 19 Oct 2026 00:51:53 GMT https://vulnogram.org/CVE-2026-107437 https://vulnogram.org/CVE-2026-107437 GV-E-Map Server V18.2.0A contains a plaintext database password embedded within an application component. The credential can be recovered through static analysis of the distributed binary and may also be exposed in process memory during runtime. Medium Mon, 12 Oct 2026 02:52:48 GMT https://vulnogram.org/CVE-2026-103098 https://vulnogram.org/CVE-2026-103098 Transmission of a sensitive key in the URL over an unencrypted HTTP connection. The request is sent over HTTP rather than HTTPS, meaning the key is transmitted in plaintext across the network. An attacker with the ability to monitor network traffic c… High Network Exploitable Fri, 02 Oct 2026 00:15:17 GMT https://vulnogram.org/CVE-2026-103097 https://vulnogram.org/CVE-2026-103097 An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the… High Network Exploitable Fri, 02 Oct 2026 00:14:46 GMT https://vulnogram.org/CVE-2026-103096 https://vulnogram.org/CVE-2026-103096 API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key… High Network Exploitable Fri, 02 Oct 2026 00:14:08 GMT https://vulnogram.org/CVE-2026-92838 https://vulnogram.org/CVE-2026-92838 A DLL hijacking vulnerability exists in the GeoVision GV-Remote E-Map desktop application. The application loads one or more dynamic-link libraries (DLLs) from an unsafe search path, allowing a local attacker to place a malicious DLL in a location se… High Thu, 17 Sep 2026 01:50:05 GMT https://vulnogram.org/CVE-2026-88290 https://vulnogram.org/CVE-2026-88290 GeoVision GV-LPC2211 V1.14 (260903) allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, allowing remote exhaustion of memory, connection, and worker resources. High Network Exploitable Thu, 10 Sep 2026 08:26:16 GMT https://vulnogram.org/CVE-2026-88289 https://vulnogram.org/CVE-2026-88289 GeoVision GV-LPC2211 V1.14 (260903) fails to validate attacker-controlled variable-length fields before copying them into fixed-size stack buffers in multiple VLSVR request handlers, allowing an unauthenticated remote attacker to crash the VLSVR serv… High Network Exploitable Thu, 10 Sep 2026 08:25:41 GMT https://vulnogram.org/CVE-2026-88288 https://vulnogram.org/CVE-2026-88288 GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary files accessible to the root-run web service. Medium Thu, 10 Sep 2026 08:25:21 GMT https://vulnogram.org/CVE-2026-88287 https://vulnogram.org/CVE-2026-88287 GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker to corrupt stack control state and crash the discovery process. High Network Exploitable Thu, 10 Sep 2026 08:24:57 GMT https://vulnogram.org/CVE-2026-88286 https://vulnogram.org/CVE-2026-88286 GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remote client to block the accept loop and prevent new PTZ connections. High Network Exploitable Thu, 10 Sep 2026 08:24:36 GMT https://vulnogram.org/CVE-2026-88285 https://vulnogram.org/CVE-2026-88285 GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication, allowing remote clients to retrieve PTZ information and issue PTZ or raw serial commands. Critical Network Exploitable Thu, 10 Sep 2026 08:24:15 GMT https://vulnogram.org/CVE-2026-88284 https://vulnogram.org/CVE-2026-88284 GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF SetUser requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker. Medium Thu, 10 Sep 2026 08:23:57 GMT https://vulnogram.org/CVE-2026-88283 https://vulnogram.org/CVE-2026-88283 GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker. Medium Thu, 10 Sep 2026 08:23:36 GMT https://vulnogram.org/CVE-2026-88282 https://vulnogram.org/CVE-2026-88282 GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update. High Thu, 10 Sep 2026 08:23:11 GMT https://vulnogram.org/CVE-2026-88281 https://vulnogram.org/CVE-2026-88281 GeoVision GV-LPC2211 V1.13 fails to limit repeated Username elements in ONVIF DeleteUsers requests, allowing an authenticated administrator to overflow a stack array and crash the ONVIF worker. Medium Thu, 10 Sep 2026 08:22:48 GMT https://vulnogram.org/CVE-2026-88280 https://vulnogram.org/CVE-2026-88280 GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fixed stack field, allowing an authenticated administrator to crash the ONVIF worker. Medium Thu, 10 Sep 2026 08:22:34 GMT https://vulnogram.org/CVE-2026-88279 https://vulnogram.org/CVE-2026-88279 GeoVision GV-LPC2211 V1.13 copies oversized ONVIF CreateUsers username or password values into fixed stack fields, allowing an authenticated administrator to crash the ONVIF worker. Medium Thu, 10 Sep 2026 08:22:12 GMT https://vulnogram.org/CVE-2026-88278 https://vulnogram.org/CVE-2026-88278 GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection, allowing a captured PasswordDigest token to be replayed for subsequent ONVIF operations. Critical Network Exploitable Thu, 10 Sep 2026 08:21:58 GMT https://vulnogram.org/CVE-2026-88277 https://vulnogram.org/CVE-2026-88277 GeoVision GV-LPC2211 V1.13 allows an authenticated ONVIF user to inject shell commands through ConsumerReference.Address and execute arbitrary commands as root. High Thu, 10 Sep 2026 08:21:43 GMT https://vulnogram.org/CVE-2026-88276 https://vulnogram.org/CVE-2026-88276 GeoVision GV-LPC2211 V1.13 allows administrator-controlled WEP key values containing shell syntax to execute arbitrary commands as root. High Thu, 10 Sep 2026 08:21:28 GMT https://vulnogram.org/CVE-2026-88275 https://vulnogram.org/CVE-2026-88275 GeoVision GV-LPC2211 V1.13 allows an administrator-controlled WPA-PSK containing shell syntax to execute arbitrary commands as root when wireless configuration is applied. High Thu, 10 Sep 2026 08:20:58 GMT https://vulnogram.org/CVE-2026-88274 https://vulnogram.org/CVE-2026-88274 GeoVision GV-LPC2211 V1.13 allows an administrator-controlled wireless SSID containing shell syntax to execute arbitrary commands as root. High Thu, 10 Sep 2026 08:20:27 GMT https://vulnogram.org/CVE-2026-88273 https://vulnogram.org/CVE-2026-88273 GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute arbitrary commands as root. High Thu, 10 Sep 2026 08:20:07 GMT https://vulnogram.org/CVE-2026-88272 https://vulnogram.org/CVE-2026-88272 GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containing shell metacharacters to be executed as arbitrary root commands when the stored username is later deleted. High Thu, 10 Sep 2026 08:19:47 GMT https://vulnogram.org/CVE-2026-88271 https://vulnogram.org/CVE-2026-88271 GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device configuration and replace the administrator password through SSVR. High Thu, 10 Sep 2026 08:19:30 GMT https://vulnogram.org/CVE-2026-88270 https://vulnogram.org/CVE-2026-88270 GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any firmware image is validated. Medium Thu, 10 Sep 2026 08:19:10 GMT https://vulnogram.org/CVE-2026-88269 https://vulnogram.org/CVE-2026-88269 GeoVision GV-LPC2211 V1.13 allows a Guest user to retrieve persistent device configuration containing plaintext administrative and user credentials through SSVR. Medium Thu, 10 Sep 2026 08:18:50 GMT https://vulnogram.org/CVE-2026-88268 https://vulnogram.org/CVE-2026-88268 GeoVision GV-LPC2211 V1.13 contains an authenticated stack buffer overflow in SSVR fragment reassembly that allows a valid user to crash the SSVR service. Medium Thu, 10 Sep 2026 08:18:21 GMT https://vulnogram.org/CVE-2026-18755 https://vulnogram.org/CVE-2026-18755 A DLL hijacking vulnerability in GeoVision GV-ASManager allows a local attacker with write access to an unsafe search directory to execute arbitrary code. By placing a crafted dynamic-link library (DLL) file into the application search path prior to… High Tue, 04 Aug 2026 07:09:50 GMT https://vulnogram.org/CVE-2026-18754 https://vulnogram.org/CVE-2026-18754 The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabl… Critical Network Exploitable Tue, 04 Aug 2026 07:09:17 GMT https://vulnogram.org/CVE-2026-18753 https://vulnogram.org/CVE-2026-18753 The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabl… Critical Network Exploitable Tue, 04 Aug 2026 07:08:40 GMT https://vulnogram.org/CVE-2026-16519 https://vulnogram.org/CVE-2026-16519 A DLL hijacking vulnerability exists in the GeoVision GV-IP Device Utility desktop application. The application loads one or more dynamic-link libraries (DLLs) from an unsafe search path, allowing a local attacker to place a malicious DLL in a locati… High Fri, 24 Jul 2026 07:05:02 GMT https://vulnogram.org/CVE-2026-57278 https://vulnogram.org/CVE-2026-57278 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities o… High Network Exploitable Thu, 02 Jul 2026 02:26:09 GMT https://vulnogram.org/CVE-2026-57277 https://vulnogram.org/CVE-2026-57277 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities o… High Network Exploitable Thu, 02 Jul 2026 02:25:34 GMT https://vulnogram.org/CVE-2026-57276 https://vulnogram.org/CVE-2026-57276 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities o… High Network Exploitable Thu, 02 Jul 2026 02:25:09 GMT https://vulnogram.org/CVE-2026-57275 https://vulnogram.org/CVE-2026-57275 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities o… High Network Exploitable Thu, 02 Jul 2026 02:24:39 GMT https://vulnogram.org/CVE-2026-57274 https://vulnogram.org/CVE-2026-57274 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities o… High Network Exploitable Thu, 02 Jul 2026 02:24:11 GMT https://vulnogram.org/CVE-2026-57273 https://vulnogram.org/CVE-2026-57273 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities o… High Network Exploitable Thu, 02 Jul 2026 02:23:43 GMT https://vulnogram.org/CVE-2026-57272 https://vulnogram.org/CVE-2026-57272 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities o… High Network Exploitable Thu, 02 Jul 2026 02:22:36 GMT https://vulnogram.org/CVE-2026-57271 https://vulnogram.org/CVE-2026-57271 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities o… High Network Exploitable Thu, 02 Jul 2026 02:21:46 GMT https://vulnogram.org/CVE-2026-57270 https://vulnogram.org/CVE-2026-57270 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities o… High Network Exploitable Thu, 02 Jul 2026 02:21:11 GMT https://vulnogram.org/CVE-2026-57269 https://vulnogram.org/CVE-2026-57269 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities o… High Network Exploitable Thu, 02 Jul 2026 02:20:43 GMT https://vulnogram.org/CVE-2026-57268 https://vulnogram.org/CVE-2026-57268 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities o… High Network Exploitable Thu, 02 Jul 2026 02:20:11 GMT https://vulnogram.org/CVE-2026-57267 https://vulnogram.org/CVE-2026-57267 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities o… High Network Exploitable Thu, 02 Jul 2026 02:19:40 GMT https://vulnogram.org/CVE-2026-57266 https://vulnogram.org/CVE-2026-57266 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities o… High Network Exploitable Thu, 02 Jul 2026 02:19:10 GMT https://vulnogram.org/CVE-2026-57265 https://vulnogram.org/CVE-2026-57265 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities o… High Network Exploitable Thu, 02 Jul 2026 02:18:47 GMT https://vulnogram.org/CVE-2026-57264 https://vulnogram.org/CVE-2026-57264 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities o… High Network Exploitable Thu, 02 Jul 2026 02:18:12 GMT https://vulnogram.org/CVE-2026-13132 https://vulnogram.org/CVE-2026-13132 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities o… High Network Exploitable Thu, 02 Jul 2026 02:17:15 GMT