CVE-2026-88270

GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any firmware image is validated...

CVE-2026-88270 GV-LPC2011/LPC2211 - SSVR Guest Firmware-Mode Pre-Validation Service Teardown Denial of Service

GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any firmware image is validated...

CVE-2026-88270

GeoVision GV-LPC2211 (and GV-LPC2011, per the title) V1.13 is affected by a Denial of Service vulnerability in the SSVR (Secure Service Virtual Router) component. A user with Guest privileges can trigger the firmware-upgrade mode and cause live services to be disrupted before any firmware image i...

CVE-2026-88270 GV-LPC2011/LPC2211 - SSVR Guest Firmware-Mode Pre-Validation Service Teardown Denial of Service

GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any firmware image is validated...

vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling

A vulnerability in Vim's shell script plugins sh.vim, zsh.vim, ps1.vim allows arbitrary code execution if a user selects maliciously crafted text in Visual mode and triggers a keyword lookup, due to improperly escaped shell metacharacters...

PT-2026-89311

GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any firmware image is validated...

CVE-2026-88270: Missing Authorization

GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any firmware image is validated...

PT-2026-89399

Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attackers can inject shell metacharacters through malicious package names to execute arbitrary commands as the Renovate user in...

VulnCheck KEV: CVE-2024-50340

symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the registerargvargc php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by...

github.com/gohugoio/hugo: Hugo: Cross-site scripting via unescaped HTML in Org Mode content

A flaw was found in Hugo. When processing content files mapped to the Org Mode media type, Hugo renders raw HTML export blocks and snippets without proper escaping. An attacker who can influence or supply content files can exploit this vulnerability to conduct cross-site scripting XSS, executing...

golang-fips: Golang FIPS zeroed buffer

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted...

CVE-2026-87810

Siyuan before v3.8.2 contains an information disclosure vulnerability in the POST /api/search/fullTextSearchBlock endpoint that filters private blocks from results but returns unfiltered match counts. Unauthenticated publish-mode readers can submit arbitrary search terms to learn whether matching...

CVE-2026-87810

Siyuan before v3.8.2 contains an information disclosure vulnerability in the POST /api/search/fullTextSearchBlock endpoint. While the endpoint filters private blocks from returned results, it returns unfiltered match counts , allowing unauthenticated publish-mode readers to submit arbitrary searc...

CVE-2026-87810 Siyuan before v3.8.2 Information Disclosure via fullTextSearchBlock

Siyuan before v3.8.2 contains an information disclosure vulnerability in the POST /api/search/fullTextSearchBlock endpoint that filters private blocks from results but returns unfiltered match counts. Unauthenticated publish-mode readers can submit arbitrary search terms to learn whether matching...

CVE-2026-87810 Siyuan before v3.8.2 Information Disclosure via fullTextSearchBlock

Siyuan before v3.8.2 contains an information disclosure vulnerability in the POST /api/search/fullTextSearchBlock endpoint that filters private blocks from results but returns unfiltered match counts. Unauthenticated publish-mode readers can submit arbitrary search terms to learn whether matching...

CVE-2026-87810 Siyuan before v3.8.2 Information Disclosure via fullTextSearchBlock

Siyuan before v3.8.2 contains an information disclosure vulnerability in the POST /api/search/fullTextSearchBlock endpoint that filters private blocks from results but returns unfiltered match counts. Unauthenticated publish-mode readers can submit arbitrary search terms to learn whether matching...

CVE-2026-87653

A flaw was found in chromium-browser. A remote attacker could exploit this vulnerability by crafting a malicious HTML page. This could lead to user interface UI misrepresentation in FullScreen mode, allowing the attacker to spoof UI elements...

openSUSE 16 Security Update : rpcbind (openSUSE-SU-2026:21765-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21765-1 advisory. This update for rpcbind fixes the following issue: - CVE-2026-16461: stack buffer overflow in rpcinfo rpcbdump short-mode version-list formatting...

Security Advisory 0177

Security Advisory 0177 . CSAF PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 17, 2026 | Moved 7368X4 Series to Affected 1.2 | September 22, 2026 | CSAF JSON file added The CVE-ID tracking this issue: CVE-2026-77190...

PT-2026-89138

An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... ...