CVE-2026-82762

CVE-2026-82762 is currently a reserved candidate with no public technical details. A sighting from JVN (JVNVU99009004) confirms an announcement is pending. Monitor for updates as details are expected once publicized.

CVE-2026-82772

CVE-2026-82772 is currently a reserved placeholder with no publicly disclosed technical details. A sighting from JVN (Japan Vulnerability Notes) has been recorded, but no product, component, or impact information is available yet. Monitor for updates.

CVE-2026-82770

CVE-2026-82770 is currently in a reserved state with no publicly available technical details. The only known reference is a JVN (Japan Vulnerability Notes) listing. Action: monitor for updates as the candidate is published.

CVE-2026-82767

CVE-2026-82767 is currently a reserved candidate with no public technical details. A sighting has been logged via JVN (Japan Vulnerability Notes), indicating an associated advisory exists, but no affected product, root cause, or impact is yet disclosed. Action: monitor for updates as details are ...

CVE-2026-82768

CVE-2026-82768 is currently a reserved candidate with no public technical details provided. A sighting referencing JVN exists, but no affected product, root cause, or impact is yet disclosed. Monitor for updates as the entry is published.

CVE-2026-82771

CVE-2026-82771 is currently a reserved candidate with no public technical details yet. A sighting on the Japan Vulnerability Notes (JVN) indicates it is being tracked, but affected products, root cause, and impact are not provided. Action: monitor for updates as details are published.

CVE-2026-82769

CVE-2026-82769 is currently in reserved status with no publicly available technical details. A JVN sighting exists, but the affected product, root cause, and impact are not yet disclosed. Monitor for updates as details are expected upon public announcement.

CVE-2026-82766

CVE-2026-82766 is currently a reserved candidate with no publicly disclosed technical details. The only connected data is a JVN sighting. Action: monitor for updates when details are published.

CVE-2026-82765

CVE-2026-82765 is currently a reserved candidate with no public technical details available. The only linked reference points to a JVN entry. Monitor for updates when the candidate is publicized.

CVE-2026-82764

CVE-2026-82764 is currently a reserved candidate with no public technical details. JVN sightings exist but lack product or impact specifics. Monitor for updates as the candidate is finalized.

CVE-2026-82763

CVE-2026-82763 is currently reserved with no publicly available technical details. A JVN sighting has been recorded, but no product, root cause, or impact information is yet provided. Monitor for future updates.

CVE-2026-82796

CVE-2026-82796 is currently a reserved candidate with no public technical details. A sighting from JVN (JVNVU97753461) has been recorded, but no product, root cause, or impact information is yet available. Action: monitor for updates.

CVE-2026-82795

CVE-2026-82795 is currently reserved with no public technical details yet. A JVN sighting exists, but no affected product, component, or impact is described. Monitor for updates when the vendor publishes the full advisory.

CVE-2026-82794

CVE-2026-82794 is currently a reserved candidate with no public technical details available in the provided documents. A sighting reference to JVN (JVNVU97753461) exists but no product, root cause, or impact information is yet published. Action: monitor for updates once the reserving organization...

CVE-2026-88264

crun , a container runtime, is affected by a /dev/console symlink-follow flaw (CVE-2026-88264). When the container configuration does not assign a dedicated mount to /dev, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fall...

CVE-2026-13745

CVE-2026-13745 is an arbitrary code execution vulnerability in Gemini CLI and its associated GitHub Action (google-github-actions/run-gemini-cli). An unprivileged attacker can exploit untrusted local .env files that override the GEMINI_CLI_HOME environment variable to gain code execution within t...

CVE-2026-88290

GeoVision GV-LPC2211 V1.14 (260903) is affected by an unauthenticated resource-exhaustion vulnerability in its VLSVR service. Remote clients can declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, leading to exhaustion of memory, connection, and worker resources . The ...

CVE-2026-88289

GeoVision GV-LPC2211 V1.14 (260903) (also referenced as GV-LPC2011) is affected by multiple pre-authentication stack buffer overflows in its VLSVR request handlers . The root cause is a failure to validate attacker-controlled variable-length fields before copying them into fixed-size stack buffer...

CVE-2026-88288

GeoVision GV-LPC2211 (also listed as GV-LPC2011) version V1.13 is affected by an arbitrary file read vulnerability in the BKDownloadLink.cgi endpoint. The root cause is a failure to restrict the filename parameter supplied to the CGI script, which allows a remote user with valid web credentials t...

CVE-2026-88287

GeoVision GV-LPC2211 V1.13 (also affecting GV-LPC2011 per the title) is vulnerable to a stack-frame overflow in its ONVIF WS-Discovery implementation. The root cause is a failure to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker ...

CVE-2026-84042

crun is a lightweight OCI container runtime. This flaw affects builds that include libkrun with passt networking enabled (krun.use_passt). When a container is started rootful , crun can execute an attacker-controlled payload embedded in the container image with host root privileges , effectively ...

CVE-2026-88286

GeoVision GV-LPC2211 V1.13 (also referenced as GV-LPC2011) contains a denial of service vulnerability in its PTZ connection-state management . An unauthenticated remote client can exploit improper handling of PTZ connection state to block the accept loop , preventing new PTZ connections and effec...

CVE-2026-88285

GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service that requires no authentication, allowing remote clients to retrieve PTZ information and issue PTZ or raw serial commands. The underlying cause is the lack of an authentication mechanism on the service itself. The CVSS v3...

CVE-2026-88284

GeoVision GV-LPC2211 version 1.13 fails to limit repeated User elements in ONVIF SetUser requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker, resulting in a denial of service. The vulnerability is scored CVSS 4.9 (Medium) with an attack ve...

CVE-2026-88283

GeoVision GV-LPC2211 V1.13 (and GV-LPC2011) is affected by a stack-frame overflow in the ONVIF CreateUsers service. The vulnerability is caused by a failure to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to overwrite stack control state and ...

CVE-2026-88282

GeoVision GV-LPC2211 (LPC series) V1.13 contains a stored command injection vulnerability in its FTP username field. An administrator who sets an FTP username containing shell metacharacters can trigger arbitrary root command execution during a subsequent FTP-account update operation. The vulnera...

CVE-2026-88281

GeoVision GV-LPC2211 V1.13 contains a stack overflow vulnerability in its ONVIF DeleteUsers endpoint. The failure to limit repeated Username elements in a DeleteUsers request allows an authenticated administrator to overflow a stack array and crash the ONVIF worker process, resulting in a denial ...

CVE-2026-88280

GeoVision GV-LPC2211 V1.13 (also referenced as GV-LPC2011) is vulnerable to a stack-frame overflow in the ONVIF SetUser function. An oversized ONVIF SetUser password is copied into a fixed-size stack buffer, allowing an authenticated administrator to crash the ONVIF worker process, resulting in a...

CVE-2026-88279

GeoVision GV-LPC2211 V1.13 is affected by a stack-frame overflow in its ONVIF CreateUsers service. Oversized username or password values are copied into fixed stack fields, allowing an authenticated administrator to crash the ONVIF worker, resulting in a denial of service on the device's ONVIF fu...

CVE-2026-88278

GeoVision GV-LPC2211 V1.13 (also referenced as GV-LPCLPC2011/2211) contains a vulnerability in its ONVIF WS-Security implementation. The product fails to enforce UsernameToken freshness or nonce reuse protection , allowing an attacker to capture a PasswordDigest token and replay it for subsequent...

CVE-2026-88277

GeoVision GV-LPC2211 version 1.13 is affected by a command injection vulnerability in its ONVIF interface. An authenticated ONVIF user can inject shell commands via the ConsumerReference.Address field, leading to arbitrary command execution with root privileges . The vulnerability is network-reac...

CVE-2026-88276

GeoVision GV-LPC2211 (firmware V1.13) is vulnerable to command injection via its wireless WEP Key1–Key4 fields. When an administrator sets WEP key values containing shell syntax, the device executes them as root , enabling arbitrary command execution . The CVSS 3.1 score is 7.2 (High) (AV:N/AC:L/...

CVE-2026-88275

GeoVision GV-LPC2211 (also affecting GV-LPC2011) version V1.13 contains a command injection vulnerability in its wireless configuration. An administrator can craft a WPA-PSK password containing shell syntax that, when the wireless configuration is applied, executes arbitrary commands as root . Th...

CVE-2026-88274

GeoVision GV-LPC2211 (V1.13), a wireless camera, is affected by a command injection vulnerability in its wireless SSID configuration. An administrator who sets a wireless SSID containing shell syntax can execute arbitrary commands as root on the device. The vulnerability requires high privileges ...

CVE-2026-88273

GeoVision GV-LPC2211 (version V1.13 ) is affected by a command injection vulnerability in its PPPoE username configuration. An administrator-controlled PPPoE username value can escape a sourced shell configuration assignment , allowing the execution of arbitrary commands as root . The attack requ...

CVE-2026-44950

CVE-2026-44950 is a heap buffer overflow in the libXfont2 font-server client (fs_read_glyphs() in src/fc/fserve.c). The function validates each glyph's source slice individually but never checks whether the cumulative destination offset exceeds the allocated buffer size. A malicious font server c...

CVE-2026-88272

GeoVision GV-LPC2211 V1.13 is affected by a stored command injection vulnerability in the administrator username field. When an administrator creates a username containing shell metacharacters , those characters are later interpreted as arbitrary root-level commands at the time the stored usernam...

CVE-2026-88271

GeoVision GV-LPC2211 V1.13 (and GV-LPC2011) is vulnerable to a Guest-level configuration overwrite via the SSVR service. A user with Guest privileges can overwrite the device configuration and replace the administrator password , effectively gaining full administrative control. The CNA-assigned C...

CVE-2026-88270

GeoVision GV-LPC2211 (and GV-LPC2011, per the title) V1.13 is affected by a Denial of Service vulnerability in the SSVR (Secure Service Virtual Router) component. A user with Guest privileges can trigger the firmware-upgrade mode and cause live services to be disrupted before any firmware image i...

CVE-2026-88269

GeoVision GV-LPC2211 V1.13 (also referenced as GV-LPC2011) is affected by a credential disclosure vulnerability in its SSVR service. A Guest-level user can retrieve the persistent device configuration, which contains plaintext administrative and user credentials , leading to a high-impact confide...

CVE-2026-88268

GeoVision GV-LPC2211 (and GV-LPC2011 ) version V1.13 is affected by an authenticated stack buffer overflow in the SSVR fragment reassembly mechanism. A valid user can exploit this flaw to crash the SSVR service , resulting in a denial of service. The CVSS v3.1 score is 6.5 (MEDIUM) with a network...

CVE-2026-59679

CVE-2026-59679 affects the libXfont2 font-server client (X.Org X11). The function fs_read_glyphs() in src/fc/fserve.c indexes the encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated based on num_extents from the separate FS_QueryXExtents16 reply—two fi...

CVE-2026-7188

Armiya Information Technologies Ltd. Co. Access Control System versions before Version 2 are affected by an SQL injection vulnerability caused by improper neutralization of special elements used in an SQL command. The vulnerability is rated CRITICAL (CVSS 9.8) with a network attack vector, low co...

CVE-2026-80354

Apache Camel K is affected by an authorization bypass in the Builder trait mavenProfiles ValueSources component. The vulnerability in custom resource resolution allows a tenant to reference secrets by name in the operator namespace, potentially exposing secrets belonging to other tenants or opera...

CVE-2026-80351

Apache Camel K is affected by an eval injection vulnerability caused by improper neutralization of directives in dynamically evaluated Maven configuration . Tenant-controlled repository content can influence code execution within the operator pod , potentially allowing tenants to execute arbitrar...

CVE-2026-80352

A YAML injection in Apache Camel K 's custom resource configuration—specifically in the Master trait serviceAccountName field—allows an authorized CR author to inject arbitrary Kubernetes objects, potentially enabling unauthorized resource creation with the privileges of the operator . The vulner...

CVE-2026-88770

Keycloak 's Device Authorization Grant flow contains a flaw where the token redemption process does not verify whether a user account is currently locked due to brute-force protection . An attacker holding an active session for a locked account can complete the device login flow and obtain new se...

CVE-2026-88763

A flaw in the skupper-router component of Red Hat Service Interconnect allows denial of service via unbounded recursion in the AMQP field parser . When the router processes a specially crafted network message, the lack of recursion bounds can exhaust stack memory, causing a crash and disrupting t...

CVE-2026-82582

An authorization bypass vulnerability in SHIRASAGI groupware allows an attacker with low privileges to retrieve files from the shared file feature by manipulating a user-controlled key. The root cause is the reliance on a user-supplied key for access control in the shared file module, enabling un...

CVE-2026-81635

SHIRASAGI by Security Science is affected by a cross-site scripting (XSS) vulnerability that may allow an attacker to execute arbitrary script in the web browser of a user who accesses a website using the product. The CNA (JPCERT) assigns a MEDIUM severity (CVSS 3.0 base score 5.4; CVSS 4.0 base ...