CVE-2026-88287

GV-LPC2011/LPC2211 -ONVIF Discovery Probe Scopes Stack-Frame Overflow Denial of Service

GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker to corrupt stack control state and crash the discovery process.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Geovision Inc.

Products

Gv-lpc2011 Lpc2211

CVE-2026-88283

GV-LPC2011/LPC2211 - ONVIF CreateUsers Repeated-Element Stack-Frame Overflow Denial of Service

GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Geovision Inc.

Products

Gv-lpc2011 Lpc2211

CVE-2026-88281

GV-LPC2011/LPC2211 - ONVIF DeleteUsers Repeated-Element Stack Overflow Denial of Service

GeoVision GV-LPC2211 V1.13 fails to limit repeated Username elements in ONVIF DeleteUsers requests, allowing an authenticated administrator to overflow a stack array and crash the ONVIF worker.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Geovision Inc.

Products

Gv-lpc2011 Lpc2211

CVE-2026-88280

GV-LPC2011/LPC2211 - ONVIF SetUser Stack-Frame Overflow Denial of Service

GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fixed stack field, allowing an authenticated administrator to crash the ONVIF worker.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Geovision Inc.

Products

Gv-lpc2011 Lpc2211

CVE-2026-88279

GV-LPC2011/LPC2211 - ONVIF CreateUsers Username/Password Stack-Frame Overflow Denial of Service

GeoVision GV-LPC2211 V1.13 copies oversized ONVIF CreateUsers username or password values into fixed stack fields, allowing an authenticated administrator to crash the ONVIF worker.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Geovision Inc.

Products

Gv-lpc2011 Lpc2211

CVE-2026-88268

GV-LPC2011/LPC2211 - SSVR Fragment-Reassembly Stack Overflow Denial of Service

GeoVision GV-LPC2211 V1.13 contains an authenticated stack buffer overflow in SSVR fragment reassembly that allows a valid user to crash the SSVR service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Geovision Inc.

Products

Gv-lpclpc2011 2211

CVE-2026-81388

Microsoft Excel Remote Code Execution Vulnerability

Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 365 Apps Excel and 15 more

CVE-2026-78439

Microsoft Office Graphics Component Remote Code Execution Vulnerability

Stack-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Office Office 365 Office Macos 2021 and 1 more

CVE-2026-69759

Microsoft Office Word Remote Code Execution Vulnerability

Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Office 2019 and 7 more

CVE-2026-69722

Microsoft Office Word Remote Code Execution Vulnerability

Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Office 2019 and 7 more

CVE-2026-85506

FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow in ipmi-oem

ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c (idrac-info subcommand to dell get-system-info).

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Freeipmi

Products

Freeipmi

CVE-2026-77101

CommServe Stack-based Buffer Overflow

CommServe contained a stack-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Commvault Linux Microsoft

Products

Commvault Linux Kernel Windows

CVE-2026-11733

Buffer overflow vulnerability in some NETGEAR Nighthawk routers

A buffer overflow vulnerability in the listed NETGEAR models allows a device administrator to temporarily interrupt the normal operation of the affected device.

CVSS 4.0 · 1.1 Low EPSS < 1% KEV · Not listed

Vendors

Netgear

Products

Rax41 Rax41 Firmware Rax41v2 and 19 more

CVE-2026-11734

Device administrator can interrupt the normal operation of some NETGEAR Nighthawk devices.

A buffer overflow vulnerability in the listed NETGEAR models allows an authenticated admin user to cause the affected device to become temporarily unavailable.

CVSS 4.0 · 1.1 Low EPSS < 1% KEV · Not listed

Vendors

Netgear

Products

Mr70 Mr70 Firmware Mr90 and 27 more

CVE-2026-11735

Stack-based buffer overflow vulnerability in some NETGEAR Nighthawk models

A stack-based buffer overflow vulnerability affects the listed NETGEAR models allowing an authenticated admin user to make unauthorized modification to the router's software and functionality.

CVSS 4.0 · 1.9 Low EPSS < 1% KEV · Not listed

Vendors

Netgear

Products

R7000 R7000 Firmware Rax20 and 37 more

CVE-2026-86140

libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements

In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Xmlsoft

Products

Libxml2

CVE-2026-67379

Microsoft SQL Server Remote Code Execution Vulnerability

Stack-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sql Server 2019 Sql Server 2022 Sql Server 2025

CVE-2026-86296

D-Link DIR-822A udhcpcd serverpacket.c strcpy stack-based overflow

A vulnerability was determined in D-Link DIR-822A A_101. This vulnerability affects the function strcpy of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 10 Critical EPSS 2.4% KEV · Not listed

Vendors

D-link

Products

Dir-822a

CVE-2026-17259

IBM i is Affected By Multiple Vulnerabilities in Debug Server

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a stack-based buffer overflow.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2026-81738

openvpn: OpenVPN: Out-of-bounds write via crafted DOMAIN-SEARCH entries

OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-SEARCH entries

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Openvpn

Products

Openvpn