Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 51

Export CSV
CVE-2026-124602

Hardcoded RSA Private Key and Public Key Exposure in GV-Access Android Application v1.6.1

The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Access application package. Because Android applications can be extracted and reverse engineered, storing private cryptographic keys directly inside the client application may allow an attacker to recover the keys and potentially use them to impersonate the application, decrypt protected data, or generate unauthorized cryptographic operations.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Geovision Geovision Inc.
Products
Gv-access Gv-access
CVE-2026-124598

Hardcoded API Key Discovered in GV-Face Android Application v2.2.1

An API key is hardcoded and retrievable from the GV-Face package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Geovision Geovision Inc.
Products
Gv-face Gv-face
CVE-2026-124599

Hardcoded RSA Private Key and Public Key Exposure in GV-Face Android Application v2.2.1

The RSA cryptographic key material, including a private key and public key, is embedded within the application package. Because Android applications can be extracted and reverse engineered, storing private cryptographic keys directly inside the client application may allow an attacker to recover the keys and potentially use them to impersonate the application, decrypt protected data, or generate unauthorized cryptographic operations.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Geovision Geovision Inc.
Products
Gv-face Gv-face
CVE-2026-124600

Unencrypted HTTP Traffic Exposing Sensitive User Credentials in GV-Face Android Application v2.2.1

GV-Face transmits sensitive user credentials and related authentication data over unencrypted HTTP connections. The HTTP traffic is not encrypted, an attacker with the ability to intercept network traffic.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Geovision Geovision Inc.
Products
Gv-face Gv-face
CVE-2026-124604

Hardcoded RSA Private Key and Public Key Exposure in GV-Cloud Android Application v1.5.1

The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Cloud application package. Because Android applications can be extracted and reverse engineered, storing private cryptographic keys directly inside the client application may allow an attacker to recover the keys and potentially use them to impersonate the application, decrypt protected data, or generate unauthorized cryptographic operations.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Geovision Geovision Inc.
Products
Gv-cloud Gv-cloud
CVE-2026-124603

Hardcoded API Key Discovered in GV-Cloud Android Application v1.5.1

An API key is hardcoded and retrievable from the GV-Cloud application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Geovision Geovision Inc.
Products
Gv-cloud Gv-cloud
CVE-2026-124601

Hardcoded API Key Discovered in GV-Access Android Application v1.6.1

An API key is hardcoded and retrievable from the GV-Access package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Geovision Geovision Inc.
Products
Gv-access Gv-access
CVE-2026-103097

GV-Eye Relay Payment API Key Vulnerability

An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Geovision Geovision Inc.
Products
Gv-eye Gv-eye
CVE-2026-103096

GV-Eye Hardcoded API Key Vulnerability

API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Geovision Geovision Inc.
Products
Gv-eye Gv-eye
CVE-2026-103098

GV-Eye Sensitive information exposure in URL query parameter Vulnerability

Transmission of a sensitive key in the URL over an unencrypted HTTP connection.  The request is sent over HTTP rather than HTTPS, meaning the key is transmitted in plaintext across the network. An attacker with the ability to monitor network traffic could intercept the request and obtain the key

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Geovision Geovision Inc.
Products
Gv-eye Gv-eye
CVE-2026-18753

Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-ASManager)

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Geovision
Products
Gv-asmanager
CVE-2026-16519

GeoVision GV-IP Device Utility DLL Search Order Hijacking Vulnerability

A DLL hijacking vulnerability exists in the GeoVision GV-IP Device Utility desktop application. The application loads one or more dynamic-link libraries (DLLs) from an unsafe search path, allowing a local attacker to place a malicious DLL in a location searched before the legitimate library location.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Geovision Geovision Inc.
Products
Gv-ip Device Utility Gv-ip Device Utility
CVE-2026-57873

GV-LPC2011/LPC2211 - unauthorized null pointer dereference vulnerability (IEEE8021x_upload.cgi)

An unauthenticated NULL pointer dereference vulnerability exists in IEEE8021x_upload.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by improper validation of multipart upload headers when processing certificate-related upload fields. A remote attacker may exploit this vulnerability by sending a malformed multipart request, causing the affected CGI process to crash and resulting in a denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Geovision Geovision Inc.
Products
Gv-lpc2011 Gv-lpclpc2011 2211
CVE-2026-57874

GV-LPC2011/LPC2211 - unauthorized buffer overflow vulnerability (IEEE8021x_upload.cgi)

An unauthenticated buffer overflow vulnerability exists in IEEE8021x_upload.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient bounds checking when parsing filename values in multipart upload data. A remote attacker may exploit this vulnerability by sending a crafted upload request with overly long input, causing memory corruption and resulting in a denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Geovision Geovision Inc.
Products
Gv-lpc2011 Gv-lpclpc2011 2211
CVE-2026-57875

GV-LPC2011/LPC2211 - unauthorized null pointer dereference vulnerability in packet parsing

An unauthenticated NULL pointer dereference vulnerability exists in the HTTP request parsing logic of multiple CGI components in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by improper validation of required HTTP request metadata before it is used by the affected components. A remote attacker may exploit this vulnerability by sending a specially crafted HTTP request, causing the affected process to crash and resulting in a denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Geovision Geovision Inc.
Products
Gv-lpc2011 Gv-lpclpc2011 2211
CVE-2026-57876

GV-LPC2011/LPC2211 - unauthorized out-of-bounds writing vulnerability (onvif.cgi)

An unauthenticated out-of-bounds write vulnerability exists in onvif.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient bounds checking when processing HTTP request body data. A remote attacker may exploit this vulnerability by sending a crafted request with excessive input, causing memory corruption and resulting in a denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Geovision Geovision Inc.
Products
Gv-lpc2011 Gv-lpclpc2011 2211
CVE-2026-57879

GV-LPC2011/LPC2211 - unauthorized buffer overflow via AuthMode/AuthValue path (ssvr)

An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient bounds checking when processing RTSP custom authentication data. A remote attacker may exploit this vulnerability by sending a crafted RTSP request, resulting in memory corruption, denial of service, or potentially arbitrary code execution.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Geovision Geovision Inc.
Products
Gv-lpc2011 Gv-lpclpc2011 2211
CVE-2023-3638

GeoVision GV-ADR2701 Improper Authentication

In GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Geovision
Products
Gv-adr2701 Gv-adr2701 Firmware