https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-7371.htmlhttps://patchthecve.com/cve/CVE-2026-7371.htmlMon, 26 Oct 2026 20:10:00 +0000HIGH 7.4: Multiple reflected cross-site scripting (xss) vulnerabilities exist in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted malicious url can lead to an arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerabilithttps://patchthecve.com/cve/CVE-2026-42368.htmlhttps://patchthecve.com/cve/CVE-2026-42368.htmlMon, 26 Oct 2026 20:10:00 +0000CRITICAL 9.9: A privilege escalation vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted HTTP request can lead to execute priviledged operation. An attacker can visit a webpage to trigger this vulnerability.https://patchthecve.com/cve/CVE-2026-42367.htmlhttps://patchthecve.com/cve/CVE-2026-42367.htmlMon, 26 Oct 2026 20:10:00 +0000MEDIUM 6.5: A privilege escalation vulnerability exists in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted HTTP request can lead to credentials leak. An attacker can visit a webpage to trigger this vulnerability.https://patchthecve.com/cve/CVE-2026-42366.htmlhttps://patchthecve.com/cve/CVE-2026-42366.htmlMon, 26 Oct 2026 20:10:00 +0000HIGH 7.4: Multiple reflected cross-site scripting (xss) vulnerabilities exist in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted malicious url can lead to an arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerabilithttps://patchthecve.com/cve/CVE-2026-42365.htmlhttps://patchthecve.com/cve/CVE-2026-42365.htmlMon, 26 Oct 2026 20:10:00 +0000HIGH 8.6: A guessable session cookie vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted series of HTTP requests can lead to an authentication bypas. An attacker can bruteforce session cookies to trigger this vulnerability.https://patchthecve.com/cve/CVE-2026-42364.htmlhttps://patchthecve.com/cve/CVE-2026-42364.htmlMon, 26 Oct 2026 20:10:00 +0000CRITICAL 9.9: An os command injection vulnerability exists in the DdnsSetting.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted DDNS configuration can lead to arbitrary command execution. An attacker can modify a configuration value to trigger this vulnerability.