CVE-2026-124600

CriticalCVSS 10.0/10Last modified Nov 12, 2026

Description

GV-Face transmits sensitive user credentials and related authentication data over unencrypted HTTP connections. The HTTP traffic is not encrypted, an attacker with the ability to intercept network traffic.

Metrics

CVSS 4.0 10.0/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-319

Affected software

No affected versions have been published.

Timeline

Published: Nov 10, 2026
Last modified: Nov 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1246016.2An API key is hardcoded and retrievable from the GV-Access package. Since Android applications can be reverse engineered, embedding sensitiv CVE-2026-1246026.2The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Access application package. Because An CVE-2026-1246036.2An API key is hardcoded and retrievable from the GV-Cloud application package. Since Android applications can be reverse engineered, embeddi CVE-2026-1246046.2The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Cloud application package. Because And CVE-2026-124616.5Out of bounds read in WebRTC in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to obtain potentially sensitive i CVE-2026-124627.5Use after free in Media in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to execu CVE-2026-1246217.4A vulnerability was determined in kongxin-github Java_Library_Management_System up to 70a6eb6b96fe64575d8051f1a59055bfc5dc5885. This affects CVE-2026-1246225.3A vulnerability was identified in olivier-ls PHP-FTS up to 1.1.3. This impacts the function TrigramIndex::open of the file Storage.php. Such CVE-2026-1246234.7A security flaw has been discovered in PipraPay 3.0.0. Affected is the function system-settings-import of the file /sumo166/CVE-apply/blob/m CVE-2026-1246245.3A weakness has been identified in PipraPay 3.0.0. Affected by this vulnerability is the function hash_hmac of the file pp-content/pp-include CVE-2026-1246256.3A security vulnerability has been detected in PipraPay 3.0.0. Affected by this issue is the function deleteData of the file pp-content/pp-in CVE-2026-1246278.7In affected versions of Octopus Server, incorrect validation of the external identity linked to a newly registered user could result in that