High severity · published Oct 2, 2026
CVE-2026-103098
GV-Eye Sensitive information exposure in URL query parameter Vulnerability
7.5
CVSS
0.2%
EPSS
No
On KEV
Description
Transmission of a sensitive key in the URL
over an unencrypted HTTP connection. The
request is sent over HTTP rather than HTTPS, meaning the key is transmitted in
plaintext across the network. An attacker with the ability to monitor network
traffic could intercept the request and obtain the key
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GV
GV-Eye · GeoVision Inc.
V3.6.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-103098
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-103098
vendor-advisory
https://www.geovision.com.tw/cyber_security.php
More from GV-Eye
7.5
CVE-2026-103097
GV-Eye Relay Payment API Key Vulnerability
7.5
CVE-2026-103096
GV-Eye Hardcoded API Key Vulnerability