CVE-2026-63269 LFI and GET SSRF via GStreamer and HLS playlists

LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In...

CVE-2026-63269

On Linux , LibreOffice is vulnerable to Local File Inclusion (LFI) and GET Server-Side Request Forgery (SSRF) due to how it handles linked media via GStreamer . An attacker can provide a linked HLS playlist that causes GStreamer to read local files or remote URLs during document loading, potentia...

CVE-2026-63269 LFI and GET SSRF via GStreamer and HLS playlists

LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In...

EUVD-2026-92420

LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In...

CVE-2026-63269

LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In...

CVE-2026-63269: Server-Side Request Forgery (SSRF)

LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In...

Linux Distros Unpatched Vulnerability : CVE-2026-63269

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made...

PT-2026-104816

LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In...

DEBIAN-CVE-2026-92164

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file scheme and inherits redirect handling from requests.Session without rejecting cross-protocol redirects. A remote server controlling an HTT...

CVE-2026-90816

A flaw was found in FFmpeg. A CPU exhaustion issue can occur in the HLS protocol module when handling a specially crafted HLS HTTP Live Streaming playlist due to insufficient validation of duration or targetduration parameters. This vulnerability can lead to an excessive consumption of CPU...

CVE-2026-91965 WWBN AVideo through 29.0 Broken Access Control via Live Endpoints

WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/Live/stats.json.php and plugin/Live/calendar.json.php endpoints. Unauthenticated attackers can retrieve restricted live transmission details including stream keys, titles, descriptions, owner information, and direct H...

CVE-2026-91965: Exposure of Sensitive Information to an Unauthorized Actor

WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/Live/stats.json.php and plugin/Live/calendar.json.php endpoints. Unauthenticated attackers can retrieve restricted live transmission details including stream keys, titles, descriptions, owner information, and direct H...

DEBIAN-CVE-2026-90816

A vulnerability was found in FFmpeg 8.0.x. This affects the function parseplaylist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/targetduration results in denial of service. The attack is possible to be carried out remotely...

CVE-2026-90816

A vulnerability was found in FFmpeg 8.0.x. This affects the function parseplaylist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/targetduration results in denial of service. The attack is possible to be carried out remotely...

Astra Linux – Vulnerability in ffmpeg5

A flaw was discovered in FFmpeg’s HLS demuxer. This vulnerability allows bypassing checks for unsafe file extensions and triggering arbitrary demuxers using base64-encoded data URIs, along with specific file extensions...

Astra Linux – Vulnerability in ffmpeg5

A flaw was discovered in FFmpeg’s TTY Demuxer. This vulnerability allows for potential data exfiltration through improper parsing of input files that do not comply with TTY standards in HLS playlists...

Astra Linux – Vulnerability in ffmpeg

A flaw was discovered in FFmpeg’s HLS playlist parsing. This vulnerability allows for a denial of service through a maliciously crafted HLS playlist, which triggers a null pointer dereference during initialization...

PT-2026-91456

Name of the Vulnerable Software and Affected Versions FFmpeg version 8.0.x Description A remote denial of service can be triggered through the manipulation of the duration or target duration arguments. This issue occurs within the parse playlist function located in the libavformat/hlsproto.c file...

CVE-2026-89252

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify ownership in addLiveLink.php when updating LiveLinks, allowing authenticated users to modify other users' links. A canStream user can overwrite another user's LiveLink HLS source and metadata by supplying an existing...

CVE-2026-89252 AVideo Missing Authorization in addLiveLink.php LiveLink Update

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify ownership in addLiveLink.php when updating LiveLinks, allowing authenticated users to modify other users' links. A canStream user can overwrite another user's LiveLink HLS source and metadata by supplying an existing...