1286 matches found
EUVD-2026-63682
BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape meetingName in record-and-playback/screenshare/playback/index.html.erb when generating the screenshare playback format. A low-privileged user could store a crafted meeting name that embedded script...
CVE-2026-55491 BigBlueButton: Stored XSS in Screenshare Recording Playback via Unescaped Meeting Name
BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape meetingName in record-and-playback/screenshare/playback/index.html.erb when generating the screenshare playback format. A low-privileged user could store a crafted meeting name that embedded script...
CVE-2026-55491 BigBlueButton: Stored XSS in Screenshare Recording Playback via Unescaped Meeting Name
BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape meetingName in record-and-playback/screenshare/playback/index.html.erb when generating the screenshare playback format. A low-privileged user could store a crafted meeting name that embedded script...
CVE-2026-55491
BigBlueButton versions prior to 3.0.29 have a stored XSS flaw: the meetingName field is rendered unescaped in record-and-playback/screenshare/playback/index.html.erb, so a low-privileged user can inject script that runs when another user replays the recording. CVSS 3.1 scores 5.4 (Medium). Upgrad...
PT-2026-79192
Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 3.0.29 Description An issue exists where the software fails to escape the meetingName variable in the record-and-playback/screenshare/playback/index.html.erb file during the generation of the screenshare playbac...
CVE-2026-55491: Improper Neutralization of Input During Web Page Generation
BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape meetingName in record-and-playback/screenshare/playback/index.html.erb when generating the screenshare playback format. A low-privileged user could store a crafted meeting name that embedded script...
CVE-2026-53452 Ground Station: Unauthenticated out-of-containment file read via `sigmfplayback` `recordingPath`
Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated configure-sdr Socket.IO command accepts a recordingPath for the sigmf-playback SDR and backend/handlers/entities/sdr.py stores it...
Linux Distros Unpatched Vulnerability : CVE-2026-74967
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Same-origin policy bypass in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbir...
CVE-2026-53452: Improper Limitation of a Pathname to a Restricted Directory
Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated configure-sdr Socket.IO command accepts a recordingPath for the sigmf-playback SDR and backend/handlers/entities/sdr.py stores it...
CVE-2026-74967
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Audio/Video: Playback component...
AZL-96854 CVE-2026-75904 affecting package libmodplug 0.8.9.0-12
libmodplug through 0.8.9.1 contains an out-of-bounds read in patsmplooped in src/loadpat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array patloops, so an index of zero reads patloops-1, one byte...
CVE-2026-74967
Same-origin policy bypass in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...
UBUNTU-CVE-2026-74967
Same-origin policy bypass in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...
CVE-2026-74967
Same-origin policy bypass in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...
CVE-2026-74967 Same-origin policy bypass in the Audio/Video: Playback component
Same-origin policy bypass in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...
EUVD-2026-60664
Same-origin policy bypass in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...
CVE-2026-74967 Same-origin policy bypass in the Audio/Video: Playback component
Same-origin policy bypass in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...
CVE-2026-74967
Same-origin policy bypass in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...
CVE-2026-74967
Same-origin policy bypass in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...
CVE-2026-74967
A Same-origin policy bypass vulnerability exists in the Audio/Video: Playback component of the Firefox web browser and Thunderbird email client. This flaw allows for the circumvention of origin-based security boundaries during media playback. The vulnerability has been addressed in Firefox 154 , ...