CVE-2026-19389: Integer Overflow or Wraparound

Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer asfdemux when parsing header objects from crafted ASF, WMV, or WMA files. Insufficient validation of attacker-controlled length and size values can bypass bounds checks and cause...

CVE-2026-19387: Out-of-bounds Write

A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. Thi...

PT-2026-69893

Name of the Vulnerable Software and Affected Versions GIMP affected versions not specified Description A flaw exists in the file format plugins, specifically those handling PSD and PAA files. A remote attacker can exploit this by tricking a user into opening a specially crafted image file, which...

CVE-2026-59091: Out-of-bounds Write

A flaw was found in GIMP's file format plugins, including those for PSD and PAA files. A remote attacker could exploit these vulnerabilities by tricking a user into opening a specially crafted image file. This could lead to unexpected application behavior or other potential security impacts witho...

PT-2026-69330

Name of the Vulnerable Software and Affected Versions GStreamer gst-plugins-ugly affected versions not specified Description Multiple integer overflow and underflow issues exist in the ASF demuxer asfdemux when parsing header objects from specially crafted ASF, WMV, or WMA files. Insufficient...

Linux Distros Unpatched Vulnerability : CVE-2026-59091

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in GIMP's file format plugins, including those for PSD and PAA files. A remote attacker could exploit these vulnerabilities by tricking a user...

Linux Distros Unpatched Vulnerability : CVE-2026-19387

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation ...

SUSE SLED15: gstreamer-plugins-bad / gstreamer-plugins-bad-devel / etc (SUSE-SU-2026:3527-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3527-1 advisory. This update for gstreamer-plugins-bad fixes the following issue: - CVE-2026-52718: byte count instead of a bit count in...

PSA: Supply Chain Compromise in BdThemes Ecosystem via Poisoned API Response

The Wordfence Threat Intelligence Team was notified on August 7th, 2026 of a supply chain compromise affecting BdThemes, a WordPress plugin vendor whose plugins are available in the official WordPress plugins directory. Currently, all the affected plugins are temporarily closed pending a full...

Wordfence Intelligence Weekly WordPress Vulnerability Report (July 27, 2026 to August 2, 2026)

Last week, there were 300 vulnerabilities disclosed in 235 WordPress Plugins and 2 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 150 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

SUSE-SU-2026:3527-1 Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issue: - CVE-2026-52718: byte count instead of a bit count in gstav1parserparsetilelistobu can cause parser desynchronization and an application crash bsc1268394...

SUSE-SU-2026:23059-1 Security update for gstreamer-plugins-base

This update for gstreamer-plugins-base fixes the following issue: - CVE-2024-4453: lack of proper validation of user-supplied data when parsing EXIF metadata bsc1224806...

[SECURITY] Fedora 44 Update: gstreamer1-plugins-base-1.28.6-1.fc44

GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related. Its plugin-based architecture means that new data types ...

[SECURITY] Fedora 44 Update: gstreamer1-plugins-ugly-free-1.28.6-1.fc44

GStreamer is a streaming media framework, based on graphs of elements which operate on media data. This package contains plug-ins whose license is not fully compatible with LGP L...

[SECURITY] Fedora 44 Update: gstreamer1-plugins-bad-free-1.28.6-1.fc44

GStreamer is a streaming media framework, based on graphs of elements which operate on media data. This package contains plug-ins that aren't tested well enough, or the code is not of good enough quality...

[SECURITY] Fedora 44 Update: gstreamer1-plugins-good-1.28.6-1.fc44

GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related. Its plugin-based architecture means that new data types ...

EUVD-2026-54200

Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites...

MiracleLinux 9 : gstreamer1-plugins-good-1.22.12-7.el9_8.1 (AXSA:2026-1488:02)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1488:02 advisory. gstreamer1-plugins-good: GStreamer: Heap buffer overflow in WavPack decoder via integer overflow CVE-2026-53705 Tenable has extracted the preceding descripti...

CVE-2026-17032

Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites...

[SECURITY] Fedora 44 Update: trafficserver-10.1.4-1.fc44

Traffic Server is a high-performance building block for cloud services. It's more than just a caching proxy server; it also has support for plugins to build large scale web applications. Key features: Caching - Improve your response time, while reducing server load and bandwidth needs by caching...