EUVD-2026-85367

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination...

PT-2026-97403

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination...

CVE-2026-96652: Server-Side Request Forgery (SSRF)

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination...

[SECURITY] Fedora 45 Update: vlc-3.0.23-18.fc45

VLC media player is a highly portable multimedia player and multimedia framew ork capable of reading most audio and video formats as well as DVDs, Audio CDs VC Ds, and various streaming protocols. It can also be used as a media converter or a server to stream in uni-cast or multi-cast in IPv4 or...

[SECURITY] Fedora 45 Update: qmplay2-26.08.02-2.fc45

QMPlay2 is a video and audio player. It can play all formats supported by FFm peg. It also supports Audio CD, raw files and chiptunes. It contains YouTube brows er...

[SECURITY] Fedora 45 Update: qmmp-2.3.3-5.fc45

This program is an audio-player, written with help of Qt library. The user interface is similar to winamp or xmms. Main opportunities: Winamp and xmms skins support plugins support AAC support MPEG1 layer 2/3 support Ogg Vorbis support native FLAC support WavePack support ModPlug support PCM WAVE...

[SECURITY] Fedora 45 Update: mpv-0.41.0-10.fc45

Mpv is a movie player based on MPlayer and mplayer2. It supports a wide varie ty of video file formats, audio and video codecs, and subtitle types. Special input URL types are available to read input from a variety of sources other than disk files. Depending on platform, a variety of different...

[SECURITY] Fedora 45 Update: fooyin-0.12.6-2.fc45

fooyin is a music player built around customization. It provides a variety of widgets to help you manage and play your local collection...

[SECURITY] Fedora 45 Update: haruna-1.8.1-4.fc45

Open source video player built with Qt/QML and libmpv. Features: + play online videos, through youtube-dl; + supports youtube playlists; + toggle playlist with mouse-over, playlist overlays the video; + auto skip chapter containing certain words; + configurable shortcuts and mouse buttons; + quic...

[SECURITY] Fedora 45 Update: aqualung-2.0-12.fc45

Aqualung is an advanced music player originally targeted at the GNU/Linux operating system. It plays audio CDs, internet radio streams and pod casts as well as sound files in just about any audio format and has the feature of inserting no gaps between adjacent tracks...

Malicious code in radio-player-theme (npm)

radio-player-theme presents itself as a radio player theme. The published tarball contains three files: package.json, style.css declared as main and payload.js, which holds the package's only executable code. payload.js is a browser payload. On execution it reads location.origin and...

MAL-2026-16347 Malicious code in radio-player-theme (npm)

radio-player-theme presents itself as a radio player theme. The published tarball contains three files: package.json, style.css declared as main and payload.js, which holds the package's only executable code. payload.js is a browser payload. On execution it reads location.origin and...

Cross-site Scripting (XSS)

Paella Player is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper sanitization of closed-caption cue text, which allows an attacker to inject malicious script content through captions and execute it in a victim's browser...

CVE-2026-61714

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.2.4 until 2.5.6, configuring synth.midi-channels above 16 allows the MIDI player to index fluidplayert::channelisplaying outside its fixed-size heap allocation while tracking active channels. The resulting...

UBUNTU-CVE-2026-61714

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.2.4 until 2.5.6, configuring synth.midi-channels above 16 allows the MIDI player to index fluidplayert::channelisplaying outside its fixed-size heap allocation while tracking active channels. The resulting...

CVE-2026-61714 FluidSynth: Heap Buffer Overflow in MIDI Player

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.2.4 until 2.5.6, configuring synth.midi-channels above 16 allows the MIDI player to index fluidplayert::channelisplaying outside its fixed-size heap allocation while tracking active channels. The resulting...

CVE-2026-61714 FluidSynth: Heap Buffer Overflow in MIDI Player

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.2.4 until 2.5.6, configuring synth.midi-channels above 16 allows the MIDI player to index fluidplayert::channelisplaying outside its fixed-size heap allocation while tracking active channels. The resulting...

CVE-2026-61714

FluidSynth (SoundFont 2 software synthesizer) versions 2.2.4 through 2.5.6 contain a heap buffer overflow in the MIDI player. When synth.midi-channels is configured above the default of 16, the code indexes _fluid_player_t::channel_isplaying outside its fixed-size heap allocation, causing out-of-...

EUVD-2026-82473

Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text...

Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text

Summary The Opencast Paella player renders caption cue text into innerHTML without escaping. The captions canvas clears captionsContainer.innerHTML and then appends each active cue with captionsContainer.innerHTML += cue, so HTML inside a WebVTT or DFXP cue becomes live DOM and executes in the...