CVE-2025-52290

A NULL pointer dereference in the avprivh264hasnumreorderframes function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service DoS via processing a crafted media file...

EUVD-2026-104293

libaribb24 aribb24 through 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser.c that allows attackers to corrupt heap memory via an oversized caption data unit. Attackers can supply a crafted caption PES packet in a media file or broadcast stream, processed through...

CVE-2025-52290

A NULL pointer dereference in the avprivh264hasnumreorderframes function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service DoS via processing a crafted media file...

CVE-2026-112280: Heap-based Buffer Overflow

libaribb24 aribb24 through 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser.c that allows attackers to corrupt heap memory via an oversized caption data unit. Attackers can supply a crafted caption PES packet in a media file or broadcast stream, processed through...

EUVD-2025-211132

A NULL pointer dereference in the avprivh264hasnumreorderframes function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service DoS via processing a crafted media file...

CVE-2025-52290

A NULL pointer dereference in the avprivh264hasnumreorderframes function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service DoS via processing a crafted media file...

PT-2026-117533

A NULL pointer dereference in the avpriv h264 has num reorder frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service DoS via processing a crafted media file...

CVE-2025-52290

A NULL pointer dereference in the avprivh264hasnumreorderframes function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service DoS via processing a crafted media file...

CVE-2025-52290

A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows an attacker to cause a Denial of Service (DoS) . The vulnerability is triggered by processing a crafted media file , which leads to an unexpected application crash. No speci...

ffmpeg-4-4.4.8-6.1 on GA media (moderate)

ffmpeg-4-4.4.8-6.1 on GA media Announcement ID: openSUSE-SU-2026:12064-1 Rating: moderate Cross-References: CVE-2023-6602 CVE-2023-6603 CVE-2024-35367 CVE-2026-18393 CVE-2026-38345 CVE-2026-38346 CVE-2026-38347 CVE-2026-38348 CVE-2026-38349 CVE-2026-38350 CVE-2026-75141 CVSS scores: CVE-2023-6602...

CVE-2025-52290

A NULL pointer dereference in the avprivh264hasnumreorderframes function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service DoS via processing a crafted media file...

CVE-2026-102608

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents manually wraps a monitor Name value in single quotes instead of using escapeshellarg before placing it in shell commands when a user with monitor-create or monitor-edit permission...

CVE-2026-102608 ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents manually wraps a monitor Name value in single quotes instead of using escapeshellarg before placing it in shell commands when a user with monitor-create or monitor-edit permission...

EUVD-2026-103151

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents manually wraps a monitor Name value in single quotes instead of using escapeshellarg before placing it in shell commands when a user with monitor-create or monitor-edit permission...

CVE-2026-102608 ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents manually wraps a monitor Name value in single quotes instead of using escapeshellarg before placing it in shell commands when a user with monitor-create or monitor-edit permission...

CVE-2026-102608

The ZoneMinder CCTV software (prior to version 1.38.3 ) is vulnerable to OS Command Injection in the downloadEvents() function within download_functions.php. The root cause is the manual wrapping of a monitor name in single quotes instead of using escapeshellarg(), allowing shell metacharacters t...

CVE-2026-102608

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents manually wraps a monitor Name value in single quotes instead of using escapeshellarg before placing it in shell commands when a user with monitor-create or monitor-edit permission...

CVE-2026-111728

Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard by setting transcodeHwAccel to custom and supplying attacker-controlled decodeFlags...

EUVD-2026-102897

Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard by setting transcodeHwAccel to custom and supplying attacker-controlled decodeFlags...

CVE-2026-102608: Improper Neutralization of Special Elements used in an OS Command

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents manually wraps a monitor Name value in single quotes instead of using escapeshellarg before placing it in shell commands when a user with monitor-create or monitor-edit permission...