EUVD-2025-211148

An out-of-bounds read in gfodfac4cfgdsiv1 /odf/descriptors.c in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

CVE-2025-60493

GPAC Project/MP4Box versions prior to 2.5 are vulnerable to a segmentation violation within the check_media_profile function (located in /mp4box/mp4box.c). This vulnerability, identified as CWE-476 (NULL Pointer Dereference), allows an attacker to trigger a Denial of Service (DoS) by providing a ...

PT-2026-120629

A heap use-after-free in the gf filter pid send event downstream function /filter core/filter pid.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

CVE-2025-60497

A segmentation violation in the GetESD function /isomedia/track.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

Apache bRPC resource management error vulnerability

Versions of Apache bRPC prior to 1.18.0 contain a security vulnerability. This vulnerability arises because the built-in /flags service can be manipulated via ?setvalue= to alter the bvar/mbvar dump path; additionally, the bvardumptabs path is not properly sanitized. As a result, remote attackers...

Ágora Transparency Theme - Moderately critical - Information disclosure - SA-CONTRIB-2026-231

This theme provides a front-end design for transparency and open-government sites, including a table preview of CSV files attached to content. The theme doesn't sufficiently check file access when it renders that preview. It reads the file directly, so a visitor who may view the content, but whos...

SMG Software Information Portal Shell Upload / Command Injection

SMG Software Information Portal versions prior to 13.06.2025 contain an unrestricted dangerous-file upload and OS command injection vulnerability...

PT-2026-120699

Name of the Vulnerable Software and Affected Versions Cisco Emergency Responder affected versions not specified Cisco Prime Collaboration Deployment affected versions not specified Cisco Unified Communications Manager Unified CM affected versions not specified Cisco Unified Communications Manager...

CVE-2025-60487

The GPAC Project/MP4Box (versions prior to 2.5 ) is vulnerable to a segmentation violation within the gf_isom_get_esd function, located in /isomedia/isom_read.c. An attacker can trigger a Denial of Service (DoS) by providing a crafted XML file . A Nessus plugin indicates that some Linux distribut...

CVE-2025-60489

A NULL pointer dereference exists in the dasher_insert_timeline_entry function within the /filters/dasher.c file of GPAC Project/MP4Box versions prior to 2.5 . An attacker can exploit this vulnerability by providing a crafted MP4 file to cause a Denial of Service (DoS) . While one source mentions...

CVE-2025-71438

An out-of-bounds read in gfodfac4cfgdsiv1 /odf/descriptors.c in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

CVE-2025-60469

A NULL pointer dereference in the gfac4presentationchmode function /mediatools/avparsers.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

Linux Distros Unpatched Vulnerability : CVE-2026-109741

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the Storage: Bucket File System component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird...

Wireshark 1.12.x < 1.12.4 Multiple Vulnerabilities (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 1.12.4. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-1.12.4 advisory. - Integer overflow in the dissectosd2cdbcontinuation function in epan/dissectors/packet-scsi-osd.c in t...

SUSE SLES15: GraphicsMagick / GraphicsMagick-devel / libGraphicsMagick++-Q16-12 / etc (SUSE-SU-2026:4592-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:4592-1 advisory. This update for GraphicsMagick fixes the following issue: - CVE-2026-103118: uncontrolled recursion in the WPG file handler when processing crafted WPG...

RHEL 10 : mrtg (RHSA-2026:87255)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:87255 advisory. The Multi Router Traffic Grapher MRTG monitors the traffic load on network connections. MRTG generates HTML pages containing PNG images which provi...

SUSE SLES15 Security Update : php-composer2 (SUSE-SU-2026:4589-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4589-1 advisory. - CVE-2026-59946: package bin entries with path segments can cause unintended host file permission modifications bsc1271152. -...

FreeBSD : Emacs -- Local command injection via crafted file names in TRAMP (436ad1a7-ccc8-11f1-af18-c4ff99d93a55)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 436ad1a7-ccc8-11f1-af18-c4ff99d93a55 advisory. TRAMP Transparent Remote file Access, Multiple Protocol is a part of Emacs that provides an...

Linux Distros Unpatched Vulnerability : CVE-2026-109247

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.0 contains a path traversal vulnerability in convertfiledescriptorstofilelist in winpr/libwinpr/clipboard/syntheticfile.c, which concatenate...

Linux Distros Unpatched Vulnerability : CVE-2026-109277

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 7.1.2-32 contains a policy bypass vulnerability in the -script operation due to missing checks on file descriptor handling. Attackers can use...