7731 matches found
CVE-2026-35033 Jellyfin: Potential SSRF + Arbitrary file read via stream argument injection
Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain an unauthenticated arbitrary file read vulnerability via ffmpeg argument injection through the StreamOptions query parameter parsing mechanism. The ParseStreamOptions method in StreamingHelpers.cs adds any...
CVE-2026-35033
Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain an unauthenticated arbitrary file read vulnerability via ffmpeg argument injection through the StreamOptions query parameter parsing mechanism. The ParseStreamOptions method in StreamingHelpers.cs adds any...
CVE-2026-35033
Jellyfin before version 10.11.7 is affected by an unauthenticated arbitrary file read via ffmpeg argument injection in the StreamOptions parsing. The ParseStreamOptions method collects lowercase query parameters into a dictionary without validation, allowing them to be concatenated into the ffmpe...
CVE-2026-35033 Jellyfin: Potential SSRF + Arbitrary file read via stream argument injection
Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain an unauthenticated arbitrary file read vulnerability via ffmpeg argument injection through the StreamOptions query parameter parsing mechanism. The ParseStreamOptions method in StreamingHelpers.cs adds any...
FFmpeg av_bprint_finalize() function heap buffer overflow vulnerability
FFmpeg is an open source software library for processing multimedia data. A heap buffer overflow vulnerability exists in FFmpeg. The vulnerability stems from the avbprintfinalize function failing to properly handle specially crafted input and can be exploited by an attacker to cause a denial of...
PT-2026-32958
Name of the Vulnerable Software and Affected Versions Jellyfin versions prior to 10.11.7 Description An unauthenticated arbitrary file read is possible via ffmpeg argument injection through the query parameter parsing mechanism. The ParseStreamOptions method in StreamingHelpers.cs adds lowercase...
CVE-2026-30997
A flaw was found in FFmpeg. An attacker can exploit an out-of-bounds read vulnerability within the readglobalparam function by providing a specially crafted input. This can lead to a Denial of Service DoS, making the affected system or application unavailable. Mitigation For systems processing...
CVE-2026-30998
A flaw was found in FFmpeg. An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component allows a remote attacker to cause a Denial of Service DoS. By supplying a specially crafted input file, the attacker can trigger this flaw, leading to the application becoming...
CVE-2026-30999
A flaw was found in FFmpeg. A remote attacker could exploit a heap buffer overflow vulnerability in the avbprintfinalize function by providing a specially crafted input. This could lead to a Denial of Service DoS, making the affected system or application unavailable to legitimate users. Mitigati...
EUVD-2026-21976
A heap buffer overflow in the avbprintfinalize function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...
EUVD-2026-21974
An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service DoS via supplying a crafted input file...
CVE-2026-30999
A heap buffer overflow in the avbprintfinalize function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...
CVE-2026-30997
An out-of-bounds read in the readglobalparam function libavcodec/av1dec.c of FFmpeg v8.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...
CVE-2026-30998
An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service DoS via supplying a crafted input file...
DEBIAN-CVE-2026-30997
An out-of-bounds read in the readglobalparam function libavcodec/av1dec.c of FFmpeg v8.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...
DEBIAN-CVE-2026-30999
A heap buffer overflow in the avbprintfinalize function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...
CVE-2026-30999
A heap buffer overflow in the avbprintfinalize function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...
CVE-2026-30997
An out-of-bounds read in the readglobalparam function libavcodec/av1dec.c of FFmpeg v8.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...
CVE-2026-30998
An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service DoS via supplying a crafted input file...