EUVD-2025-211149

A NULL pointer dereference in the dasherinserttimelineentry function /filters/dasher.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

EUVD-2025-211163

A segmentation violation in the GetESD function /isomedia/track.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

PT-2026-120632

A segmentation violation in the GetESD function /isomedia/track.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

CVE-2025-60497

A segmentation violation in the GetESD function /isomedia/track.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: flatpak (UTSA-2026-142354)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142354 advisory. A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On system...

Linux Distros Unpatched Vulnerability : CVE-2026-109782

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5. CVE-2026-109782 Note that Nessus reli...

Rocky Linux 9 [CIQ] Security Update: cockpit-files Multiple Vulnerabilities (crlsa-2026_84595)

The Rocky Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202684595 advisory. cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste CVE-2026-91202 cockpit-files: cockpit-files: Local...

Linux Distros Unpatched Vulnerability : CVE-2026-112941

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftReadWriteLock and AsyncSoftReadWriteLock cache a successful check of the .r...

oretnom23 file-management-system-php input validation error vulnerability

The oretnom23 file-management-system-php contains an input validation error vulnerability. This vulnerability arises because the include function in the index.php file processes the ‘page’ parameter, resulting in file inclusion and potential remote exploitation...

Fortinet FortiSIEM 7.5 gRPC File Write / Remote Code Execution

Fortinet FortiSIEM version 7.5 contains an unauthenticated gRPC path traversal and NUL-byte injection vulnerability that allows arbitrary file write and remote command execution. https://packetstorm.news/download/236742...

EUVD-2025-211166

A heap use-after-free in the gfodfac4cfgcleanlist function /odf/descriptors.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

EUVD-2025-211165

A NULL pointer dereference in the gfac4presentationchmode function /mediatools/avparsers.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

CVE-2025-60476

A heap use-after-free in the gfodfac4cfgcleanlist function /odf/descriptors.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

oretnom23 file-management-system-php input validation error vulnerability

The oretnom23 file-management-system-php versions 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 and earlier contain a security vulnerability. This vulnerability stems from improper handling of the fid/id parameter in the files.php component within the File Management module, potentially leading to SQL...

Red Hat Confidential Compute Attestation resource management error vulnerability

Red Hat Confidential Compute Attestation version 1 contains a resource management error vulnerability. This vulnerability arises because storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer leak file descriptors when processing corrupted or malicious input. Unrestricted repeated calls may...

PT-2026-120806

Name of the Vulnerable Software and Affected Versions nbconvert versions 5.4.0 through 7.17.1 Description The ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py fails to properly limit the result of joining the cell output metadata filename to the output files dir. This allows ...

PT-2026-120741

pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents...

PT-2026-120631

Name of the Vulnerable Software and Affected Versions GPAC Project/MP4Box versions prior to 2.5 Description A segmentation violation occurs in the check media profile function located in /mp4box/mp4box.c. This issue allows an attacker to trigger a Denial of Service DoS by providing a specially...

PT-2026-120714

A flaw has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function save files of the file admin class.php. Executing a manipulation of the argument Upload can lead to unrestricted upload. It is possible to launch the attack...

PT-2026-120908

This theme provides a front-end design for transparency and open-government sites, including a table preview of CSV files attached to content. The theme doesn't sufficiently check file access when it renders that preview. It reads the file directly, so a visitor who may view the content, but whos...