CVE-2025-60489

A NULL pointer dereference in the dasherinserttimelineentry function /filters/dasher.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

CVE-2025-60490

A heap use-after-free in the gffilterpidsendeventdownstream function /filtercore/filterpid.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

EUVD-2025-211160

A segmentation violation in the gfisomgetesd function /isomedia/isomread.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted XML file...

EUVD-2025-211150

A NULL pointer dereference in the StatSFVec2f function /scenemanager/scenestats.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MPEG-4 file...

PT-2026-120586

Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file values to POST /api/v1/backup/restore to restore archives from, o...

PT-2026-120607

An out-of-bounds read in gf odf ac4 cfg dsi v1 /odf/descriptors.c in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

SMG Software Information Portal Shell Upload / Command Injection

SMG Software Information Portal versions prior to 13.06.2025 contain an unrestricted dangerous-file upload and OS command injection vulnerability...

GPAC MP4Box security vulnerability

A security vulnerability exists in GPAC MP4Box versions prior to 2.5. This vulnerability stems from a segmentation fault in the GetESD function located at /isomedia/track.c. Attackers can exploit this by providing a specially crafted MP4 file, potentially leading to a denial of service...

TinyPNG - Moderately critical - Information disclosure - SA-CONTRIB-2026-246

TinyPNG uses smart lossy compression techniques to reduce the file size of your PNG files. The module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than private://. This vulnerability is mitigated by the fact that Drupal must be...

Ágora Transparency Theme - Moderately critical - Information disclosure - SA-CONTRIB-2026-231

This theme provides a front-end design for transparency and open-government sites, including a table preview of CSV files attached to content. The theme doesn't sufficiently check file access when it renders that preview. It reads the file directly, so a visitor who may view the content, but whos...

Nigel Jinivon file-management-system authorization issue vulnerability

The Nigel Jinivon file-management-system has an authorization issue vulnerability. This vulnerability stems from improper handling of the Request parameter in the index/store/update/destroy functions within the app/Http/Controllers/FileController.php file in the Files API component. As a result,...

oretnom23 file-management-system-php input validation error vulnerability

The oretnom23 file-management-system-php versions 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 and earlier contain a security vulnerability. This vulnerability stems from improper handling of the username/password parameters in the Login function within the adminclass.php file, potentially enabling S...

PT-2026-120232

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLM agent file-read tools. Attackers can prompt the agent to invoke read document, which lacks sandbox checks, or safe user path-gated tools to le...

RHEL 10 : mrtg (RHSA-2026:87255)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:87255 advisory. The Multi Router Traffic Grapher MRTG monitors the traffic load on network connections. MRTG generates HTML pages containing PNG images which provi...

Linux Distros Unpatched Vulnerability : CVE-2026-109247

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.0 contains a path traversal vulnerability in convertfiledescriptorstofilelist in winpr/libwinpr/clipboard/syntheticfile.c, which concatenate...

SiteIsolation Component Google Chrome Microsoft Edge Information Disclosure

The vulnerability in the SiteIsolation component of Google Chrome and Microsoft Edge web browsers is related to authorization errors. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted PDF file...

Google Chrome Microsoft Edge DoS

The vulnerability in the Notifications component of Google Chrome and Microsoft Edge web browsers is related to insufficient validation of input protected information. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service by sending a specially crafted PDF fi...

PT-2026-120668

A weakness has been identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected is the function save folder/delete folder/delete file/file rename/save files of the file admin class.php of the component Folder Management. This manipulation of the...

CVE-2025-60493

GPAC Project/MP4Box versions prior to 2.5 are vulnerable to a segmentation violation within the check_media_profile function (located in /mp4box/mp4box.c). This vulnerability, identified as CWE-476 (NULL Pointer Dereference), allows an attacker to trigger a Denial of Service (DoS) by providing a ...

CVE-2025-60490

GPAC Project's MP4Box versions prior to 2.5 are vulnerable to a heap use-after-free (or stack reutilization) issue in the gf_filter_pid_send_event_downstream function located in /filter_core/filter_pid.c. An attacker can exploit this vulnerability by supplying a crafted MP4 file to trigger a Deni...