1511 matches found
CVE-2026-107676
A flaw was found in FFmpeg. This vulnerability allows an attacker to trigger an information disclosure by providing a specially crafted media file containing manipulated High Dynamic Range HDR metadata. When FFmpeg processes the media file during conversion or transcoding, uninitialized memory...
CVE-2026-54337-PoC
CVE-2026-54337 PoC CVE-2026-54337 - fireshare test.mp4 2단계 : 다음 curl 명령을 실행합니다 자리 표시자를 반드시 변경하세요 $ curl -s -w "HTTP %httpcode\n" \ -F "file=@;filename= -selectstreams v.mp4" \ -F "folder=testfolder -o " \ http:///api/upload/public 예를 들어, /data/db.sqlite를 덮어쓰려면 명령을 다음과 같이 변경합니다. $ curl -s -w "HTTP...
The vulnerability of the `nhmldump_send_frame()` function in the `src/filters/write_nhml.c` file, a component handler for media files on the GPAC multimedia platform, allows a malicious actor to cause a service failure.
The vulnerability of the nhmldumpsendframe function in the src/filters/writenhml.c file of the media file processing component of the GPAC multimedia platform is related to improper cleaning or release of resources. Exploiting this vulnerability can allow an attacker to cause service failures...
EUVD-2026-87820
AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/stationid/file/id/play endpoint that allows authenticated users to download media files from any station. Attackers can enumerate media files using sequential IDs and exfiltrate the complete media...
CVE-2026-100855
AzuraCast versions before 0.23.6 are vulnerable to a missing permission check in the GET /api/station/{station_id}/file/{id}/play endpoint. This flaw allows authenticated users to download media files from any station by enumerating sequential IDs. Consequently, an attacker can exfiltrate the com...
CVE-2026-100855 AzuraCast before 0.23.6 Missing Permission Check via /play
AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/stationid/file/id/play endpoint that allows authenticated users to download media files from any station. Attackers can enumerate media files using sequential IDs and exfiltrate the complete media...
CVE-2026-100853
AzuraCast versions prior to 0.23.8 are vulnerable to an authorization bypass in the public On-Demand download endpoint. The root cause is a failure to verify playlist-level access controls , which allows unauthenticated users to download media files that were intended to be excluded from On-Deman...
CVE-2026-100853 AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass
In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download media files excluded from On-Demand-enabled playlists. Attackers can bypass the station operator's intended access restrictions by directly...
CVE-2026-100855: Missing Authorization
AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/stationid/file/id/play endpoint that allows authenticated users to download media files from any station. Attackers can enumerate media files using sequential IDs and exfiltrate the complete media...
[SECURITY] [DSA 6515-1] vlc security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6515-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 25, 2026 https://www.debian.org/security/faq -...
CVE-2026-93366
Bludit CMS version 3.22.0 and earlier is vulnerable to an authorization bypass in the bl-kernel/ajax/ endpoints. Authenticated users with the Author role can enumerate and delete media files belonging to other users, including administrators, by providing arbitrary uuid parameters. The vulnerabil...
Debian dsa-6515 : libvlc-bin - security update
The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6515 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6515-1 [email protected] https://www.debian.org/securit...
Astra Linux – Vulnerability in Chromium
Before version 152.0.7977.65, reading out of bounds in Skia using Google Chrome allowed a remote attacker to potentially read memory within the sandbox through a crafted media file. Chromium security severity: Medium...
WordPress Custom Field Template plugin <= 2.7.8 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Media File Deletion vulnerability
Authenticated Contributor+ Insecure Direct Object Reference to Arbitrary Media File Deletion vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Custom Field Template versions = 2.7.8...
WordPress WP Travel Engine plugin < 6.8.1 - Subscriber+ Arbitrary Media File Move via user_profile_image vulnerability
Subscriber+ Arbitrary Media File Move via userprofileimage vulnerability discovered by marim00 in WordPress Plugin WP Travel Engine versions 6.8.1...
USN-8716-2: FFmpeg vulnerabilities
USN-8716-1 fixed several vulnerabilities in FFmpeg. This update provides the corresponding fix for Ubuntu 26.04 LTS. Original advisory details: It was discovered that FFmpeg incorrectly handled certain crafted media files in the VobSub subtitle demuxer. An attacker could possibly use this issue t...
[SECURITY] [DSA 6486-1] libde265 security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6486-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 06, 2026 https://www.debian.org/security/faq -...
Debian dsa-6486 : libde265-0 - security update
The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6486 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6486-1 [email protected] https://www.debian.org/securit...
SUSE CVE-2026-79020
Out of bounds read in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted media file. Chromium security severity: Medium...