PT-2026-108113

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 8.1.3 Description A protection mechanism failure exists in the HLS demuxer. This issue allows attackers to bypass protocol and allowed extensions restrictions when opening child playlists. By providing a crafted master...

CVE-2026-63269

On Linux , LibreOffice is vulnerable to Local File Inclusion (LFI) and GET Server-Side Request Forgery (SSRF) due to how it handles linked media via GStreamer . An attacker can provide a linked HLS playlist that causes GStreamer to read local files or remote URLs during document loading, potentia...

CVE-2026-63269 LFI and GET SSRF via GStreamer and HLS playlists

LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In...

CVE-2026-63269 LFI and GET SSRF via GStreamer and HLS playlists

LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In...

CVE-2026-63269

LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In...

CVE-2026-105089: Improper Neutralization of Input During Web Page Generation

WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of oncli...

Improper Resource Shutdown or Release

Overview Affected versions of this package are vulnerable to Improper Resource Shutdown or Release in the parseplaylist function of the Duration Parser component when processing the duration or targetduration arguments. An attacker can cause a denial of service by providing specially crafted...

Astra Linux – Vulnerability in ffmpeg5

A flaw was discovered in FFmpeg’s TTY Demuxer. This vulnerability allows for potential data exfiltration through improper parsing of input files that do not comply with TTY standards in HLS playlists...

CVE-2026-90540 WWBN AVideo Missing Authorization via playListAddVideo.json.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate watch permissions in the playListAddVideo.json.php endpoint when adding videos to playlists. Authenticated attackers can add password-protected videos they cannot watch to playlists they own by submitting the...

CVE-2026-90540 WWBN AVideo Missing Authorization via playListAddVideo.json.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate watch permissions in the playListAddVideo.json.php endpoint when adding videos to playlists. Authenticated attackers can add password-protected videos they cannot watch to playlists they own by submitting the...

CVE-2026-90538

WWBN AVideo versions through commit c3edcc274c389816d434acadac07ee78eaf330c1 contain a missing authorization vulnerability in playlistsFromUser.json.php . The root cause is improper cache keying that conflates requests across different user contexts, allowing unauthenticated attackers to retrieve...

CVE-2026-90538 WWBN AVideo Missing Authorization via playlistsFromUser.json.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in playlistsFromUser.json.php that allows unauthenticated attackers to read private playlists by requesting another user's identifier. Attackers can retrieve Favorite and Watch Later...

CVE-2026-90538 WWBN AVideo Missing Authorization via playlistsFromUser.json.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in playlistsFromUser.json.php that allows unauthenticated attackers to read private playlists by requesting another user's identifier. Attackers can retrieve Favorite and Watch Later...

PT-2026-90643

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in playlistsFromUser.json.php that allows unauthenticated attackers to read private playlists by requesting another user's identifier. Attackers can retrieve Favorite and Watch Later...

CVE-2026-89245 WWBN AVideo Cross-Site Request Forgery via playlistRemove.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in playlistRemove.php that allows attackers to delete playlists by skipping CSRF protection checks. Attackers can craft a malicious form that submits a POST request to...

CVE-2026-89245: Cross-Site Request Forgery (CSRF)

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in playlistRemove.php that allows attackers to delete playlists by skipping CSRF protection checks. Attackers can craft a malicious form that submits a POST request to...

CVE-2026-86728

AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-stream keys and private EPG schedules to unauthenticated users. Attackers can request the endpoint with sequential user or playlist IDs to retrieve sensitive credentials, server...

CVE-2026-86728: Missing Authentication for Critical Function

AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-stream keys and private EPG schedules to unauthenticated users. Attackers can request the endpoint with sequential user or playlist IDs to retrieve sensitive credentials, server...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2026-104825)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104825 advisory. A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists...

SUSE CVE-2026-49339

gonic is a music streaming server / free-software subsonic server API implementation. The maintainer's fix in commit 6dd71e6a3c966867ef8c900d359a7df75789f410 added an ownership check based on playlist.UserID. However, playlist.UserID is derived from the first path segment of the attacker-controll...