GHSA-8XX6-HGC6-GC2M HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)

Summary When decoding a compressed response body gzip, deflate, br, or zstd, HTTPX2 fully decompressed each network read before yielding content to the application. A small compressed input could therefore cause a large intermediate memory allocation, even when the application streamed the respon...

CVE-2026-69275

Use after free in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-69900

CVE-2026-69900 is an untrusted pointer dereference in the Kernel Streaming WOW Thunk Service Driver (a Windows kernel-mode driver) that allows a locally authenticated attacker to escalate privileges . Microsoft rated it HIGH (CVSS 7.8) with local attack vector, low complexity, low privileges requ...

EUVD-2026-73433

Use after free in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-69275

CVE-2026-69275 is a use-after-free vulnerability in the Kernel Streaming WOW Thunk Service Driver that allows an authorized attacker to escalate privileges locally. The CVSS 3.1 score is 7.0 (HIGH) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attack vector , high complexity...

CVE-2026-86720

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ownership of liverestreamsid in resendRestreamer.json.php, allowing authenticated users with canStream to access other users' restream destinations. Attackers can broadcast their live stream to victim-configured...

CVE-2026-86720 WWBN AVideo Missing Authorization via resendRestreamer.json.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ownership of liverestreamsid in resendRestreamer.json.php, allowing authenticated users with canStream to access other users' restream destinations. Attackers can broadcast their live stream to victim-configured...

Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability

Use after free in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally...

Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability

Untrusted pointer dereference in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-69900: Untrusted Pointer Dereference

Untrusted pointer dereference in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-69275: Use After Free

Use after free in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally...

PT-2026-87323

Name of the Vulnerable Software and Affected Versions Kernel Streaming WOW Thunk Service Driver affected versions not specified Description A use-after-free condition in the Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally. Use-after-free is a...

NewStart CGSL MAIN 7.02 : python-urllib3 Multiple Vulnerabilities (NS-SA-2026-0104)

The remote NewStart CGSL host, running version MAIN 7.02, has python-urllib3 packages installed that are affected by multiple vulnerabilities: - urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly...

PT-2026-88502

Impact A log streaming event destination may reference a generic HTTP credential, and the destination resolved and decrypted whichever credential it named without checking that the caller had access to it. A user holding a custom global role scoped to Log Streaming operations could therefore name...

CVE-2026-86993: Missing Authorization

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, a Log Streaming event destination could reference a generic HTTP credential and decrypt whichever credential ID it named without an ownership check. A user with a custom global role carrying Log Streaming...

EUVD-2026-71881

The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.8 via the 'remoteurl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the...

Linux Distros Unpatched Vulnerability : CVE-2026-68547

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - exiv2 - None Ubuntu Linux - GHSA-jcgh-p9v3-pw6j: Heap out-of-bounds read in RemoteIo when reading block-aligned remote CRW files CVE-2026-68547...

CVE-2021-44320

Parrot AR.Drone version 1 and 2 does not employ a suitable mechanism to prevent denial-of-service DoS attacks. An attacker can harm the device availability i.e., video streaming and control by using tool to perform an IPv4 flood attack. Verified attacks includes SYN flooding and UDP flooding...

PhoneSploit-Pro v2.3

PhoneSploit Pro The Swiss Army knife for Android. An all-in-one hacking tool written in Python to remotely take over Android devices using ADB, scrcpy, Nmap, and Metasploit-Framework. Table of contents Overview Screenshots Features Requirements Installing dependencies Getting started Device setup...

CVE-2021-44320

Parrot AR.Drone versions 1 and 2 are susceptible to denial-of-service (DoS) attacks because they lack adequate mechanisms to prevent them. An attacker can perform an IPv4 flood attack , specifically verified as SYN flooding and UDP flooding , to disrupt device availability. Such attacks can compr...