py-model-versioning (>=0.4.0, <=0.5.0), qudi-iqo-modules (>=0.4.0, <=0.5.1) +3 more potentially affected by CVE-2026-0994 via protobuf (4.21.5)

protobuf PYPI version 4.21.5 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - py-model-versioning =0.4.0, =0.4.0, =0.0.2, =1.0.0, =2.14.6, =2.15.1 Source cves: CVE-2026-0994 Source advisory: OSV:PYSEC-2026-1805...

keras-video-generators-modified (0.2.0) potentially affected by CVE-2025-12060 via keras (2.5.0rc0)

keras PYPI version 2.5.0rc0 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - keras-video-generators-modified 0.2.0 Source cves: CVE-2025-12060 Source advisory: OSV:PYSEC-2026-1486...

keras-video-generators-modified (0.2.0) potentially affected by CVE-2025-12058 via keras (2.5.0rc0)

keras PYPI version 2.5.0rc0 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - keras-video-generators-modified 0.2.0 Source cves: CVE-2025-12058 Source advisory: OSV:PYSEC-2026-1487...

PYSEC-2026-1573 LLaMA Factory's Chat API Contains Critical SSRF and LFI Vulnerabilities

Summary A Server-Side Request Forgery SSRF vulnerability in the chat API allows any authenticated user to force the server to make arbitrary HTTP requests to internal and external networks. This can lead to the exposure of sensitive internal services, reconnaissance of the internal network, or...

adaptgym (>=0.1.1, <=0.1.2), aiearth-engine (>=3.1.0, <=3.1.5) +34 more potentially affected by CVE-2024-6345 via setuptools (66.0.0)

setuptools PYPI version 66.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - adaptgym =0.1.1, =3.1.0, =0.2.2, =0.1.1, =0.2.2 - bob-bio-base 8.0.0 - bob-bio-face 8.0.0 - bob-bio-spear 5.0.0 - bob-bio-vein 5.0.0 -...

Malicious code in @vmo-community/video-player (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7100 Malicious code in @vmo-community/video-player (npm)

--- -= Per source details. Do not edit below this line.=-...

yt-dlp File Downloader cookie leak

ImpactDuring file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host.This vulnerable behavior is present in all versions of youtube-dl...

SUSE CVE-2026-13858

Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. Chromium security severity: Medium...

SUSE CVE-2026-13942

Inappropriate implementation in Video Capture in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a local attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-14056

Insufficient validation of untrusted input in Media in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted video file. Chromium security severity: Low...

PT-2026-56279

Name of the Vulnerable Software and Affected Versions Cap affected versions not specified Description The 'GET /api/video/ai' endpoint fails to validate user ownership or membership. This allows authenticated attackers to provide arbitrary video IDs to access private AI metadata, such as titles,...

CVE-2026-59704: Missing Authorization

Cap's GET /api/video/ai endpoint fails to validate user ownership or membership before returning private video AI metadata including titles, summaries, and chapters. Authenticated attackers can supply arbitrary video IDs to read sensitive AI-generated content and trigger unauthorized AI generatio...

Important: gstreamer1-plugins-bad-free

Issue Overview: A denial of service vulnerability was found in GStreamer's AV1 codec parser in gst-plugins-bad. The gstav1parserparsetilelistobu function passes a byte count to a bit-reader API that expects a bit count, causing parser desynchronization. A remote attacker could trick a user into...

CVE-2026-55727

A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14.0.0 prior to build 5.14.178.18 may allow an unauthenticated attacker to access live video streams...

EUVD-2026-41923

A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14.0.0 prior to build 5.14.178.18 may allow an unauthenticated attacker to access live video streams...

CVE-2026-55727

A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14.0.0 prior to build 5.14.178.18 may allow an unauthenticated attacker to access live video streams...

CVE-2026-55727

A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14.0.0 prior to build 5.14.178.18 may allow an unauthenticated attacker to access live video streams...

CVE-2026-55727

A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14.0.0 prior to build 5.14.178.18 may allow an unauthenticated attacker to access live video streams...

CVE-2026-55727

CVE-2026-55727 affects Genetec Security Center 5.14.0.0 (before build 5.14.178.18). A flaw in the authentication mechanism for video stream requests may allow an unauthenticated attacker to access live video streams. The CVSSv3.1 base score is 7.5 (HIGH) with network attack vector and no user int...