24798 matches found
CVE-2026-77396 PJSIP: Heap buffer overflow in the AVI parser
PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the PJSIP AVI parser in pjmedia/src/pjmedia/aviplayer.c uses an input-file video chunk length as the number of bytes copied into a frame buffer whose capacity is derived from the declared media...
CVE-2026-77396 PJSIP: Heap buffer overflow in the AVI parser
PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the PJSIP AVI parser in pjmedia/src/pjmedia/aviplayer.c uses an input-file video chunk length as the number of bytes copied into a frame buffer whose capacity is derived from the declared media...
CVE-2026-88259
CareCam CM2507 IP cameras do not require authentication for access to its network video streaming service. An unauthenticated attacker with network access to the affected device could retrieve live camera video...
EUVD-2026-83029
CareCam CM2507 IP cameras do not require authentication for access to its network video streaming service. An unauthenticated attacker with network access to the affected device could retrieve live camera video...
CVE-2026-88259 CareCam CM2507 Missing Authentication for Critical Function
CareCam CM2507 IP cameras do not require authentication for access to its network video streaming service. An unauthenticated attacker with network access to the affected device could retrieve live camera video...
CVE-2026-88259
CareCam CM2507 IP cameras are affected by a missing authentication for critical function vulnerability in their network video streaming service. An unauthenticated attacker with network access to the device can retrieve live camera video without credentials. The CISA advisory (ICSA-26-258-08 ) as...
CVE-2026-88259 CareCam CM2507 Missing Authentication for Critical Function
CareCam CM2507 IP cameras do not require authentication for access to its network video streaming service. An unauthenticated attacker with network access to the affected device could retrieve live camera video...
CVE-2026-88622
NUUO Network Video Recorder 2.0.0 is vulnerable to Command Injection in handleimportprivilege.php...
CVE-2026-88623
NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen is used to open the URL in binary read-only mode. The content is then written to the /tmp/ directory, with the filename derived from basename ...
CVE-2026-40534
An improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Video API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write limited files when the player is launched...
EUVD-2026-82789
An improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Video API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write limited files when the player is launched...
CVE-2026-40534
An improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Video API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write limited files when the player is launched...
CVE-2026-40534
An improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Video API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write limited files when the player is launched...
CVE-2026-40534
CVE-2026-40534 is a cross-site scripting (XSS) vulnerability in the Video API component of Synology DiskStation Manager (DSM) , caused by improper neutralization of input during web page generation. Remote authenticated users can read or write limited files when the media player is launched. Affe...
CVE-2026-88623
The NUUO Network Video Recorder 2.0.0 is vulnerable to an arbitrary file read flaw located in the up.php component. The issue occurs because the application accepts a user-supplied url parameter via POST and uses the fopen() function to open the URL in binary read-only mode. The resulting content...
PT-2026-95387
Name of the Vulnerable Software and Affected Versions NUUO Network Video Recorder version 2.0.0 Description Command Injection is possible via the 'handle import privilege.php' endpoint. Recommendations At the moment, there is no information about a newer version that contains a fix for this...
EUVD-2026-82974
NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen is used to open the URL in binary read-only mode. The content is then written to the /tmp/ directory, with the filename derived from basename ...
PT-2026-95482
Name of the Vulnerable Software and Affected Versions CareCam CM2507 affected versions not specified Description CareCam CM2507 IP cameras lack authentication requirements for access to the network video streaming service. This allows an unauthenticated attacker with network access to the device ...