firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the WebRTC: Audio/Video component...

firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the Audio/Video: cubeb component...

firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the WebRTC: Audio/Video component...

firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the Audio/Video: cubeb component...

Linux Distros Unpatched Vulnerability : CVE-2026-68221

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: nuvoton: npcm-video: fix memory leaks in probe and remove npcmvideoprobe allocates the npcmvideo structure with kzallocobj but never frees it on any prob...

CVE-2026-68106

A flaw was found in the Linux kernel's drm/amdgpu component. This vulnerability occurs when processing video frames with invalid dimensions, specifically if the width or height is less than 16. Such malformed input can lead to a division by zero error during video decoding operations. A local...

CVE-2026-69113

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video...

CVE-2026-69113

Cap v0.3.1 has a broken access control flaw in POST /api/video/comment that lets an authenticated user supply any videoId to comment on private videos. Impact includes injecting comments on others’ private videos, triggering owner notification emails, and enumerating valid video IDs via response ...

CVE-2026-69113 Cap v0.3.1 Broken Access Control via video comment endpoint

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video...

CVE-2026-69113 Cap v0.3.1 Broken Access Control via video comment endpoint

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video...

CVE-2026-69113 Cap v0.3.1 Broken Access Control via video comment endpoint

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video...

EUVD-2026-56853

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video...

CVE-2026-73090 PeerTube: Cross-origin remote video takeover via Update activity

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the host in videoObject.id, allowing a malicious federated server...

CVE-2026-73090 PeerTube: Cross-origin remote video takeover via Update activity

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the host in videoObject.id, allowing a malicious federated server...

CVE-2026-73090 PeerTube: Cross-origin remote video takeover via Update activity

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the host in videoObject.id, allowing a malicious federated server...

CVE-2026-73090

PeerTube (ActivityPub-fed video platform) has a vulnerability in versions prior to 8.2.2 where processUpdateActivity and processUpdateVideo can accept an Update containing a Video object without verifying byActor.url against the host in videoObject.id. This allows a malicious federated server to ...

CVE-2026-68229

A flaw was found in the Linux kernel's Cedrus media driver. This vulnerability allows an attacker to cause an out-of-bounds read by providing specially crafted H.264 video streams with invalid reference list entries. This could lead to system instability or potentially information disclosure...

CVE-2026-68204

A flaw was found in the Linux kernel's media subsystem, specifically within the vivid driver. The vividupdateformatcap/out functions, which handle video format changes, can be called when the video buffer queue is actively processing data. This occurs because checks for a busy queue are missing...

firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the Audio/Video: cubeb component...

firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the Audio/Video: GMP component...