Linux Distros Unpatched Vulnerability : CVE-2026-43162

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: tegra-video: Fix memory leak in tegrachanneltryformat The state object allocated by v4l2subdevstatealloc must be freed with v4l2subdevstatefree when it i...

PT-2026-37563

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the pvrusb2 media component where the pvr2 send request ex function fails to handle a scenario where a write USB Request Block URB—a data structure used for USB...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the tw9906 driver failing to release the memory of the v4l2 controller during error detection,...

PT-2026-37596

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds memory access occurs in the vfe isr reg update function. The vfe isr function uses MSM VFE IMAGE MASTERS NUM 7 as a loop bound and passes the resulting index to vfe isr...

PT-2026-37529

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the v4l2-async component of the media subsystem regarding error handling after a match is found with an fwnode. Specifically, if the v4l2 async match notify function...

PT-2026-37502

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the tegra channel try format function. The issue arises because two error paths return immediately after the v4l2 subdev call function fails, failing to call v4l2...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, caused by an error in calculating the buffer size for AV1 block information. This vulnerability may lead to the...

PT-2026-37569

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Fix device cleanup order to prevent kernel panic Move video device unregistration to the beginning of the remove function to ensure all video operations are stopped before cleaning up the worker thread...

PT-2026-37562

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A buffer size issue exists in the Verisilicon AV1 media component. The tile information, consisting of row sb, col sb, start pos, and end pos 4 bytes each, requires a total memory...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from an incorrect path not releasing the v4l2 control handler in the usbkeeneprobe function, potential...

vLLM Vulnerable to Remote DoS via Special-Token Placeholders

Summary This report explains a Token Injection vulnerability in vLLM’s multimodal processing. Unauthenticated, text-only prompts that spell special tokens are interpreted as control. Image and video placeholder sequences supplied without matching data cause vLLM to index into empty grids during...

CRLF Injection

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to CRLF Injection via the downloadICS.php process. An attacker can inject arbitrary calendar events and spoof event details by supplying specially crafted input...

CLSA-2026-1777663444 freerdp: Fix of 3 CVEs

CVE-2026-33985: fix information leak in ClearCodec glyph index decode; validate nWidthnHeight for overflow and update glyphEntry-count only after a successful realloc so subsequent reads cannot expose adjacent heap memory - CVE-2022-39283: fix missing length check in /video channel data handler;...

Cross-site Scripting (XSS)

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Cross-site Scripting XSS in the sendSiteEmail process. An attacker can inject arbitrary HTML content into emails sent to subscribers by supplying crafted input to...

Malicious Package

Overview react-video-canvas is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-43072 drm/vc4: platform_get_irq_byname() returns an int

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: platformgetirqbyname returns an int platformgetirqbyname will return a negative value if an error happens, so it should be checked and not just passed directly into devmrequestthreadedirq hoping all will be ok...

CLSA-2026-1777973407 libvpx: Fix of CVE-2024-5197

CVE-2024-5197: fix integer overflows in image allocation and wrapping logic...

nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files

A flaw was found in NGINX's ngxhttpmp4module. This Out-of-Bounds Read/Write vulnerability occurs due to improper handling of specially crafted MP4 files. A local authenticated attacker, by supplying a malicious MP4 file, can trigger a buffer over-read or overwrite in worker memory. This can lead ...

CVE-2026-7372

A stack overflow vulnerability exists in the WebCam Server Login functionality of GeoVision GV-VMS V20 20.0.2. A specially crafted HTTP request can lead to an arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability. Stack-overflow via...

PT-2026-38126

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 148.0.7778.96 Description An out of bounds read in WebCodecs allows a remote attacker to perform an out of bounds memory read by using a crafted video file. Recommendations Update to version 148.0.7778.96 or lat...