Astra Linux – Vulnerability in Chromium

The use of after-free in Storage in Google Chrome before version 141.0.7390.65 allowed a remote attacker to execute arbitrary code through a crafted video file. Chromium security severity: High...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Media: MediTech; vcodec: Fixed a resource leak related to the scp device during firmware initialization. On MediTech devices with a System Companion Processor SCP, the mtkscp structure must be explicitly removed to avoid a resour...

WordPress JNews - Video plugin <= 11.0.2 - Reflected Cross Site Scripting (XSS) vulnerability

WordPress JNews - Video plugin = 11.0.2 - Reflected Cross Site Scripting XSS vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin JNews - Video versions = 11.0.2...

PT-2026-2418

Name of the Vulnerable Software and Affected Versions AimOne Video Converter version 2.04 Build 103 Description AimOne Video Converter version 2.04 Build 103 contains a buffer overflow in its registration form, leading to application crashes and a denial of service. An attacker can create a...

MiracleLinux 8 : kernel-4.18.0-553.40.1.el8_10 (AXSA:2025-9673:13)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-9673:13 advisory. kernel: media: uvcvideo: Skip parsing frames of type UVCVSUNDEFINED in uvcparseformat CVE-2024-53104 Tenable has extracted the preceding description block...

MiracleLinux 9 : firefox-140.5.0-1.el9_7.ML.1 (AXSA:2025-11515:36)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-11515:36 advisory. firefox: Mitigation bypass in the DOM: Security component CVE-2025-13018 firefox: Use-after-free in the Audio/Video component CVE-2025-13014 firefo...

PT-2026-2544

In the Linux kernel, the following vulnerability has been resolved: media: iris: Add sanity check for stop streaming Add sanity check in iris vb2 stop streaming. If inst-state is already IRIS INST ERROR, we should skip the stream off operation because it would still send packets to the firmware. ...

AimOne Video Converter 安全漏洞

AimOne Video Converter is a video format conversion tool from AimOne. A security vulnerability exists in AimOne Video Converter version 2.04 Build 103, which originates from a buffer overflow in the registry form that could lead to an application crash and denial of service attack...

Hikvision NVR/DVR Devices 安全漏洞

Hikvision NVR/DVR Devices are a series of network cameras from Hikvision, a Chinese company. A security vulnerability exists in Hikvision NVR/DVR Devices that stems from a stack overflow in the device's search and discovery function, which could allow an attacker on the same LAN to cause the devi...

CVE-2026-22800

PILOS Platform for Interactive Live-Online Seminars is a frontend for BigBlueButton. Prior to 4.10.0, Cross-Site Request Forgery CSRF vulnerability exists in an administrative API endpoint responsible for terminating all active video conferences on a single server. The affected endpoint performs ...

CVE-2026-22800 PILOS affected by a CSRF via GET request allows unintentional termination of all active video conferences

PILOS Platform for Interactive Live-Online Seminars is a frontend for BigBlueButton. Prior to 4.10.0, Cross-Site Request Forgery CSRF vulnerability exists in an administrative API endpoint responsible for terminating all active video conferences on a single server. The affected endpoint performs ...

CVE-2026-22800

PILOS (Platform for Interactive Live-Online Seminars) before version 4.10.0 contains a CSRF vulnerability in an administrative GET endpoint that terminates all active video conferences on a single BigBlueButton server. Although authorization checks exist, the use of GET allows implicit invocation...

CVE-2026-22800 PILOS affected by a CSRF via GET request allows unintentional termination of all active video conferences

PILOS Platform for Interactive Live-Online Seminars is a frontend for BigBlueButton. Prior to 4.10.0, Cross-Site Request Forgery CSRF vulnerability exists in an administrative API endpoint responsible for terminating all active video conferences on a single server. The affected endpoint performs ...

CVE-2025-68622

The CVE-2025-68622 affects Espressif ESP-IDF USB Host UVC Class Driver (esp-usb UVC host). A vulnerability in the UVC host parsing allows a malicious USB Video Class (UVC) device to cause a stack buffer overflow during configuration-descriptor parsing when UVC printing is enabled. A crafted descr...

EUVD-2025-206283

Espressif ESP-IDF USB Host UVC Class Driver allows video streaming from USB cameras. Prior to 2.4.0, a vulnerability in the esp-usb UVC host implementation allows a malicious USB Video Class UVC device to trigger a stack buffer overflow during configuration-descriptor parsing. When UVC...

CVE-2025-68622 Espressif ESP-IDF USB Host UVC Class Driver has a stack buffer overflow in UVC descriptor printing

Espressif ESP-IDF USB Host UVC Class Driver allows video streaming from USB cameras. Prior to 2.4.0, a vulnerability in the esp-usb UVC host implementation allows a malicious USB Video Class UVC device to trigger a stack buffer overflow during configuration-descriptor parsing. When UVC...

CVE-2026-0854 Merit LILIN｜NVR - OS Command Injection

Certain DVR/NVR models developed by Merit LILIN has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the device...

CVE-2026-0854 Merit LILIN｜NVR - OS Command Injection

Certain DVR/NVR models developed by Merit LILIN has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the device...

CVE-2026-0854

The CVE concerns Merit LILIN DVR/NVR devices that expose an OS Command Injection vulnerability. The affected component is the device OS on Merit LILIN DVR/NVR models; the root cause is an OS command injection vector that allows an authenticated remote attacker to inject and run arbitrary OS comma...

WordPress DZS Video Gallery plugin <= 12.39 - SQL Injection vulnerability

SQL Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin DZS Video Gallery versions = 12.39...