Linux Distros Unpatched Vulnerability : CVE-2026-86424

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use TOCTOU vulnerability in the video decoder that allows attackers to bypass path...

MAL-2026-15986 Malicious code in iframe-to-video (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9ddc607fb5b68fa9cd9a186110b72bea322a0a74ad96f6e8ba53105ed89e2388 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in iframe-to-video (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9ddc607fb5b68fa9cd9a186110b72bea322a0a74ad96f6e8ba53105ed89e2388 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-84937

The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database...

CVE-2026-4361

The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6. This is due to the etpbsetvideooembedthumbnailresolution function using wpremoteget instead of wpsaferemoteget to fetch a remote image URL, which does not restrict requests to...

EUVD-2026-71886

The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the imagesrc attribute of the etpbvideoslideritem shortcode in all versions up to, and including, 4.27.6. This is due to the imagesrc field not being included in the $urloptions whitelist which only contains...

CVE-2026-3853 Divi <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter

The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the imagesrc attribute of the etpbvideoslideritem shortcode in all versions up to, and including, 4.27.6. This is due to the imagesrc field not being included in the $urloptions whitelist which only contains...

CVE-2026-3853 Divi <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter

The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the imagesrc attribute of the etpbvideoslideritem shortcode in all versions up to, and including, 4.27.6. This is due to the imagesrc field not being included in the $urloptions whitelist which only contains...

CVE-2026-3853

The Divi theme for WordPress (versions ≤ 4.27.6 ) is affected by a DOM-Based Stored Cross-Site Scripting vulnerability in the image_src attribute of the et_pb_video_slider_item shortcode. The root cause is that image_src is absent from the $url_options whitelist, so it never receives esc_url_raw(...

Exploit for Generation of Error Message Containing Sensitive Information in Vllm

CVE-2026-22778 — vLLM RCE in video processing Vulnerable lab...

CVE-2026-86119: Server-Side Request Forgery (SSRF)

Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZEORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, acces...

CVE-2026-84937: Improper Neutralization of Special Elements used in an SQL Command

The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database...

PT-2026-86360

🚨 CVE-2026-84937 The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database...

PT-2026-86328

The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the image src attribute of the et pb video slider item shortcode in all versions up to, and including, 4.27.6. This is due to the image src field not being included in the $url options whitelist which only...

WordPress Divi plugin <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter vulnerability

Authenticated Contributor+ DOM-Based Stored Cross-Site Scripting via Video Slider 'imagesrc' Shortcode Parameter vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Theme Divi versions = 4.27.6...

CVE-2021-44320

Parrot AR.Drone version 1 and 2 does not employ a suitable mechanism to prevent denial-of-service DoS attacks. An attacker can harm the device availability i.e., video streaming and control by using tool to perform an IPv4 flood attack. Verified attacks includes SYN flooding and UDP flooding...

CVE-2026-80909

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reject UVD message with invalid number of h265 refs Same change as for h264, avoids overflow later when calculating min dpb size. cherry picked from commit a4b0720e4f1601f97f59a2be9c1b4b94fa6527d5...

CVE-2026-85696

SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to break out of quoted arguments and execut...

CVE-2026-85696 SadTalker OS Command Injection via Audio Filename

SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to break out of quoted arguments and execut...

EUVD-2026-71145

SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to break out of quoted arguments and execut...