EUVD-2025-211159

A heap use-after-free in the gffilterpidsendeventdownstream function /filtercore/filterpid.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

EUVD-2025-211161

A stack overflow in the gfbifsdecnode function /bifs/fielddecode.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

EUVD-2025-211163

A segmentation violation in the GetESD function /isomedia/track.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

CVE-2025-60492

A stack overflow in the gfbifsdecnode function /bifs/fielddecode.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

CVE-2025-60497

A segmentation violation in the GetESD function /isomedia/track.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

PT-2026-120713

Name of the Vulnerable Software and Affected Versions Electron versions prior to 42.11.6 Electron versions prior to 43.7.3 Electron versions prior to 44.4.3 Electron versions prior to 45.0.0-alpha.9 Description Frame data received from the GPU process for the webContents.beginFrameSubscription...

PT-2026-120816

A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the component Media Generation API. This manipulation of the argument output path causes file inclusion...

CVE-2025-60492

A stack overflow in the gfbifsdecnode function /bifs/fielddecode.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

PT-2026-120179

Name of the Vulnerable Software and Affected Versions vLLM versions 0.7.3 through 0.30.x Description When trust remote code is enabled, the software forwards the request-supplied mm processor kwargs.code revision to the Transformers AutoProcessor.from pretrained function. This allows clients to...

ROS-20261021-73-0073

The vulnerability of the httpresponserecvbody function in the libfreerdp/core/gateway/http.c file of the RDP client FreeRDP is related to unlimited resource allocation. Exploiting this vulnerability could allow a remote attacker to cause service failures...

PT-2026-120673

Name of the Vulnerable Software and Affected Versions Electron versions prior to 42.11.1 Electron versions prior to 43.5.1 Electron versions prior to 44.1.1 Electron versions prior to 45.0.0-alpha.4 Description The chrome.tabs.query function returns the URL and title of each tab to extensions tha...

PT-2026-120674

Name of the Vulnerable Software and Affected Versions Electron versions prior to 42.11.9 Electron versions prior to 43.7.6 Electron versions prior to 44.5.0 Electron versions prior to 45.0.0-alpha.13 Description Pointer lock permission requests originating from certain cross-origin iframes cause...

PT-2026-120677

Name of the Vulnerable Software and Affected Versions Electron versions prior to 42.11.3 Electron versions prior to 43.7.0 Electron versions prior to 44.3.0 Electron versions prior to 45.0.0-alpha.5 Description Requests to open external protocol URLs can be attributed to a document other than the...

PT-2026-120811

Name of the Vulnerable Software and Affected Versions toml-node versions prior to 5.0.1 Description The toml.parse function allows writing attacker-controlled properties to Object.prototype. This occurs because the quoteDottedString function in lib/compiler.js generates identical bookkeeping...

PT-2026-120736

Name of the Vulnerable Software and Affected Versions Nuxt versions 3.13.0 through 4.6.1 Description The server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker. Subsequently, NuxtIsland inserts this input into the page head ...

PT-2026-120813

Name of the Vulnerable Software and Affected Versions toml-node versions prior to 5.0.1 Description The toml.parse function passes unbounded hexadecimal, octal, binary, and decimal digit sequences from lib/parser.js to BigInt before the reduceInteger function in lib/compiler.js verifies if the...

PT-2026-120801

Name of the Vulnerable Software and Affected Versions Jupyter Server versions 2.0.0 through 2.6.0 Description An authorization bypass exists when GatewayClient.url is enabled, causing the KernelWebsocketHandler to be replaced by WebSocketChannelsHandler. While this handler authenticates the user,...

PT-2026-120346

Name of the Vulnerable Software and Affected Versions Tenda AC19 version 16.03.10.07 Description A stack-based buffer overflow exists in the httpd Web Management Service. The issue occurs within the formSetFirewallCfg function located in the /goform/SetFirewallCfg endpoint when processing the...

Parasoft Continuous Testing Platform 10.7.5 - JSP command execution

Title: Parasoft Continuous Testing Platform 10.7.5- JSP command execution Author: 0day Rubbish Research Team Contact: [email protected] Type: remote Platform: Linux CVE: pending Description: Parasoft Continuous Testing Platform CTP from Parasoft United States, a closed-source commercial...

CVE-2025-60469

The GPAC Project/MP4Box software (versions before 2.5 ) is vulnerable to a NULL pointer dereference within the gf_ac4_presentation_ch_mode function located in /media_tools/av_parsers.c. This flaw allows an attacker to trigger a Denial of Service (DoS) by providing a specially crafted AC4 file . N...