CVE-2026-120246

A flaw was found in FFmpeg. This vulnerability leads to information disclosure when processing a specially crafted CDXL media file. By tricking a user or automated service into decoding a file that references uninitialized color palette entries, an attacker can cause sensitive internal stack memo...

CVE-2026-54337-PoC

CVE-2026-54337 PoC CVE-2026-54337 - Unauthenticated File Write/Overwrite in fireshare test.mp4 Step 2 : Run the following curl command make sure to change the placeholder $ curl -s -w "HTTP %httpcode\n" \ -F "file=@;filename= -selectstreams v.mp4" \ -F "folder=testfolder -o " ...

[SECURITY] [DLA 4869-1] vlc security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4869-1 [email protected] https://www.debian.org/lts/security/ Simon Quigley October 29, 2026 https://wiki.debian.org/LTS -...

Debian dla-4869 : libvlc-bin - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4869 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4869-1 [email protected]...

CVE-2026-107745

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion in versions up to and including 3.8.4 . The root cause is insufficient file path validation in the upload_file function, which allows authenticated attackers with subscr...

EUVD-2026-111565

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the uploadfile function in all versions up to, and including, 3.8.4 This makes it possible for authenticated attackers, with...

CVE-2026-107745 AI Engine <= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the uploadfile function in all versions up to, and including, 3.8.4 This makes it possible for authenticated attackers, with...

CVE-2026-107745 AI Engine <= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the uploadfile function in all versions up to, and including, 3.8.4 This makes it possible for authenticated attackers, with...

CVE-2026-107745: tigroumeow: The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file…

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the uploadfile function in all versions up to, and including, 3.8.4 This makes it possible for authenticated attackers, with...

WordPress AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini plugin <= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion vulnerability

Authenticated Subscriber+ Limited Media File Deletion vulnerability discovered by Sawyer in WordPress Plugin AI Engine versions = 3.8.4...

EUVD-2026-110440

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2. Processing a maliciously crafted media file may lead to...

WordPress GeoDirectory plugin < 2.8.194 - Subscriber+ Media File Disclosure and Deletion vulnerability

Subscriber+ Media File Disclosure and Deletion vulnerability discovered by vuxvinh in WordPress Plugin GeoDirectory versions 2.8.194...

CVE-2026-113491

The GeoDirectory WordPress plugin (versions before 2.8.194 ) is vulnerable to a Path Traversal vulnerability (CWE-22 ) due to insufficient validation of user-supplied image URLs when saving front-end listings. This flaw allows users with Subscriber-level access or higher to read files from outsid...

CVE-2026-113491 GeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal

The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limit...

CVE-2026-113491 GeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal

The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limit...

SUSE CVE-2025-52290

A NULL pointer dereference in the avprivh264hasnumreorderframes function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service DoS via processing a crafted media file...

CVE-2026-86913

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted media file may lead to...

CVE-2026-86913

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted media file may lead to...

CVE-2026-86913

A use after free issue exists in the CoreMedia framework of Apple devices. Processing a maliciously crafted media file can lead to unexpected app termination or corrupt process memory . This vulnerability is addressed in iOS 26.7/27 , iPadOS 26.7/27 , macOS Golden Gate 27 , macOS Sequoia 15.8 , m...

CVE-2026-86913

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted media file may lead to...