74 matches found
CVE-2026-105815 Credential Material Exposure Leading to Unauthorized Streamed Media-Session Access in TP-Link Tapo C210
TP-Link Tapo C210 V3.60 may expose shared credential material and cryptographic metadata through unauthenticated DS JSON API requests. The exposed shared credential can be accepted by the Streamd Digest authentication mechanism as an administrative password, allowing an unauthenticated...
CVE-2026-105815
The TP-Link Tapo C210 (V3.60) is vulnerable to an Improper Authentication flaw (CWE-287) where unauthenticated DS JSON API requests expose shared credential material and cryptographic metadata. An unauthenticated attacker on an adjacent network can leverage this exposed material as an administrat...
CVE-2026-104480
Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecognized participant. An attacker in control of the DAVE signaling path the voice gateway, or an equivalent position able to add, alter, or withhold signaling messages to a client...
ROS-20260915-73-0027
The vulnerability of the Media Session component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the request. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially crafted HTML page...
Astra Linux – Vulnerability in Chromium
The use of after free in the Media Session in Google Chrome before version 125.0.6422.141 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: High...
EUVD-2026-76868
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to check user authorization in the PlayerSkins mediaSession.json.php endpoint before returning video metadata. Unauthenticated attackers can request the endpoint with a video ID parameter to retrieve password-protected vide...
Media Session DoS
The vulnerability of the Media Session component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the request. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially crafted HTML page...
GHSA-28GM-JRMW-XX93 SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)
Impact A single malformed inbound UDP packet on the RTP/ICE socket can remotely terminate an active RTP or WebRTC media session. The packet receive handler indexes packet and STUN attribute bytes without sufficient length checks and throws, and the UDP receive loop converted any such exception in...
SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)
Impact A single malformed inbound UDP packet on the RTP/ICE socket can remotely terminate an active RTP or WebRTC media session. The packet receive handler indexes packet and STUN attribute bytes without sufficient length checks and throws, and the UDP receive loop converted any such exception in...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in the Media Session component in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Medium...
CVE-2026-11181
An inappropriate implementation flaw was found in the Media Session component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=502633299...
SUSE CVE-2026-11181
Inappropriate implementation in Media Session in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: Medium...
Chromium: CVE-2026-11181 Inappropriate implementation in Media Session
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
EUVD-2026-34642
Inappropriate implementation in Media Session in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: Medium...
Linux Distros Unpatched Vulnerability : CVE-2026-11181
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inappropriate implementation in Media Session in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML...
DEBIAN-CVE-2026-11181
Inappropriate implementation in Media Session in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-11181
Inappropriate implementation in Media Session in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-11181
Inappropriate implementation in Media Session in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-11181
Google Chrome and Microsoft Edge web browsers are affected by a vulnerability in the Media Session component. The root cause is an inappropriate implementation and a lack of mechanisms for verifying the source of the request . This flaw allows a remote attacker to bypass the same-origin policy us...