CVE-2026-125269

FFmpeg versions through 9.0.2 are susceptible to a double free vulnerability within the libavcodec/cbs_sei.c component. The root cause is that the cbs_sei_delete_message() function leaves a stale extension_data reference, which is subsequently reused by ff_cbs_sei_add_message(). An attacker can t...

CVE-2026-125227

FFmpeg versions through 9.0.2 are vulnerable to an integer overflow within the cbs_jpeg_write_scan() function in libavcodec/cbs_jpeg.c. This flaw leads to a heap buffer overflow specifically on 32-bit builds . An attacker can exploit this by providing a crafted MJPEG/JPEG stream containing a scan...

CVE-2026-125231

FFmpeg versions 4.4 through 9.0.2 are vulnerable to a NULL pointer dereference in libavcodec/adxdec.c. The root cause is that adx_decode_header() updates the channel layout before validating the sample rate. A crafted ADX/AAX stream containing mid-stream new-extradata side data with an invalid sa...

CVE-2026-125231

FFmpeg 4.4 through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/adxdec.c because adxdecodeheader updates the channel layout before validating the sample rate. Attackers can supply a crafted ADX/AAX stream with mid-stream new-extradata side data carrying an invalid sample...

CVE-2026-125203

FFmpeg versions before 8.1.3 and 9.x before 9.0.2 are vulnerable to a heap buffer overflow in the Cook multichannel decoder (located in libavcodec/cook.c). The root cause is a failure to verify that subpacket channel masks are disjoint . An attacker can exploit this by providing a crafted RealMed...

CVE-2026-125173

FFmpeg versions through 9.0.2 are vulnerable to a memory leak in the libxevd_receive_frame() function within libavcodec/libxevd.c. The root cause is a failure to free pkt_au when an access unit produces no picture. An attacker can exploit this by providing a crafted EVC stream containing numerous...

EUVD-2026-120181

FFmpeg 4.4 through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/adxdec.c because adxdecodeheader updates the channel layout before validating the sample rate. Attackers can supply a crafted ADX/AAX stream with mid-stream new-extradata side data carrying an invalid sample...

EUVD-2026-120177

FFmpeg through 9.0.2 contains an integer overflow in cbsjpegwritescan in libavcodec/cbsjpeg.c that causes a heap buffer overflow on 32-bit builds. Attackers can supply a crafted MJPEG/JPEG stream with a scan of 512 MiB or more, processed by CBS bitstream filters like filterunits, to corrupt the...

EUVD-2026-120292

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap buffer overflow vulnerability in the Cook multichannel decoder in libavcodec/cook.c that fails to verify subpacket channel masks are disjoint. Attackers can supply a crafted RealMedia Cook stream with overlapping subpacket masks, causing...

EUVD-2026-120279

FFmpeg through 9.0.2 contains an information disclosure vulnerability in decodemvc2 in libavcodec/mvcdec.c that leaks uninitialized stack memory through unchecked palette indices. Attackers can supply a crafted MVC2 stream declaring few colors but referencing higher palette indices, copying proce...

undici: undici: Denial of Service via unhandled stream error on excessive content encodings

A flaw was found in undici. When an application sends a request to a malicious remote server, the server can return a response with excessive content encodings and immediately close the connection. Because the underlying response stream is left unhandled, this abrupt closure triggers an unhandled...

undici: undici: Denial of Service via unhandled stream error on excessive content encodings

A flaw was found in undici. When an application sends a request to a malicious remote server, the server can return a response with excessive content encodings and immediately close the connection. Because the underlying response stream is left unhandled, this abrupt closure triggers an unhandled...

undici: undici: Denial of Service via unhandled stream error on excessive content encodings

A flaw was found in undici. When an application sends a request to a malicious remote server, the server can return a response with excessive content encodings and immediately close the connection. Because the underlying response stream is left unhandled, this abrupt closure triggers an unhandled...

EUVD-2026-119348

The DNS-over-QUIC DoQ server in hickory-server hickory-dns before 0.26.2 does not apply any timeout when reading a request message from a QUIC stream, bypassing all configured timeouts. A remote unauthenticated client can open a connection and a request stream and hold it open indefinitely,...

tomcat-embed-core-9.0.31-CVE-2020-11996

Please see the PoC in testImplicitCloseLargeId unit test of TestHttp2Section51.java: https://github.com/rusakovichma/tomcat-embed-core-9.0.31-CVE-2020-11996/blob/master/test/org/apache/coyote/http2/TestHttp2Section51.java...

PT-2026-139870

The DNS-over-QUIC DoQ server in hickory-server hickory-dns before 0.26.2 does not apply any timeout when reading a request message from a QUIC stream, bypassing all configured timeouts. A remote unauthenticated client can open a connection and a request stream and hold it open indefinitely,...

CVE-2026-123589: hickory-dns: The DNS-over-QUIC (DoQ) server in hickory-server (hickory-dns) before 0.26.2 does not apply any timeout when reading a…

The DNS-over-QUIC DoQ server in hickory-server hickory-dns before 0.26.2 does not apply any timeout when reading a request message from a QUIC stream, bypassing all configured timeouts. A remote unauthenticated client can open a connection and a request stream and hold it open indefinitely,...

NOW

NØW — Word-Based Shellcode Encoder Encode shellcode as natural-looking English prose. Decode it back with the right sentence + password. What is NØW? NØW Natural Output Words is a C tool that converts raw shellcode bytes into human-readable English text — either a plain list of codewords or fluen...

MAL-2026-18756 Malicious code in twitch-stream-py (PyPI)

twitchstream/getchat.py is a modified copy of the sounddevice library. Its queryhostapis function, which other functions in the module call, decodes a base32-hidden URL, downloads a Python script from it to %USERPROFILE%.steam\script.py, adds a value named "WindowsUpdate" under...

snuffleupagus

Snuffleupagus Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest! Key Features • Download • Examples • Documentation • License • Thanks Snuffleupagus is a PHP 7+ and 8+ module designed to drastically raise the cost of attacks against websites, by killing entire b...