CVE-2026-69963: Heap-based Buffer Overflow

Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally...

CVE-2026-69970: Heap-based Buffer Overflow

Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally...

CVE-2026-41210 Moonlight Qt: Remote heap buffer overflow in Moonlight Qt H.264 SPS fixup path via crafted seq_parameter_set_id

Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming session to a malicious host, the host can send a crafted H.264 SPS NAL when Moonlight selects a decoder path that does not advertise...

CVE-2026-108475

The VideoWhisper.com Broadcast Live Video WordPress plugin (versions

CVE-2026-108475 WordPress Broadcast Live Video plugin <= 7.3.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.6...

CVE-2026-108475: Missing Authorization

Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.6...

CVE-2026-41210: Out-of-bounds Write

Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming session to a malicious host, the host can send a crafted H.264 SPS NAL when Moonlight selects a decoder path that does not advertise...

CVE-2026-108768

A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the function json.loads of the component Streaming Tool-Call Argument Handler. The manipulation leads to allocation of resources. It is possible to initiate the attack remotely. The exploit is publicly...

CVE-2026-108768 zhayujie CowAgent Streaming Tool-Call Argument json.loads allocation of resources

A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the function json.loads of the component Streaming Tool-Call Argument Handler. The manipulation leads to allocation of resources. It is possible to initiate the attack remotely. The exploit is publicly...

CVE-2026-108768

A vulnerability exists in zhayujie CowAgent up to version 2.2.0 within the Streaming Tool-Call Argument Handler component. The issue stems from the json.loads function, where specific manipulation leads to an allocation of resources (CWE-770, CWE-400). This flaw can be triggered via a remote atta...

EUVD-2026-97122

A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the function json.loads of the component Streaming Tool-Call Argument Handler. The manipulation leads to allocation of resources. It is possible to initiate the attack remotely. The exploit is publicly...

CVE-2026-108768: Allocation of Resources Without Limits or Throttling

A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the function json.loads of the component Streaming Tool-Call Argument Handler. The manipulation leads to allocation of resources. It is possible to initiate the attack remotely. The exploit is publicly...

PT-2026-110343

Name of the Vulnerable Software and Affected Versions zhayujie CowAgent versions prior to 2.2.1 Description An issue exists in the Streaming Tool-Call Argument Handler component where the json.loads function can be manipulated. This allows a remote attacker to cause an excessive allocation of...

CVE-2026-106283

An use after free flaw was found in the Streaming component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/499468981...

EUVD-2026-95406

TP-Link Tapo C325WB V2 generates the pre-shared key used by its local media streaming service with a time-seeded pseudo-random number generator, making the key predictable and recoverable. An unauthenticated attacker on the adjacent network can recover the key and authenticate to the media...

EUVD-2026-95404

An unauthenticated denial-of-service vulnerability exists in Tapo C325WB v2 in the RTSP streaming service on TCP port 554 when the Camera Account feature is enabled. A crafted pair of RTSP-over-HTTP tunneling requests can cause memory corruption and crash the streaming daemon. Successful...

MiracleLinux 9 : brotli-1.0.9-10.el9_8 (AXBA:2026-2004:03)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXBA:2026-2004:03 advisory. - urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compress...

CVE-2026-105673

An unauthenticated denial-of-service vulnerability exists in Tapo C325WB v2 in the RTSP streaming service on TCP port 554 when the Camera Account feature is enabled. A crafted pair of RTSP-over-HTTP tunneling requests can cause memory corruption and crash the streaming daemon. Successful...

CVE-2026-105674

TP-Link Tapo C325WB V2 generates the pre-shared key used by its local media streaming service with a time-seeded pseudo-random number generator, making the key predictable and recoverable. An unauthenticated attacker on the adjacent network can recover the key and authenticate to the media...

CVE-2026-105674 Predictable Media Stream Pre-Shared Key Vulnerability in TP-Link Tapo C325WB

TP-Link Tapo C325WB V2 generates the pre-shared key used by its local media streaming service with a time-seeded pseudo-random number generator, making the key predictable and recoverable. An unauthenticated attacker on the adjacent network can recover the key and authenticate to the media...