EUVD-2026-55312

In the Linux kernel, the following vulnerability has been resolved: media: stm32-dcmipp: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffe...

CVE-2026-68211

The CVE concerns the Linux kernel component media: stm32-dcmipp. The issue arises when start_streaming() fails after vb2 has handed buffers to the driver via buf_queue(); if those buffers aren’t returned with vb2_buffer_done(), vb2_start_streaming() may WARN_ON(owned_by_drv_count) and the buffers...

CVE-2026-68209

The CVE-2026-68209 issue affects the Linux kernel sun4i-csi driver where, if start_streaming() fails, the vb2 framework does not return queued buffers, leading to buffer leaks and potential resource exhaustion. The root cause is that buffers queued via vb2_buffer_done() may not be returned before...

CVE-2026-68209 media: sun4i-csi: Return queued buffers on start_streaming() failure

In the Linux kernel, the following vulnerability has been resolved: media: sun4i-csi: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffers...

EUVD-2026-55310

In the Linux kernel, the following vulnerability has been resolved: media: sun4i-csi: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffers...

EUVD-2026-54999

All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by ?vdl= on any aiovgvideos post public/video.php, AIOVGPublicVideo::downloadvideo, which reads the post's mp4 meta value and streams that URL's response back to the requester...

send v4.1.1

@fastify/send Send is a library for streaming files from the file system as an HTTP response supporting partial responses Ranges, conditional-GET negotiation If-Match, If-Unmodified-Since, If-None-Match, If-Modified-Since, high test coverage, and granular events which may be leveraged to take...

PT-2026-69609

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the sun4i-csi media component where queued buffers leak if the sun4i csi start streaming function returns an error without returning those buffers via vb2 buffer done...

PT-2026-69622

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the msi2500 driver where the msi2500 start streaming function fails to return queued buffers when an error occurs. The vb2 framework provides buffers via buf queue...

PT-2026-69611

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the stm32-dcmipp media component where queued buffers leak if the dcmipp bytecap start streaming function returns an error without returning those buffers via vb2 buff...

PT-2026-69617

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the Linux kernel media component when start streaming fails. The pwc isoc init function submits isochronous URBs USB Request Blocks in a loop. If the first URB is...

PT-2026-69613

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the rtl2832 sdr driver within the media subsystem. The vb2 framework provides buffers to the driver via buf queue before calling start streaming. If the rtl2832 s...

RUSTSEC-2026-0239 Streaming AEAD does not authenticate stream structure

In all published versions of dcrypt-symmetric before 2.0.0, version-1 GCM and ChaCha20-Poly1305 streams used unauthenticated terminator, counter, and length fields. Decryptors trusted transmitted counters, allocated from unbounded lengths, and discarded plaintext that did not fit a caller's singl...

Streaming AEAD does not authenticate stream structure

In all published versions of dcrypt-symmetric before 2.0.0, version-1 GCM and ChaCha20-Poly1305 streams used unauthenticated terminator, counter, and length fields. Decryptors trusted transmitted counters, allocated from unbounded lengths, and discarded plaintext that did not fit a caller's singl...

ECHO-A10B-DD74-A1AF

Bulletin has no description...

CVE-2026-16535

The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action...

MAL-2026-13520 Malicious code in @aster110/cc2wechat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a22dda7bf5c10da8b67b359d665b133709826bdebbd6632fc0fcf04551f1efac The package runs a daemon that long-polls Tencent's iLink Bot API ilinkai.weixin.qq.com for incoming WeChat messages and forwards each message body...

SUSE CVE-2026-68494

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...

CVE-2026-71225

A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs over 64 KiB in stateful modes such as Counter CTR or Cipher Block Chaining CBC, the library improperly reuses the Initialization Vector IV for each internal data chunk. A remote attacker could...

EUVD-2025-210619

Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. The application contains hardcoded credentials in the RTSP authentication mechanism. An attacker with network access can use the unchangeable default credentials to access the RTSP video stream, resulting in unauthorized...