CVE-2026-89173 Kingdom Communication Associated｜Smart Video Intercom System - Sensitive Data Exposure

Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate valid user accounts by exploiting differences in system responses...

PT-2026-89796

Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate valid user accounts by exploiting differences in system responses...

PT-2026-89797

Smart Video Intercom System developed by Kingdom Communication Associated has a Missing Brute-force Protection vulnerability. Unauthenticated remote attackers can gain access to valid accounts through a large number of login attempts...

ROS-20260911-73-0111

The vulnerability of the Video component in Google Chrome and Microsoft Edge browsers is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause a service failure through a specially crafted HTML page...

ROS-20260911-73-0132

The vulnerability of the Codecs components in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created video file...

ROS-20260911-73-0121

The vulnerability of the Codecs components in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure using a specially created video file...

ROS-20260911-73-0222

The vulnerability of the Codecs components in Google Chrome and Microsoft Edge relates to writing beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to cause a service failure using a specially created video file...

PT-2026-90450

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Fix null pointer dereference in uvcg video init In uvcg video init, if kthread run worker fails, the error logged uses uvcg err, however, the pointer it uses: video-uvc is not assigned at this point, triggering ...

PT-2026-89798

Smart Video Intercom System developed by Kingdom Communication Associated has a Client-Side Authentication vulnerability. Unauthenticated remote attackers can bypass authentication to access specific pages and obtain partial system configuration values...

PT-2026-90457

In the Linux kernel, the following vulnerability has been resolved: Revert "media: v4l2-dev: fix error handling in video register device" This reverts commit 2a934fdb01db6458288fc9386d3d8ceba6dd551a. The intentions of that patch were good, but it doesn't work. The idea is that if device register...

mistral.rs: Unbounded Remote Media Fetch and Video Frame Expansion DoS

Unbounded Remote Media Fetch and Video Frame Expansion DoS Summary The POST /v1/chat/completions endpoint in mistral.rs fetches attacker-supplied media URLs image, audio, video into server memory with no byte limit, and extracts every frame of a supplied video when numframes is None. An...

CVE-2026-84122

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Audio/Video component...

CVE-2026-88876

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/PlayerSkins/seo.php that allows unauthenticated attackers to access password-protected video sources by calling getSources without password validation. Attackers can request t...

CVE-2026-88875

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 incompletely sanitizes sensitive user fields in the APIName=video response. Video rows include columns joined from the video owner's user record, and API::getapivideo calls removeSensitiveUserFields only when the...

EUVD-2026-75425

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 incompletely sanitizes sensitive user fields in the APIName=video response. Video rows include columns joined from the video owner's user record, and API::getapivideo calls removeSensitiveUserFields only when the...

CVE-2026-88875

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) incompletely sanitizes sensitive user fields in the APIName=video response. The function API::get_api_video() calls removeSensitiveUserFields() only when the caller is neither authenticated nor using a valid API...

CVE-2026-88875 AVideo Incomplete API Sanitization Information Disclosure

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 incompletely sanitizes sensitive user fields in the APIName=video response. Video rows include columns joined from the video owner's user record, and API::getapivideo calls removeSensitiveUserFields only when the...

ffmpeg: FFmpeg: Arbitrary code execution via crafted video in vf_hqdn3d filter

A flaw was found in FFmpeg. A remote attacker can exploit a heap out-of-bounds write vulnerability within the vfhqdn3d filter by providing a specially crafted video file. When filtergraph reinitialization is disabled, the filter allocates undersized memory buffers for video frames. Subsequent...

ROS-20260910-73-0060

The vulnerability of the Media component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability could allow an attacker to cause a service failure using a specially created video file...

PT-2026-89263

The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'bg video service url' Setting in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...