Pexip vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-103110 Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute code remotely as an unprCritical 9.8 · Sep 30, 2026
• CVE-2026-103109 Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigHigh 7.7 · Sep 29, 2026
• CVE-2026-103108 Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to triHigh 7.5 · Sep 29, 2026
• CVE-2026-103106 Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation within an internal Pexip Infinity service that allows an attackeHigh 7.8 · Sep 29, 2026
• CVE-2026-103105 Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper access control on a product-internal API which allows an attacker with local accesHigh 8.8 · Sep 29, 2026
• CVE-2026-103104 Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation which allows a remote attacker to triHigh 7.5 · Sep 29, 2026
• CVE-2026-103102 Pexip Infinity before 41.0 is affected by improper input validation in the signaling implementation which allows a remote attacker to trigger a software abort rHigh 8.6 · Sep 29, 2026
• CVE-2026-103101 Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a malicious attacker to render a Pexip InfinHigh 8.6 · Sep 29, 2026
• CVE-2026-103100 Pexip Infinity before 40.1 is affected by improper input validation in the signaling implementation that allows a malicious attacker to trigger a software abortHigh 7.5 · Sep 29, 2026
• CVE-2026-103099 Pexip Infinity before 41.1 is affected by improper input validation in the media implementation that allows a remote attacker to trigger a software abort resultHigh 7.5 · Sep 29, 2026
• CVE-2025-66443 Pexip Infinity 35.0 through 38.1 before 39.0, in non-default configurations that use Direct Media for WebRTC, has Improper Input Validation in signalling that aHigh 7.5 · Dec 25, 2025
• CVE-2025-66379 Pexip Infinity before 39.0 has Improper Input Validation in the media implementation, allowing a remote attacker to trigger a software abort via a crafted mediaHigh 7.5 · Dec 25, 2025
• CVE-2025-66377 Pexip Infinity before 39.0 has Missing Authentication for a Critical Function in a product-internal API, allowing an attacker (who already has access to executeHigh 7.5 · Dec 25, 2025
• CVE-2025-59683 Pexip Infinity 15.0 through 38.0 before 38.1 has Improper Access Control in the Secure Scheduler for Exchange service, when used with Office 365 Legacy ExchangeHigh 8.2 · Dec 25, 2025
• CVE-2025-48704 Pexip Infinity 35.0 through 37.2 before 38.0 has Improper Input Validation in signalling that allows an attacker to trigger a software abort, resulting in a denHigh 7.5 · Dec 25, 2025
• CVE-2025-32096 Pexip Infinity 33.0 through 37.0 before 37.1 has improper input validation in signaling that allows an attacker to trigger a software abort, resulting in a deniHigh 7.5 · Dec 25, 2025
• CVE-2025-32095 Pexip Infinity before 37.0 has improper input validation in signalling that allows a remote attacker to trigger a software abort via a crafted signalling messagHigh 7.5 · Dec 25, 2025
• CVE-2025-30080 Signalling in Pexip Infinity 29 through 36.2 before 37.0 has improper input validation that allows remote attackers to trigger a temporary denial of service (soHigh 7.5 · Apr 2, 2025
• CVE-2024-37917 Pexip Infinity before 35.0 has improper input validation that allows remote attackers to trigger a denial of service (software abort) via a crafted signalling mHigh 7.5 · Apr 2, 2025
• CVE-2023-31455 Pexip Infinity before 31.2 has Improper Input Validation for RTCP, allowing remote attackers to trigger an abort.High 7.5 · Dec 25, 2023
• CVE-2023-31289 Pexip Infinity before 31.2 has Improper Input Validation for signalling, allowing remote attackers to trigger an abort.High 7.5 · Dec 25, 2023
• CVE-2022-32263 Pexip Infinity before 28.1 allows remote attackers to trigger a software abort via G.719.High 7.5 · Jul 17, 2022
• CVE-2022-29286 Pexip Infinity 27 before 28.0 allows remote attackers to trigger excessive resource consumption and termination because of registrar resource mishandling.High 7.5 · Jul 17, 2022
• CVE-2022-27937 Pexip Infinity before 27.3 allows remote attackers to trigger excessive resource consumption via H.264.High 7.5 · Jul 17, 2022
• CVE-2022-27936 Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via H.323.High 7.5 · Jul 17, 2022