Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,805 results · page 15 of 57
Mar 20, 2026WWBN AVideo is an open source video platform.CVE-2026-33039 · Other software · WWBN · reported by GitHubHigh 8.6
WWBN AVideo is an open source video platform. In versions 25.0 and below, the plugin/LiveLinks/proxy.php endpoint validates user-supplied URLs against internal/private networks using isSSRFSafeURL(), but only checks the initial URL. When the initial URL responds with an HTTP redirect (Location header), the redirect target is fetched via fakeBrowser() without re-validation, allowing an attacker to reach internal services (cloud metadata, RFC1918 addresses) through an attacker-controlled redirect. This issue is fixed in version 26.0.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026WWBN AVideo is an open source video platform.CVE-2026-33038 · Other software · WWBN · reported by GitHubHigh 8.1
WWBN AVideo is an open source video platform. Versions 25.0 and below are vulnerable to unauthenticated application takeover through the install/checkConfiguration.php endpoint. install/checkConfiguration.php performs full application initialization: database setup, admin account creation, and configuration file write, all from an unauthenticated POST input. The only guard is checking whether videos/configuration.php already exists. On uninitialized deployments, any remote attacker can complete the installation with attacker-controlled credentials and an attacker-controlled database, gaining full administrative access. This issue has been fixed in version 26.0.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026WWBN AVideo is an open source video platform.CVE-2026-33037 · Other software · WWBN · reported by GitHubHigh 8.1
WWBN AVideo is an open source video platform. In versions 25.0 and below, the official Docker deployment files (docker-compose.yml, env.example) ship with the admin password set to "password", which is automatically used to seed the admin account during installation, meaning any instance deployed without overriding SYSTEM_ADMIN_PASSWORD is immediately vulnerable to trivial administrative takeover. No compensating controls exist: there is no forced password change on first login, no complexity validation, no default-password detection, and the password is hashed with weak MD5. Full admin access enables user data exposure, content manipulation, and potential remote code execution via file uploads and plugin management. The same insecure-default pattern extends to database credentials (avideo/avideo), compounding the risk. Exploitation depends on operators failing to change the default, a condition likely met in quick-start, demo, and automated deployments. This issue has been fixed in version 26.0.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026WWBN AVideo is an open source video platform.CVE-2026-33035 · Other software · WWBN · reported by GitHubMedium 5.3
WWBN AVideo is an open source video platform. In versions 25.0 and below, there is a reflected XSS vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser. User input from a URL parameter flows through PHP's json_encode() into a JavaScript function that renders it via innerHTML, bypassing encoding and achieving full script execution. The vulnerability is caused by two issues working together: unescaped user input passed to JavaScript (videoNotFound.php), and innerHTML rendering HTML tags as executable DOM (script.js). The attack can be escalated to steal session cookies, take over accounts, phish credentials via injected login forms, spread self-propagating payloads, and compromise admin accounts — all by exploiting the lack of proper input sanitization and cookie security (e.g., missing HttpOnly flag on PHPSESSID). The issue has been fixed in version 26.0.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026AVideo is a video-sharing Platform.CVE-2026-33025 · Other software · WWBN · reported by GitHubHigh 8.6
AVideo is a video-sharing Platform. Versions prior to 8.0 contain a SQL Injection vulnerability in the getSqlFromPost() method of Object.php. The $_POST['sort'] array keys are used directly as SQL column identifiers inside an ORDER BY clause. Although real_escape_string() was applied, it only escapes string-context characters (quotes, null bytes) and provides no protection for SQL identifiers — making it entirely ineffective here. This issue has been fixed in version 8.0. To workaround this issue without upgrading, operators can apply a WAF rule to block POST requests where any sort[*] key contains characters outside [A-Za-z0-9_]. Alternatively, restrict access to the queue view (queue.json.php, index.php) to trusted IP ranges only.
- Product
- AVideo-Encoder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026AVideo is a video-sharing Platform.CVE-2026-33024 · Other software · WWBN · reported by GitHubCritical 9.3
AVideo is a video-sharing Platform. Versions prior to 8.0 contain a Server-Side Request Forgery vulnerability (CWE-918) in the public thumbnail endpoints getImage.php and getImageMP4.php. Both endpoints accept a base64Url GET parameter, base64-decode it, and pass the resulting URL to ffmpeg as an input source without any authentication requirement. The prior validation only checked that the URL was syntactically valid (FILTER_VALIDATE_URL) and started with http(s)://. This is insufficient: an attacker can supply URLs such as http://169.254.169.254/latest/meta-data/ (AWS/cloud instance metadata), http://192.168.x.x/, or http://127.0.0.1/ to make the server reach internal network resources. The response is not directly returned (blind), but timing differences and error logs can be used to infer results. The issue has been fixed in version 8.0.
- Product
- AVideo-Encoder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2026ClipBucket v5 is an open source video sharing platform.CVE-2026-32321 · Other software · MacWarrior · reported by GitHubHigh 8.8
ClipBucket v5 is an open source video sharing platform. An authenticated time-based blind SQL injection vulnerability exists in ClipBucket prior to 5.5.3 #80 within the `actions/ajax.php` endpoint. Due to insufficient input sanitization of the `userid` parameter, an authenticated attacker can execute arbitrary SQL queries, leading to full database disclosure and potential administrative account takeover. Version 5.5.3 #80 fixes the issue.
- Product
- clipbucket-v5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2026music-metadata is a metadata parser for audio and video media files.CVE-2026-32256 · Other software · Borewit · reported by GitHubHigh 7.5
music-metadata is a metadata parser for audio and video media files. Prior to version 11.12.3, music-metadata's ASF parser (`parseExtensionObject()` in `lib/asf/AsfParser.ts:112-158`) enters an infinite loop when a sub-object inside the ASF Header Extension Object has `objectSize = 0`. Version 11.12.3 fixes the issue.
- Product
- music-metadata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026Out-of-bounds read in FFmpeg 8.0 and 8.0.1 RV60 video decoder (libavcodec/rv60dec.c).CVE-2025-69693 · Other software · Ffmpeg · reported by MITREMedium 5.4
Out-of-bounds read in FFmpeg 8.0 and 8.0.1 RV60 video decoder (libavcodec/rv60dec.c). The quantization parameter (qp) validation at line 2267 only checks the lower bound (qp < 0) but is missing upper bound validation. The qp value can reach 65 (base value 63 from 6-bit frame header + offset +2 from read_qp_offset) while the rv60_qp_to_idx array has size 64 (valid indices 0-63). This results in out-of-bounds array access at lines 1554 (decode_cbp8), 1655 (decode_cbp16), and 1419/1421 (get_c4x4_set), potentially leading to memory disclosure or crash. A previous fix in commit 61cbcaf93f added validation only for intra frames. This vulnerability affects the released versions 8.0 (released 2025-08-22) and 8.0.1 (released 2025-11-20) and is fixed in git master commit 8abeb879df which will be included in FFmpeg 8.1.
- Product
- Ffmpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2026MAS Videos: Missing AuthorizationCVE-2026-32348 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in MadrasThemes MAS Videos masvideos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MAS Videos: from n/a through <= 1.3.2.
- Product
- MAS Videos
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update MAS Videos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2026An SQL injection vulnerability has been reported to affect Video Station.CVE-2024-14025 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 0.1
An SQL injection vulnerability has been reported to affect Video Station. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.2 and later
- Product
- Video Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026An improper certificate validation vulnerability has been reported to affect Video Station.CVE-2024-14024 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 0.1
An improper certificate validation vulnerability has been reported to affect Video Station. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Video Station 5.8.2 and later
- Product
- Video Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Heap buffer overflow in the Audio/Video: Playback component in Firefox for Android.CVE-2026-3845 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Heap buffer overflow in the Audio/Video: Playback component in Firefox for Android. This vulnerability was fixed in Firefox 148.0.2.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Mar 10, 2026WWBN AVideo is an open source video platform.CVE-2026-30885 · Other software · WWBN · reported by GitHubMedium 5.5
WWBN AVideo is an open source video platform. Prior to 25.0, the /objects/playlistsFromUser.json.php endpoint returns all playlists for any user without requiring authentication or authorization. An unauthenticated attacker can enumerate user IDs and retrieve playlist information including playlist names, video IDs, and playlist status for any user on the platform. This vulnerability is fixed in 25.0.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2026A security vulnerability has been detected in Tiandy Video Surveillance System 视频监控平台 7.17.0.CVE-2026-3797 · Other software · Tiandy · reported by VulDBLow 2.1
A security vulnerability has been detected in Tiandy Video Surveillance System 视频监控平台 7.17.0. The impacted element is the function uploadFile of the file /src/com/tiandy/easy7/core/rest/CLS_REST_File.java. The manipulation of the argument fileName leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Video Surveillance System 视频监控平台
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2026Show YouTube video: Stored Cross-Site ScriptingCVE-2026-1825 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Show YouTube video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'syv' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Show YouTube video
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Show YouTube video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 7, 2026Paid Videochat Turnkey Site – HTML5 PPV Live Webcams: Privilege EscalationCVE-2025-8899 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Paid Videochat Turnkey Site – HTML5 PPV Live Webcams plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.3.20. This is due to videowhisper_register_form() function not restricting user roles that can be set during registration. This makes it possible for authenticated attackers, with Author-level access and above, to create posts/pages with the registration form and administrator set as the role and subsequently use that form to register an administrator account. This can also be exploited by contributors, but is far less likely to be successful because an administrator would need to approve the form with the administrator role for the attack to be successful.
- Product
- Paid Videochat Turnkey Site – HTML5 PPV Live Webcams
- Affected
- up to 7.3.20
- What to do
- Affects up to 7.3.20. Update Paid Videochat Turnkey Site – HTML5 PPV Live Webcams to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 6, 2026AVideo is a video-sharing Platform software.CVE-2026-29058 · Other software · WWBN · reported by GitHubCritical 9.8
AVideo is a video-sharing Platform software. Prior to version 7.0, an unauthenticated attacker can execute arbitrary OS commands on the server by injecting shell command substitution into the base64Url GET parameter. This can lead to full server compromise, data exfiltration (e.g., configuration secrets, internal keys, credentials), and service disruption. This issue has been patched in version 7.0.
- Product
- AVideo-Encoder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2026Home-Gallery.org is a self-hosted open-source web gallery to browse personal photos and videos.CVE-2026-28679 · Other software · xemle · reported by GitHubHigh 8.6
Home-Gallery.org is a self-hosted open-source web gallery to browse personal photos and videos. Prior to version 1.21.0, when a user requests a download, the application does not verify whether the requested file is located within the media source directory, which can result in sensitive system files being downloadable as well. This issue has been patched in version 1.21.0.
- Product
- home-gallery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026WWBN AVideo is an open source video platform.CVE-2026-29093 · Other software · WWBN · reported by GitHubHigh 8.1
WWBN AVideo is an open source video platform. Prior to version 24.0, the official docker-compose.yml publishes the memcached service on host port 11211 (0.0.0.0:11211) with no authentication, while the Dockerfile configures PHP to store all user sessions in that memcached instance. An attacker who can reach port 11211 can read, modify, or flush session data — enabling session hijacking, admin impersonation, and mass session destruction without any application-level authentication. This issue has been patched in version 24.0.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026WWBN AVideo is an open source video platform.CVE-2026-28502 · Other software · WWBN · reported by GitHubCritical 9.3
WWBN AVideo is an open source video platform. Prior to version 24.0, an authenticated Remote Code Execution (RCE) vulnerability was identified in AVideo related to the plugin upload/import functionality. The issue allowed an authenticated administrator to upload a specially crafted ZIP archive containing executable server-side files. Due to insufficient validation of extracted file contents, the archive was extracted directly into a web-accessible plugin directory, allowing arbitrary PHP code execution. This issue has been patched in version 24.0.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026WWBN AVideo is an open source video platform.CVE-2026-28501 · Other software · WWBN · reported by GitHubCritical 9.8
WWBN AVideo is an open source video platform. Prior to version 24.0, an unauthenticated SQL Injection vulnerability exists in AVideo within the objects/videos.json.php and objects/video.php components. The application fails to properly sanitize the catName parameter when it is supplied via a JSON-formatted POST request body. Because JSON input is parsed and merged into $_REQUEST after global security checks are executed, the payload bypasses the existing sanitization mechanisms. This issue has been patched in version 24.0.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2026All-in-One Video Gallery: Reflected Cross-Site ScriptingCVE-2026-1706 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The All-in-One Video Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'vi' parameter in all versions up to, and including, 4.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- All-in-One Video Gallery
- Affected
- up to 4.7.1
- What to do
- Affects up to 4.7.1. Update All-in-One Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 3, 2026An issue in Step-Video-T2V allows a remote attacker to execute arbitrary code via the /vae-api , /caption-api , feature = pickle.loads(request.get_data()) compoCVE-2025-57622 · Other software · reported by MITRECritical 9.8
An issue in Step-Video-T2V allows a remote attacker to execute arbitrary code via the /vae-api , /caption-api , feature = pickle.loads(request.get_data()) component
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026ClipBucket v5 is an open source video sharing platform.CVE-2026-28354 · Other software · MacWarrior · reported by GitHubMedium 5.7
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 #59, collection item operations are vulnerable to authorization flaws, allowing a normal authenticated user to modify another user’s collection items. This affects both add item (/actions/add_to_collection.php) due to missing authorization checks and delete item (/manage_collections.php?mode=manage_items...) due to a broken ownership check in removeItemFromCollection(). As a result, attackers can insert and remove items from collections they do not own. Version 5.5.3 #59 fixes the issue.
- Product
- clipbucket-v5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026ClipBucket v5 is an open source video sharing platform.CVE-2026-26997 · Other software · MacWarrior · reported by GitHubLow 2
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 #59, a normal authenticated user can store the XSS payload. The payload is triggered by administrator. Version 5.5.3 #59 fixes the issue.
- Product
- clipbucket-v5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026VideoLAN VLC for Android prior to version 3.7.0 contains an authentication bypass in the Remote Access Server feature due to missing or insufficient rate limitiCVE-2026-26227 · Other software · VideoLAN · reported by VulnCheckMedium 6.3
VideoLAN VLC for Android prior to version 3.7.0 contains an authentication bypass in the Remote Access Server feature due to missing or insufficient rate limiting on one-time password (OTP) verification. The Remote Access Server uses a 4-digit OTP and does not enforce effective throttling or lockout within the OTP validity window, allowing an attacker with network reachability to the server to repeatedly attempt OTP verification until a valid user_session cookie is issued. Successful exploitation results in unauthorized access to the Remote Access interface, limited to media files explicitly shared by the VLC for Android user.
- Product
- VLC for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvideolan.org
Feb 26, 2026VideoLAN VLC for Android prior to version 3.7.0 contains a path traversal vulnerability in the Remote Access Server routing for the authenticated endpoint GET /CVE-2026-26228 · Other software · VideoLAN · reported by VulnCheckLow 2.3
VideoLAN VLC for Android prior to version 3.7.0 contains a path traversal vulnerability in the Remote Access Server routing for the authenticated endpoint GET /download. The file query parameter is concatenated into a filesystem path under the configured download directory without canonicalization or directory containment checks, allowing an authenticated attacker with network reachability to the Remote Access Server to request files outside the intended directory. The impact is bounded by the Android application sandbox and storage restrictions, typically limiting exposure to app-internal and app-specific external storage.
- Product
- VLC for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvideolan.org
Feb 24, 2026WWBN AVideo is an open source video platform.CVE-2026-27732 · Other software · WWBN · reported by GitHubHigh 8.6
WWBN AVideo is an open source video platform. Prior to version 22.0, the `aVideoEncoder.json.php` API endpoint accepts a `downloadURL` parameter and fetches the referenced resource server-side without proper validation or an allow-list. This allows authenticated users to trigger server-side requests to arbitrary URLs (including internal network endpoints). An authenticated attacker can leverage SSRF to interact with internal services and retrieve sensitive data (e.g., internal APIs, metadata services), potentially leading to further compromise depending on the deployment environment. This issue has been fixed in AVideo version 22.0.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026WWBN AVideo is an open source video platform.CVE-2026-27568 · Other software · WWBN · reported by GitHubMedium 5.1
WWBN AVideo is an open source video platform. Prior to version 21.0, AVideo allows Markdown in video comments and uses Parsedown (v1.7.4) without Safe Mode enabled. Markdown links are not sufficiently sanitized, allowing `javascript:` URIs to be rendered as clickable links. An authenticated low-privilege attacker can post a malicious comment that injects persistent JavaScript. When another user clicks the link, the attacker can perform actions such as session hijacking, privilege escalation (including admin takeover), and data exfiltration. Version 21.0 contains a fix. As a workaround, validate and block unsafe URI schemes (e.g., `javascript:`) before rendering Markdown, and enable Parsedown Safe Mode.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026Incorrect boundary conditions in the Audio/Video: GMP component.CVE-2026-2788 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Feb 24, 2026Integer overflow in the Audio/Video component.CVE-2026-2774 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Feb 24, 2026Use-after-free in the Audio/Video: Playback component.CVE-2026-2772 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Feb 24, 2026Incorrect boundary conditions in the WebRTC: Audio/Video component.CVE-2026-2757 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Incorrect boundary conditions in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Feb 23, 2026yt-dlp is a command-line audio/video downloader.CVE-2026-26331 · Other software · yt-dlp · reported by GitHubHigh 8.8
yt-dlp is a command-line audio/video downloader. Starting in version 2023.06.21 and prior to version 2026.02.21, when yt-dlp's `--netrc-cmd` command-line option (or `netrc_cmd` Python API parameter) is used, an attacker could achieve arbitrary command injection on the user's system with a maliciously crafted URL. yt-dlp maintainers assume the impact of this vulnerability to be high for anyone who uses `--netrc-cmd` in their command/configuration or `netrc_cmd` in their Python scripts. Even though the maliciously crafted URL itself will look very suspicious to many users, it would be trivial for a maliciously crafted webpage with an inconspicuous URL to covertly exploit this vulnerability via HTTP redirect. Users without `--netrc-cmd` in their arguments or `netrc_cmd` in their scripts are unaffected. No evidence has been found of this exploit being used in the wild. yt-dlp version 2026.02.21 fixes this issue by validating all netrc "machine" values and raising an error upon unexpected input. As a workaround, users who are unable to upgrade should avoid using the `--netrc-cmd` command-line option (or `netrc_cmd` Python API parameter), or they should at least not pass a placeholder (`
- Product
- yt-dlp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026A security flaw has been discovered in Tiandy Video Surveillance System 视频监控平台 7.17.0.CVE-2026-2985 · Other software · Tiandy · reported by VulDBLow 2.1
A security flaw has been discovered in Tiandy Video Surveillance System 视频监控平台 7.17.0. This impacts the function downloadImage of the file /com/tiandy/easy7/core/bo/CLSBODownLoad.java. Performing a manipulation of the argument urlPath results in server-side request forgery. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Video Surveillance System 视频监控平台
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026Foscam Video Management System 1.1.6.6 contains a buffer overflow vulnerability in the UID field that allows local attackers to crash the application by supplyiCVE-2019-25437 · Other software · Foscam · reported by VulnCheckMedium 6.7
Foscam Video Management System 1.1.6.6 contains a buffer overflow vulnerability in the UID field that allows local attackers to crash the application by supplying an excessively long string. Attackers can input a 5000-character buffer into the UID parameter during device addition to trigger an application crash when the Login Check function is invoked.
- Product
- Foscam Video Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comfoscam.com
Feb 19, 2026PJSIP is a free and open source multimedia communication library.CVE-2026-26203 · Other software · pjsip · reported by GitHubMedium 5.1
PJSIP is a free and open source multimedia communication library. Versions prior to 2.17 have a critical heap buffer underflow vulnerability in PJSIP's H.264 packetizer. The bug occurs when processing malformed H.264 bitstreams without NAL unit start codes, where the packetizer performs unchecked pointer arithmetic that can read from memory located before the allocated buffer. Version 2.17 contains a patch for the issue.
- Product
- pjmedia-video
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026Foscam Video Management System 1.1.4.9 contains a denial of service vulnerability in the username input field that allows attackers to crash the application.CVE-2019-25353 · Other software · Diy Security SL · reported by VulnCheckMedium 4.6
Foscam Video Management System 1.1.4.9 contains a denial of service vulnerability in the username input field that allows attackers to crash the application. Attackers can overwrite the username with a 520-byte buffer of repeated 'A' characters to trigger an application crash during device login.
- Product
- Foscam Video Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comfoscam.es
Feb 18, 2026Video Share VOD – Turnkey Video Site Builder Script: Stored Cross-Site ScriptingCVE-2025-13727 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in all versions up to, and including, 2.7.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Video Share VOD – Turnkey Video Site Builder Script
- Affected
- up to 2.7.11
- What to do
- Affects up to 2.7.11. Update Video Share VOD – Turnkey Video Site Builder Script to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 18, 2026Video Conferencing with Zoom: Contains an AJAX handler that has its nonce verification commented outCVE-2026-1368 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Video Conferencing with Zoom WordPress plugin before 4.6.6 contains an AJAX handler that has its nonce verification commented out, allowing unauthenticated attackers to generate valid Zoom SDK signatures for any meeting ID and retrieve the site's Zoom SDK key.
- Product
- Video Conferencing with Zoom
- Fixed in
- 4.6.6
- What to do
- Update Video Conferencing with Zoom to 4.6.6 or newer.
Feb 14, 2026Modula Image Gallery – Photo Grid & Video Gallery: Authorization bypassCVE-2026-1254 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.6. This is due to the plugin not properly verifying that a user is authorized to modify specific posts before updating them via the REST API. This makes it possible for authenticated attackers, with contributor level access and above, to update the title, excerpt, and content of arbitrary posts by passing post IDs in the modulaImages field when editing a gallery.
- Product
- Modula Image Gallery – Photo Grid & Video Gallery
- Affected
- up to 2.13.6
- What to do
- Affects up to 2.13.6. Update Modula Image Gallery – Photo Grid & Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 12, 2026ClipBucket v5 is an open source video sharing platform.CVE-2026-26005 · Other software · MacWarrior · reported by GitHubMedium 5
ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #45, in Clip Bucket V5, The Remote Play allows creating video entries that reference external video URLs without uploading the video files to the server. However, by specifying an internal network host in the video URL, an SSRF can be triggered, causing GET requests to be sent to internal servers. An attacker can exploit this to scan the internal network. Even a regular (non-privileged) user can carry out the attack.
- Product
- clipbucket-v5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2026Debug code left active in AMD's Video Decoder Engine Firmware (VCN FW) could allow a attacker to submit a maliciously crafted command causing the VCN FW to perfCVE-2024-36319 · Other software · AMD · reported by psirt@amd.comMedium 6.3
Debug code left active in AMD's Video Decoder Engine Firmware (VCN FW) could allow a attacker to submit a maliciously crafted command causing the VCN FW to perform read/writes HW registers, potentially impacting confidentiality, integrity and availabilability of the system.
- Product
- AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics; AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026Allok Video Converter 4.6.1217 contains a stack overflow vulnerability in the License Name input field that allows attackers to execute arbitrary code.CVE-2020-37184 · Other software · Allok Soft · reported by VulnCheckHigh 8.4
Allok Video Converter 4.6.1217 contains a stack overflow vulnerability in the License Name input field that allows attackers to execute arbitrary code. Attackers can craft a specially designed payload to overwrite SEH handlers and execute system commands by injecting malicious bytecode into the input field.
- Product
- Allok Video Converter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordalloksoft.comexploit-db.com
Feb 11, 2026AVideo Platform 8.1 contains an information disclosure vulnerability that allows attackers to enumerate user details through the playlistsFromUser.json.php endpCVE-2020-37173 · Other software · AVideo · reported by VulnCheckHigh 8.7
AVideo Platform 8.1 contains an information disclosure vulnerability that allows attackers to enumerate user details through the playlistsFromUser.json.php endpoint. Attackers can retrieve sensitive user information including email, password hash, and administrative status by manipulating the users_id parameter.
- Product
- AVideo Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanCVE-2020-37172 · Other software · AVideo · reported by VulnCheckHigh 8.5
AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanism. Attackers can craft malicious requests to the recoverPass endpoint using the user's recovery token to change account credentials without authentication.
- Product
- AVideo Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanCVE-2020-37158 · Other software · AVideo · reported by VulnCheckHigh 8.5
AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanism. Attackers can craft malicious requests to the recoverPass endpoint using the user's recovery token to change account credentials without authentication.
- Product
- AVideo Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026Videospirecore Theme: Privilege escalationCVE-2025-15096 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The 'Videospirecore Theme Plugin' plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.6. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
- Product
- Videospirecore Theme
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Videospirecore Theme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Feb 10, 2026ClipBucket v5 is an open source video sharing platform.CVE-2026-25728 · Other software · MacWarrior · reported by GitHubCritical 9.3
ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #40, a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability exists in ClipBucket's avatar and background image upload functionality. The application moves uploaded files to a web-accessible location before validating them, creating a window where an attacker can execute arbitrary PHP code before the file is deleted. The uploaded file was moved to a web-accessible path via move_uploaded_file(), then validated via ValidateImage(). If validation failed, the file was deleted via @unlink(). This vulnerability is fixed in 5.5.3 - #40.
- Product
- clipbucket-v5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.