Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
530 results · page 1 of 11
Oct 28, 2026An uncontrolled recursion in the MessagePack\BufferUnpacker::unpack() component of rybakit/msgpack v0.11.0 allows attackers to cause a Denial of Service (DoS) vCVE-2026-106972 · Other software · reported by MITRE
An uncontrolled recursion in the MessagePack\BufferUnpacker::unpack() component of rybakit/msgpack v0.11.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack v0.11.0 allows attackers to cause a Denial of Service (DoS) via a crafted inpCVE-2026-106971 · Other software · reported by MITRE
An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack v0.11.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026MessagePack is the serializer implementation for Python msgpack.org.CVE-2026-114613 · Other software · msgpack · reported by GitHubHigh 7.5
MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). Repeated malformed inputs can cause unbounded process memory growth and denial of service in applications that deserialize attacker-controlled MessagePack data. Both unpackb() and the streaming Unpacker API are affected. The pure-Python fallback does not exhibit this leak in the reported tests. This issue is fixed in version 1.2.3.
- Product
- msgpack-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of SerCVE-2025-60476 · Other software · reported by MITREMedium 5.5
A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026A NULL pointer dereference in the gf_ac4_presentation_ch_mode function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause aCVE-2025-60469 · Other software · reported by MITREMedium 5.5
A NULL pointer dereference in the gf_ac4_presentation_ch_mode function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026A segmentation violation in the GetESD function (/isomedia/track.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via suCVE-2025-60497 · Other software · reported by MITREMedium 5.5
A segmentation violation in the GetESD function (/isomedia/track.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026A segmentation violation in the check_media_profile function (/mp4box/mp4box.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service CVE-2025-60493 · Other software · reported by MITREMedium 5.5
A segmentation violation in the check_media_profile function (/mp4box/mp4box.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026A stack overflow in the gf_bifs_dec_node function (/bifs/field_decode.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) vCVE-2025-60492 · Other software · reported by MITREMedium 5.5
A stack overflow in the gf_bifs_dec_node function (/bifs/field_decode.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026A heap use-after-free in the dasher_flush_segment function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (CVE-2025-60491 · Other software · reported by MITREMedium 5.5
A heap use-after-free in the dasher_flush_segment function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026A heap use-after-free in the gf_filter_pid_send_event_downstream function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 2.5 allows attackers to causCVE-2025-60490 · Other software · reported by MITREMedium 5.5
A heap use-after-free in the gf_filter_pid_send_event_downstream function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026A segmentation violation in the gf_isom_get_esd function (/isomedia/isom_read.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of ServiceCVE-2025-60487 · Other software · reported by MITREMedium 5.5
A segmentation violation in the gf_isom_get_esd function (/isomedia/isom_read.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026A use-after-free in the gf_filter_packet_destroy function (/filter_core/filter_pck.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of SeCVE-2025-60478 · Other software · reported by MITREMedium 5.5
A use-after-free in the gf_filter_packet_destroy function (/filter_core/filter_pck.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026An out-of-bounds read in gf_odf_ac4_cfg_dsi_v1 (/odf/descriptors.c) in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service (DoS) vCVE-2025-71438 · Other software · reported by MITREMedium 5.5
An out-of-bounds read in gf_odf_ac4_cfg_dsi_v1 (/odf/descriptors.c) in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026A NULL pointer dereference in the dasher_insert_timeline_entry function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a DenialCVE-2025-60489 · Other software · reported by MITREMedium 5.5
A NULL pointer dereference in the dasher_insert_timeline_entry function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026A NULL pointer dereference in the StatSFVec2f function (/scene_manager/scene_stats.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of SeCVE-2025-60479 · Other software · reported by MITREMedium 5.5
A NULL pointer dereference in the StatSFVec2f function (/scene_manager/scene_stats.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-4 file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026A Floating-Point Exception (FPE) in the reframer_send_packet function (/filters/reframer.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a DenialCVE-2025-60496 · Other software · reported by MITREMedium 5.5
A Floating-Point Exception (FPE) in the reframer_send_packet function (/filters/reframer.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026A segmentation violation in the gf_props_equal_internal function (/filter_core/filter_props.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a DenCVE-2025-60494 · Other software · reported by MITREMedium 5.5
A segmentation violation in the gf_props_equal_internal function (/filter_core/filter_props.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted data file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026A buffer overflow in the gf_ac4_parser_bs function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (CVE-2025-60475 · Other software · reported by MITREMedium 5.5
A buffer overflow in the gf_ac4_parser_bs function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers tCVE-2025-60482 · Other software · reported by MITREMedium 5.5
A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026A heap buffer overflow in the gf_odf_ac4_cfg_alternative_info function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attaCVE-2025-60480 · Other software · reported by MITREMedium 5.5
A heap buffer overflow in the gf_odf_ac4_cfg_alternative_info function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026A segmentation violation in the dump_isom_saps function (/mp4box/filedump.c) of GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-masterallows attackers to cause a DenialCVE-2025-55667 · Other software · reported by MITREMedium 5.5
A segmentation violation in the dump_isom_saps function (/mp4box/filedump.c) of GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-masterallows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pid.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) viaCVE-2025-55654 · Other software · reported by MITREMedium 5.5
A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pid.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_parse_lfrac function (utils/error.c).CVE-2025-55653 · Other software · reported by MITREMedium 5.5
GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_parse_lfrac function (utils/error.c). Processing a crafted MP4 file containing a zero-denominator fraction string causes gf_parse_lfrac() to divide by zero, terminating the process with SIGFPE.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026A heap buffer overflow in the stbl_AddSize function (isomedia/stbl_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplyinCVE-2025-55640 · Other software · reported by MITREMedium 5.5
A heap buffer overflow in the stbl_AddSize function (isomedia/stbl_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026A vulnerability has been found in GPAC up to 26.07.0.CVE-2026-109827 · Other software · reported by VulDBLow 2.1
A vulnerability has been found in GPAC up to 26.07.0. This vulnerability affects the function gf_m2ts_decode_ait of the file src/media_tools/ait.c of the component AIT Parser. Such manipulation leads to out-of-bounds write. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 6d2c21a1a688abb20d0111b608db3b6f44d348f4. Applying a patch is advised to resolve this issue.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026A vulnerability was detected in GPAC up to 26.07.0.CVE-2026-108539 · Other software · reported by VulDBLow 2.1
A vulnerability was detected in GPAC up to 26.07.0. This affects the function gf_fq_pop of the file filter_core/filter_queue.c of the component MP4Box. Performing a manipulation results in use after free. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026A security vulnerability has been detected in GPAC up to 26.07.0.CVE-2026-108538 · Other software · reported by VulDBLow 2.1
A security vulnerability has been detected in GPAC up to 26.07.0. The impacted element is the function gf_mx_v of the file utils/os_thread.c of the component MP4Box. Such manipulation leads to use after free. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026msgpack5 is a msgpack v5 implementation for node.js and the browser.CVE-2026-107302 · Other software · mcollina · reported by GitHubHigh 7.5
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value before validating that the complete five-byte header is available. A truncated map32 header therefore causes a checked out-of-bounds buffer read and throws RangeError instead of IncompleteBufferError, which can unexpectedly terminate a request, stream, or worker in applications that wait for additional bytes after IncompleteBufferError. There is no adjacent-memory disclosure because the buffer implementation checks bounds. This issue is fixed in version 6.1.0.
- Product
- msgpack5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026msgpack5 is a msgpack v5 implementation for node.js and the browser.CVE-2026-107301 · Other software · mcollina · reported by GitHubMedium 6.5
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, constructing msgpack5 with an empty or partial options object disables the default protoAction: 'error' protection. A decoded map containing a __proto__ key can then replace the decoded object's prototype, potentially changing inherited properties or downstream behavior, although Object.prototype is not modified globally. This issue is fixed in version 6.1.0.
- Product
- msgpack5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026msgpack5 is a msgpack v5 implementation for node.js and the browser.CVE-2026-107300 · Other software · mcollina · reported by GitHubHigh 7.5
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to the value count, exhausting the JavaScript call stack, and interrupting the process or stream. This issue is fixed in version 6.1.0.
- Product
- msgpack5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026msgpack5 is a msgpack v5 implementation for node.js and the browser.CVE-2026-107299 · Other software · mcollina · reported by GitHubMedium 5.9
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that cannot make the value valid, allowing a remote peer to exhaust memory. This issue is fixed in version 6.1.0.
- Product
- msgpack5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026msgpack5 is a msgpack v5 implementation for node.js and the browser.CVE-2026-107298 · Other software · mcollina · reported by GitHubMedium 5.3
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth limit, allowing an attacker who can provide MessagePack input to submit deeply nested containers that exhaust the JavaScript call stack and interrupt a process, worker, or request handler. This issue is fixed in version 6.1.0.
- Product
- msgpack5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026msgpack5 is a msgpack v5 implementation for node.js and the browser.CVE-2026-107297 · Other software · mcollina · reported by GitHubMedium 5.9
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack container across many small chunks, causing completed elements to be decoded repeatedly, producing quadratic CPU use and blocking the event loop. This issue is fixed in version 6.1.0.
- Product
- msgpack5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026msgpack5 is a msgpack v5 implementation for node.js and the browser.CVE-2026-107296 · Other software · mcollina · reported by GitHubLow 3.7
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, decoding a negative signed 64-bit integer modifies the corresponding bytes in the caller-provided input buffer while computing the value. Applications that retain or reuse encoded input for integrity checks, logging, or later processing can observe silently corrupted data, while positive integers and other MessagePack value types are unaffected. This issue is fixed in version 6.1.0.
- Product
- msgpack5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026A weakness has been identified in GPAC up to 26.07.0.CVE-2026-103227 · Other software · reported by VulDBMedium 5.3
A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gf_dash_resolve_url of the file src/media_tools/dash_client.c of the component DASH Client. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. Upgrading to version abi-16.26 can resolve this issue. Patch name: 4c8e26f278ff63eec57968f7bc696f604bb0cffd. It is recommended to upgrade the affected component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026A NULL pointer dereference vulnerability exists in the gf_sg_vrml_field_clone() function of GPAC 2d7da22e (26.08-DEV).CVE-2026-88339 · Other software · reported by MITREMedium 5.5
A NULL pointer dereference vulnerability exists in the gf_sg_vrml_field_clone() function of GPAC 2d7da22e (26.08-DEV). The vulnerability occurs when cloning a PROTO default SFImage field with a NULL source pointer. An attacker can provide a specially crafted input file that triggers the condition, resulting in application crash and denial of service.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026A vulnerability was identified in GPAC 26.08-DEV.CVE-2026-93331 · Other software · reported by VulDBMedium 6.9
A vulnerability was identified in GPAC 26.08-DEV. This vulnerability affects the function gf_rtp_parse_ttxt of the file src/ietf/rtp_depacketizer.c of the component RTP Depacketizer. Such manipulation of the argument size leads to out-of-bounds read. It is possible to launch the attack remotely. Upgrading to version abi-16.26 is able to resolve this issue. The name of the patch is 6bb0f64b4d1039c0fecd14ee2c1ee861d8661a68. The affected component should be upgraded.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026A weakness has been identified in GPAC 26.08-DEV.CVE-2026-92475 · Other software · reported by VulDBLow 1.9
A weakness has been identified in GPAC 26.08-DEV. This impacts the function wait_for_header_and_parse of the file src/utils/downloader.c. This manipulation of the argument Content-Range causes out-of-bounds read. The attack requires local access. The exploit has been made available to the public and could be used for attacks. Upgrading to version abi-16.26 will fix this issue. Patch name: c74a3065038ede35c1c7b75fa493a69ef6bcdb84. It is recommended to upgrade the affected component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026A security flaw has been discovered in GPAC 26.08-DEV.CVE-2026-92474 · Other software · reported by VulDBLow 1.9
A security flaw has been discovered in GPAC 26.08-DEV. This affects the function gf_inline_get_proto_lib of the file src/compositor/mpeg4_inline.c of the component Proto Link Handler. The manipulation results in use after free. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. Upgrading to version abi-16.24 mitigates this issue. The patch is identified as e34f4ba349d55cd1849f0bcf4cf46552732e2db7. Upgrading the affected component is recommended.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026A vulnerability was identified in GPAC 26.08-DEV.CVE-2026-92473 · Other software · reported by VulDBLow 1.9
A vulnerability was identified in GPAC 26.08-DEV. The impacted element is the function gf_sg_command_del of the file src/scenegraph/commands.c of the component BIFS Handler. The manipulation leads to use after free. The attack needs to be performed locally. The exploit is publicly available and might be used. Upgrading to version abi-16.24 is sufficient to resolve this issue. The identifier of the patch is e34f4ba349d55cd1849f0bcf4cf46552732e2db7. It is suggested to upgrade the affected component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026A vulnerability was determined in GPAC 26.08-DEV.CVE-2026-92472 · Other software · reported by VulDBLow 1.9
A vulnerability was determined in GPAC 26.08-DEV. The affected element is the function gf_node_deactivate_ex of the file src/scenegraph/base_scenegraph.c of the component MP4Box. Executing a manipulation can lead to use after free. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.24 is sufficient to fix this issue. This patch is called e34f4ba349d55cd1849f0bcf4cf46552732e2db7. The affected component should be upgraded. This issue is distinct from CVE-2026-90827.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026A vulnerability was determined in GPAC 26.07.0.CVE-2026-92399 · Other software · reported by VulDBMedium 5.5
A vulnerability was determined in GPAC 26.07.0. This affects the function rmt_client_handle_ws_frame of the file src/utils/rmt_ws.c of the component WebSocket Handler. Executing a manipulation of the argument payload_size can lead to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.26 is able to mitigate this issue. This patch is called 37bccbb30cf53a0e1a084cea9a1ce422b3ddfe12. Upgrading the affected component is recommended.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026A vulnerability was identified in GPAC up to f1219cde.CVE-2026-91091 · Other software · reported by VulDBLow 2.1
A vulnerability was identified in GPAC up to f1219cde. The impacted element is the function gf_node_list_insert_child of the file scenegraph/base_scenegraph.c of the component Node Insertion. Such manipulation leads to memory corruption. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version abi-16.23 is sufficient to resolve this issue. The name of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. It is suggested to upgrade the affected component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026A vulnerability was determined in GPAC up to f1219cde.CVE-2026-91090 · Other software · reported by VulDBLow 0.9
A vulnerability was determined in GPAC up to f1219cde. The affected element is the function gf_node_activate_ex of the file scenegraph/base_scenegraph.c. This manipulation causes stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 is sufficient to fix this issue. Patch name: 9eb40df4448b88d6a6ce3454657c06f47eff0b24. The affected component should be upgraded.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026A vulnerability was found in GPAC up to f1219cde.CVE-2026-91089 · Other software · reported by VulDBLow 2.1
A vulnerability was found in GPAC up to f1219cde. Impacted is the function gf_node_get_name_and_id of the file scenegraph/base_scenegraph.c. The manipulation results in use after free. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version abi-16.23 is recommended to address this issue. The patch is identified as 49dee5cad329cfed310c1682703df7daa47df31a. You should upgrade the affected component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026A vulnerability has been found in GPAC up to f1219cde.CVE-2026-91088 · Other software · reported by VulDBLow 2.4
A vulnerability has been found in GPAC up to f1219cde. This issue affects the function gf_url_concatenate_ex of the file utils/url.c of the component URL Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. Upgrading to version abi-16.23 is capable of addressing this issue. The identifier of the patch is afca1f1181668d85941d51ed1adf647807d5d975. It is advisable to upgrade the affected component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026A flaw has been found in GPAC up to f1219cde.CVE-2026-91087 · Other software · reported by VulDBMedium 5.5
A flaw has been found in GPAC up to f1219cde. This vulnerability affects the function gf_mo_get_od_id of the file compositor/media_object.c of the component Compositor. Executing a manipulation can lead to use after free. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version abi-16.24 is able to resolve this issue. This patch is called e34f4ba349d55cd1849f0bcf4cf46552732e2db7. Upgrading the affected component is advised.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026A security vulnerability has been detected in GPAC up to f1219cde.CVE-2026-91086 · Other software · reported by VulDBLow 2.1
A security vulnerability has been detected in GPAC up to f1219cde. Affected by this issue is the function mpgviddmx_process of the file filters/reframe_mpgvid.c of the component MPEG Video Reframer. Such manipulation leads to heap-based buffer overflow. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version abi-16.23 can resolve this issue. The name of the patch is afca1f1181668d85941d51ed1adf647807d5d975. Upgrading the affected component is recommended.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026A vulnerability was identified in GPAC 26.07.0.CVE-2026-90827 · Other software · reported by VulDBLow 1.9
A vulnerability was identified in GPAC 26.07.0. This affects the function gf_node_deactivate_ex of the file scenegraph/base_scenegraph.c of the component MP4Box. Such manipulation leads to use after free. The attack must be carried out locally. The exploit is publicly available and might be used. Upgrading to version abi-16.23 is able to mitigate this issue. The name of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. You should upgrade the affected component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026A vulnerability was determined in GPAC 26.07.0.CVE-2026-90826 · Other software · reported by VulDBLow 0.9
A vulnerability was determined in GPAC 26.07.0. Affected by this issue is the function gf_node_del of the file scenegraph/base_scenegraph.c of the component MP4Box. This manipulation causes out-of-bounds read. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 can resolve this issue. Patch name: afca1f1181668d85941d51ed1adf647807d5d975. It is advisable to upgrade the affected component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.