📺 FFmpeg DASH Demuxer Vulnerable to Negative Array Index
Patch FFmpeg systems that consume live DASH streams from untrusted or externally controlled servers as a high priority. Media gateways, transcoders, and ingestion services are the most exposed.
CVE-2026-75146 is a HIGH-severity out-of-bounds read in the FFmpeg DASH demuxer before commit 65b0dab. A malicious or misconfigured live DASH server can decrease startNumber during a manifest refresh, driving the sequence number negative and causing a negative fragments-array index. The vulnerability has a CVSS score of 8.1.
🔗 Read more 🔗
Source: NVD
🎞️ FFmpeg AV1 RTP Packetizer Out-of-Bounds Read
Teams using FFmpeg to process or packetize untrusted AV1 content for RTP should update to a fixed build promptly. Prioritize internet-facing or automated media-processing systems where attackers can supply crafted input.
CVE-2026-75147 affects FFmpeg before commit 983dae9 and is a HIGH-severity out-of-bounds read in the AV1 RTP packetizer. A crafted AV1 OBU can cause a size counter to wrap and make the packetizer dereference memory beyond the packet buffer. The vulnerability has a CVSS score of 7.1.
🔗 Read more 🔗
Source: NVD
💥 FFmpeg VC-2 RTP Packetizer Heap Overflow
Organizations packetizing untrusted VC-2 or Dirac media into RTP should move to a patched FFmpeg build promptly. Treat exposed media-processing pipelines as higher priority because malformed content can trigger memory corruption.
CVE-2026-75144 affects FFmpeg before commit 1cdeb3c and is a HIGH-severity heap buffer overflow in the VC-2/Dirac RTP packetizer. Crafted Dirac data can supply an oversized data-unit or fragment length that is copied into a fixed-size buffer without an adequate bounds check, causing memory corruption. The vulnerability has a CVSS score of 7.8.
🔗 Read more 🔗
Source: NVD
🚨 Critical FFmpeg RIST Reader Heap Buffer Overflow
Patch any FFmpeg deployment that accepts RIST traffic with very high urgency, especially network-reachable ingest systems. The remote trigger and critical memory-corruption impact make this one of the highest-priority FFmpeg fixes in this set.
CVE-2026-75143 is a CRITICAL heap buffer overflow in the FFmpeg RIST protocol reader before commit 1c10bcc. The vulnerable librist_read() path can copy a received payload larger than the caller-provided destination buffer, including through the async:rist:// URL scheme. A remote RIST sender can trigger the overflow, and the vulnerability has a CVSS score of 9.8.
🔗 Read more 🔗
Source: NVD
📼 FFmpeg MPEG-PS Muxer Stack Buffer Overflow
Patch FFmpeg installations that mux attacker-controlled or otherwise untrusted media into MPEG-PS. Automated conversion services and upload-processing backends should be handled promptly because crafted multi-stream input can trigger the flaw.
CVE-2026-75142 affects FFmpeg before commit 9d786e4 and is a HIGH-severity stack buffer overflow in the MPEG-PS muxer. Input containing more streams than a fixed-size stack buffer can accommodate causes the buffer to overflow during muxing. The vulnerability has a CVSS score of 7.8.
🔗 Read more 🔗
Source: NVD
🎥 FFmpeg HEVC hvcC Writer Heap Buffer Overflow
Update FFmpeg systems that mux untrusted HEVC content, particularly upload processors and transcoding services. The issue involves memory corruption, so exposed media workflows should not defer the fix.
CVE-2026-75141 is a HIGH-severity heap buffer overflow in the FFmpeg hvcC box writer before commit acf5d7c. A crafted HEVC file containing more NAL units of one type than the count field can represent can overflow that count and trigger a heap buffer overflow during muxing. The vulnerability has a CVSS score of 7.8.
🔗 Read more 🔗
Source: NVD
🚨 TrueConf Server Sandbox Escape Enables Remote Code Execution
Administrators running affected TrueConf servers should patch with critical urgency and restrict access to port 4307/TCP until remediation is complete. Internet-exposed systems deserve immediate attention because exploitation does not require authentication.
CVE-2026-72530 is a CRITICAL vulnerability affecting TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier. An unauthenticated remote attacker with network access to port 4307/TCP can use a specially crafted script to escape the isolated environment and execute arbitrary code on the host. The vulnerability has a CVSS score of 9.0.
🔗 Read more 🔗
Source: NVD
⚠️ Critical TrueConf Flaw Allows Unauthenticated Script Execution
Affected TrueConf servers should be patched immediately, with port 4307/TCP restricted from untrusted networks as an interim control. The unauthenticated remote attack path makes exposed servers especially urgent.
CVE-2026-72529 is a CRITICAL vulnerability in TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier. A remote unauthenticated attacker with access to port 4307/TCP can invoke an undocumented function to execute an arbitrary script. The vulnerability has a CVSS score of 9.8.
🔗 Read more 🔗
Source: NVD
☸️ Search-v2-operator Flaw Can Lead to Full Cluster Compromise
Kubernetes administrators using search-v2-operator should remediate this urgently and review who can edit the affected Custom Resources. Environments granting CR-edit permissions to less-trusted users are at particular risk of escalation to cluster-wide control.
CVE-2026-71470 is a CRITICAL privilege-escalation vulnerability in search-v2-operator. A privileged Custom Resource editor can manipulate fields such as imageOverride, arguments, and environment variables to mount arbitrary secrets or substitute an attacker-controlled container image. Because the ServiceAccount has extensive impersonation permissions, exploitation can lead to full cluster compromise, and the vulnerability has a CVSS score of 9.1.
🔗 Read more 🔗
Source: NVD
☁️ Flow-Like Azure SAS Permission Flaw Enables Blob Modification
Self-hosted Flow-Like users on Azure Blob Storage should update to version 1.0.4 or a newer fixed build promptly. Prioritize environments where workflow execution rights are deliberately granted to users who should not have file write or delete access.
CVE-2026-50173 is a HIGH-severity authorization flaw affecting self-hosted Flow-Like deployments before version 1.0.4 when Azure Blob Storage is used. Authenticated app members with ExecuteEvents but without file permissions can obtain SAS credentials that still allow writing and deleting blobs under the app content prefix. Flow-Like Studio and the hosted Flow-Like Web App are not affected, and the vulnerability has a CVSS score of 7.2.
🔗 Read more 🔗
Source: NVD
🛡️ Wazuh Cluster Path Flaw Can Escalate to Root Code Execution
Wazuh operators with clustered deployments should upgrade urgently to a fixed release and treat possession of the cluster Fernet key as highly privileged. Review cluster peers and key exposure because a malicious or compromised peer can turn this flaw into root-level code execution.
CVE-2026-49441 is a CRITICAL Wazuh vulnerability affecting versions from 4.3.0 until 4.14.6 and 5.0.0-beta3. A cluster peer holding the shared Fernet key can abuse an insufficiently confined file path to overwrite security-sensitive files such as /var/ossec/etc/ossec.conf, potentially configuring commands that execute as root after a service reload. The issue is fixed in versions 4.14.6 and 5.0.0-beta3 and has a CVSS score of 9.1.
🔗 Read more 🔗
Source: NVD
🔑 Wazuh Cluster Traversal Can Expose API Private Keys
Clustered Wazuh deployments should upgrade urgently and investigate any possibility that the shared Fernet key or a cluster peer has been compromised. Exposure of the API private key can enable forged administrator access without creating a new account.
CVE-2026-48162 is a CRITICAL vulnerability affecting Wazuh versions from 4.0.0 until 4.14.6 and 5.0.0-beta3. A cluster peer holding the shared Fernet key can exploit an attacker-controlled path in DistributedAPI.send_tmp_file() to retrieve arbitrary readable files, including the REST API private key. That key can be used to forge administrator API tokens offline, and the issue is fixed in versions 4.14.6 and 5.0.0-beta3 with a CVSS score of 9.1.
🔗 Read more 🔗
Source: NVD