Veille CVE

Semaine du 31 août au 6 septembre 2026

4 CVE

Critique 2 Élevée 1 Moyenne 0 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Ffmpeg ffmpeg » ✕
  1. CVE-2026-86189 9.8 Critique

    WWBN AVideo

    WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previously issued ciphertext as a notifyCode token, which is decrypted but never validated, to bypass authentication and write files to the application root and subdirectories.

  2. CVE-2026-85696 9.8 Critique

    OpenTalker SadTalker

    SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to break out of quoted arguments and execute arbitrary system commands when video generation occurs.

  3. CVE-2026-52295 2.9 Faible

    FFmpeg · Ffmpeg ffmpeg

    FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c.

  4. CVE-2026-10195 8.8 Élevée

    fs-code FS Poster - WordPress Social media Auto Poster & Scheduler [Facebook, Instagram, Twitter, Pinterest]

    The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 8.0.1. This is due to insufficient input sanitization of the FFmpeg path parameter before passing it to the exec() function, combined with missing authorization checks on the REST API endpoints. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary commands on the underlying server.