CVE-2026-81028 is a vulnerability in ZLMediaKit's downloadFile API, which allows for a confinement bypass via prefix collision. The API is intended to confine downloads to a set of configured root directories, but due to a flawed prefix comparison, it is possible to serve files from sibling directories that merely start with the configured root string. This issue arises because the relative-path argument [truncated]
CVE-2026-35203 is a high-severity vulnerability in the ZLMediaKit streaming media service framework. The VP9 RTP payload parser in ext-codec/VP9Rtp.cpp reads multiple fields from the RTP payload based on flag bits in the first byte, without verifying that sufficient data exists in the buffer. A crafted VP9 RTP packet with a 1-byte payload (0xFF, all flags set) causes the parser to read past the end of the [truncated]
