CVE-2025-66443 | High | 7.5 | 2025-12-25 | Pexip Infinity 35.0 through 38.1 before 39.0, in non-default configurations that use Direct Media for WebRTC, has Improper Input Validation in signalling that… |
CVE-2025-66379 | High | 7.5 | 2025-12-25 | Pexip Infinity before 39.0 has Improper Input Validation in the media implementation, allowing a remote attacker to trigger a software abort via a crafted medi… |
CVE-2025-66378 | Medium | 5.9 | 2025-12-25 | Pexip Infinity 38.0 and 38.1 before 39.0 has insufficient access control in the RTMP implementation, allowing an attacker to disconnect RTMP streams traversing… |
CVE-2025-66377 | High | 7.5 | 2025-12-25 | Pexip Infinity before 39.0 has Missing Authentication for a Critical Function in a product-internal API, allowing an attacker (who already has access to execut… |
CVE-2025-59683 | High | 8.2 | 2025-12-25 | Pexip Infinity 15.0 through 38.0 before 38.1 has Improper Access Control in the Secure Scheduler for Exchange service, when used with Office 365 Legacy Exchang… |
CVE-2025-49088 | Medium | 5.9 | 2025-12-25 | Pexip Infinity 32.0 through 37.1 before 37.2, in certain configurations of OTJ (One Touch Join) for Teams SIP Guest Join, has Improper Input Validation in the… |
CVE-2025-48704 | High | 7.5 | 2025-12-25 | Pexip Infinity 35.0 through 37.2 before 38.0 has Improper Input Validation in signalling that allows an attacker to trigger a software abort, resulting in a de… |
CVE-2025-32096 | High | 7.5 | 2025-12-25 | Pexip Infinity 33.0 through 37.0 before 37.1 has improper input validation in signaling that allows an attacker to trigger a software abort, resulting in a den… |
CVE-2025-32095 | High | 7.5 | 2025-12-25 | Pexip Infinity before 37.0 has improper input validation in signalling that allows a remote attacker to trigger a software abort via a crafted signalling messa… |
CVE-2025-30080 | High | 7.5 | 2025-04-02 | Signalling in Pexip Infinity 29 through 36.2 before 37.0 has improper input validation that allows remote attackers to trigger a temporary denial of service (s… |
CVE-2024-37917 | High | 7.5 | 2025-04-02 | Pexip Infinity before 35.0 has improper input validation that allows remote attackers to trigger a denial of service (software abort) via a crafted signalling… |
CVE-2024-33850 | Medium | 4.3 | 2024-06-10 | Pexip Infinity before 34.1 has Improper Access Control for persons in a waiting room. They can see the conference roster list, and perform certain actions that… |
CVE-2023-40236 | Medium | 5.3 | 2023-12-25 | In Pexip VMR self-service portal before 3, the same SSH host key is used across different customers' installations, which allows authentication bypass. |
CVE-2023-37225 | Medium | 6.1 | 2023-12-25 | Pexip Infinity before 32 allows Webapp1 XSS via preconfigured links. |
CVE-2023-31455 | High | 7.5 | 2023-12-25 | Pexip Infinity before 31.2 has Improper Input Validation for RTCP, allowing remote attackers to trigger an abort. |
CVE-2023-31289 | High | 7.5 | 2023-12-25 | Pexip Infinity before 31.2 has Improper Input Validation for signalling, allowing remote attackers to trigger an abort. |
CVE-2022-32263 | High | 7.5 | 2022-07-17 | Pexip Infinity before 28.1 allows remote attackers to trigger a software abort via G.719. |
CVE-2022-29286 | High | 7.5 | 2022-07-17 | Pexip Infinity 27 before 28.0 allows remote attackers to trigger excessive resource consumption and termination because of registrar resource mishandling. |
CVE-2022-27937 | High | 7.5 | 2022-07-17 | Pexip Infinity before 27.3 allows remote attackers to trigger excessive resource consumption via H.264. |
CVE-2022-27936 | High | 7.5 | 2022-07-17 | Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via H.323. |
CVE-2022-27935 | High | 7.5 | 2022-07-17 | Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via Epic Telehealth. |
CVE-2022-27934 | High | 7.5 | 2022-07-17 | Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via HTTP. |
CVE-2022-27933 | High | 8.2 | 2022-07-17 | Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join. |
CVE-2022-27932 | High | 7.5 | 2022-07-17 | Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join. |
CVE-2022-27931 | High | 7.5 | 2022-07-17 | Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol. |
CVE-2022-27930 | Medium | 5.9 | 2022-07-17 | Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via single-sign-on if a random Universally Unique Identifier is guessed. |
CVE-2022-27929 | High | 7.5 | 2022-07-17 | Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via HTTP. |
CVE-2022-27928 | High | 7.5 | 2022-07-17 | Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol. |
CVE-2022-26657 | High | 7.5 | 2022-07-17 | Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join. |
CVE-2022-26656 | High | 8.2 | 2022-07-17 | Pexip Infinity before 27.3 allows remote attackers to trigger a software abort, and possibly enumerate usernames, via One Touch Join. |
CVE-2022-26655 | High | 7.5 | 2022-07-17 | Pexip Infinity 27.x before 27.3 has Improper Input Validation. The client API allows remote attackers to trigger a software abort via a gateway call into Teams. |
CVE-2022-26654 | High | 7.5 | 2022-07-17 | Pexip Infinity before 27.3 allows remote attackers to force a software abort via HTTP. |
CVE-2022-25357 | Medium | 5.3 | 2022-07-17 | Pexip Infinity 27.x before 27.2 has Improper Access Control. An attacker can sometimes join a conference (call join) if it has a lock but not a PIN. |
CVE-2022-23228 | High | 7.5 | 2022-02-18 | Pexip Infinity before 27.0 has improper WebRTC input validation. An unauthenticated remote attacker can use excessive resources, temporarily causing denial of… |
CVE-2021-29656 | Critical | 9.8 | 2022-02-18 | Pexip Infinity Connect before 1.8.0 mishandles TLS certificate validation. The allow list is not properly checked. |
CVE-2021-29655 | Critical | 9.8 | 2022-02-18 | Pexip Infinity Connect before 1.8.0 omits certain provisioning authenticity checks. Thus, untrusted code may execute. |
CVE-2021-42555 | High | 7.5 | 2022-01-15 | Pexip Infinity before 26.2 allows temporary remote Denial of Service (abort) because of missing call-setup input validation. |
CVE-2021-35969 | High | 7.5 | 2022-01-15 | Pexip Infinity before 26 allows temporary remote Denial of Service (abort) because of missing call-setup input validation. |
CVE-2021-33499 | High | 7.5 | 2022-01-15 | Pexip Infinity before 26 allows remote denial of service because of missing H.264 input validation (issue 2 of 2). |
CVE-2021-33498 | High | 7.5 | 2022-01-15 | Pexip Infinity before 26 allows remote denial of service because of missing H.264 input validation (issue 1 of 2). |
CVE-2021-32545 | High | 7.5 | 2022-01-15 | Pexip Infinity before 26 allows remote denial of service because of missing RTMP input validation. |
CVE-2021-31925 | High | 7.5 | 2021-07-07 | Pexip Infinity 25.x before 25.4 has Improper Input Validation, and thus an unauthenticated remote attacker can cause a denial of service via the administrative… |
CVE-2020-25868 | High | 7.5 | 2021-07-07 | Pexip Infinity 22.x through 24.x before 24.2 has Improper Input Validation for call setup. An unauthenticated remote attacker can trigger a software abort (tem… |
CVE-2020-24615 | Medium | 5.3 | 2020-09-25 | Pexip Infinity before 24.1 has Improper Input Validation, leading to temporary denial of service via SIP. |
CVE-2020-13387 | High | 7.5 | 2020-09-25 | Pexip Infinity before 23.4 has a lack of input validation, leading to temporary denial of service via H.323. |
CVE-2020-12824 | High | 7.5 | 2020-09-25 | Pexip Infinity 23.x before 23.3 has improper input validation, leading to a temporary software abort via RTP. |
CVE-2020-11805 | Critical | 9.8 | 2020-09-25 | Pexip Reverse Proxy and TURN Server before 6.1.0 has Incorrect UDP Access Control via TURN. |
CVE-2019-7178 | High | 7.2 | 2020-09-25 | Pexip Infinity before 20.1 allows privilege escalation by restoring a system backup. |
CVE-2019-7177 | High | 7.2 | 2020-09-25 | Pexip Infinity before 20.1 allows Code Injection onto nodes via an admin. |
CVE-2018-10585 | High | 7.5 | 2020-09-25 | Pexip Infinity before 18 allows remote Denial of Service (XML parsing). |
CVE-2018-10432 | High | 7.5 | 2020-09-25 | Pexip Infinity before 18 allows Remote Denial of Service (TLS handshakes in RTMP). |
CVE-2017-17477 | Medium | 6.1 | 2020-09-25 | Pexip Infinity before 17 allows an unauthenticated remote attacker to achieve stored XSS via management web interface views. |
CVE-2015-4719 | Critical | 9.8 | 2020-09-24 | The client API authentication mechanism in Pexip Infinity before 10 allows remote attackers to gain privileges via a crafted request. |
CVE-2017-6551 | Critical | 9.8 | 2017-05-02 | Pexip Infinity before 14.2 allows remote attackers to cause a denial of service (service restart) or execute arbitrary code via vectors related to Conferencing… |
CVE-2014-8779 | | | 2015-02-03 | Pexip Infinity before 8 uses the same SSH host keys across different customers' installations, which allows man-in-the-middle attackers to spoof Management and… |