Pexip Infinity
24 CVEs affecting Pexip Infinity. Latest disclosed: 2026-09-30. Critical: 1, High: 21.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-103110 | Critical | 9.8 | 2026-09-30 | Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute code remotely as an unp… |
CVE-2026-103105 | High | 8.8 | 2026-09-30 | Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper access control on a product-internal API which allows an attacker with local acce… |
CVE-2026-103102 | High | 8.6 | 2026-09-30 | Pexip Infinity before 41.0 is affected by improper input validation in the signaling implementation which allows a remote attacker to trigger a software abort… |
CVE-2026-103101 | High | 8.6 | 2026-09-30 | Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a malicious attacker to render a Pexip Infi… |
CVE-2025-59683 | High | 8.2 | 2025-12-25 | Pexip Infinity 15.0 through 38.0 before 38.1 has Improper Access Control in the Secure Scheduler for Exchange service, when used with Office 365 Legacy Exchang… |
CVE-2026-103106 | High | 7.8 | 2026-09-30 | Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation within an internal Pexip Infinity service that allows an attack… |
CVE-2026-103109 | High | 7.7 | 2026-09-30 | Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to tri… |
CVE-2026-103108 | High | 7.5 | 2026-09-30 | Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to tr… |
CVE-2026-103104 | High | 7.5 | 2026-09-30 | Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation which allows a remote attacker to tr… |
CVE-2026-103100 | High | 7.5 | 2026-09-30 | Pexip Infinity before 40.1 is affected by improper input validation in the signaling implementation that allows a malicious attacker to trigger a software abor… |
CVE-2026-103099 | High | 7.5 | 2026-09-30 | Pexip Infinity before 41.1 is affected by improper input validation in the media implementation that allows a remote attacker to trigger a software abort resul… |
CVE-2025-66443 | High | 7.5 | 2025-12-25 | Pexip Infinity 35.0 through 38.1 before 39.0, in non-default configurations that use Direct Media for WebRTC, has Improper Input Validation in signalling that… |
CVE-2025-66379 | High | 7.5 | 2025-12-25 | Pexip Infinity before 39.0 has Improper Input Validation in the media implementation, allowing a remote attacker to trigger a software abort via a crafted medi… |
CVE-2025-66377 | High | 7.5 | 2025-12-25 | Pexip Infinity before 39.0 has Missing Authentication for a Critical Function in a product-internal API, allowing an attacker (who already has access to execut… |
CVE-2025-48704 | High | 7.5 | 2025-12-25 | Pexip Infinity 35.0 through 37.2 before 38.0 has Improper Input Validation in signalling that allows an attacker to trigger a software abort, resulting in a de… |
CVE-2025-32096 | High | 7.5 | 2025-12-25 | Pexip Infinity 33.0 through 37.0 before 37.1 has improper input validation in signaling that allows an attacker to trigger a software abort, resulting in a den… |
CVE-2025-32095 | High | 7.5 | 2025-12-25 | Pexip Infinity before 37.0 has improper input validation in signalling that allows a remote attacker to trigger a software abort via a crafted signalling messa… |
CVE-2021-42555 | High | 7.5 | 2022-01-15 | Pexip Infinity before 26.2 allows temporary remote Denial of Service (abort) because of missing call-setup input validation. |
CVE-2021-35969 | High | 7.5 | 2022-01-15 | Pexip Infinity before 26 allows temporary remote Denial of Service (abort) because of missing call-setup input validation. |
CVE-2021-33499 | High | 7.5 | 2022-01-15 | Pexip Infinity before 26 allows remote denial of service because of missing H.264 input validation (issue 2 of 2). |