CVE-2026-30121

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

remotion-dev remotion v4.0.409 was discovered to contain an arbitrary file write vulnerability.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-123

Affected software

No affected versions have been published.

Timeline

Published
Jun 15, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-30138.7Coppermine Photo Gallery in versions 1.6.09 through 1.6.27 is vulnerable to path traversal. Unauthenticated remote attacker is able to exploCVE-2026-301396.1A reflected cross-site scripting (XSS) vulnerability in the AdvancedSearch functionality of Silverpeas Core before version 6.4.6 allows attaCVE-2026-30149.1Milestone has released a new version of XProtect® (and several cumulative patch updates) which fix security vulnerability in Management ServCVE-2026-301407.5An incorrect access control vulnerability exists in Tenda W15E V02.03.01.26_cn. An unauthenticated attacker can access the /cgi-bin/DownloadCVE-2026-301419.8An issue was discovered in bitbank2 AnimatedGIF v2.2.0. A buffer overflow in the DecodeLZW function allows remote attackers to cause a deniaCVE-2026-30158.8A vulnerability was determined in UTT HiPER 810G up to 1.7.7-171114. Impacted is the function strcpy of the file /goform/formPolicyRouteConfCVE-2026-30168.8A vulnerability was identified in UTT HiPER 810G up to 1.7.7-171114. The affected element is the function strcpy of the file /goform/formP2PCVE-2026-301626.1Cross Site Scripting (xss) vulnerability in Timo 2.0.3 via crafted links in the title field.CVE-2026-30177.2The Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts plugin for WordPress is vulnerable to PHP Object Injection CVE-2026-30187.5The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpmlsubscriber_id’ parameter in all versions up to, CVE-2026-30208.6Identity based authorization bypass vulnerability (IDOR) that allows an attacker to modify the data of a legitimate user account, such as chCVE-2026-30216.5Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma web application, specifically in the endpoint 'vets.wakyma.com/centro/equi
CVE-2026-30121: Critical severity, CVSS 9.1 | Vulnix