← Back to Vulnerability Reports CVE Intelligence

CVE-2026-30612

See advisory•CRITICAL · CVSS 9.8•No exploitation reported

What is CVE-2026-30612?

An issue in Time4 Popcorn for Windows <= 6.2.1.18 and Time4Popcorn for MacOS <= 6.2.1.17 and Time4Popcorn for Android <= 3.5.0.173 allows a remote attacker to execute arbitrary code via the updater.exe for windows, PT.updd on MacOS components

CVSS9.8 NVD 3.1

SeverityCRITICAL

ExploitationNo exploitation reported

Triage statusNo Known Exploit

ActionPatch within 48 hours

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWECWE-494

NVD published2026-08-27

NVD last modified2026-09-01

Timeline

2026-08-27Published to the U.S. National Vulnerability Database (NVD)
2026-09-01NVD record last updated
2026-10-24First covered in a defend.network daily briefing

Affected product

See advisory

References

Referenced in our briefings & reports

PHP Critical RCEs Under Active Exploitation; BlackX UEFI Bootkit Targets Diplomats (2026-10-24)

Related vulnerabilities

CVE-2026-3502 – TrueConf Client (same weakness: CWE-494)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.