High
CVE-2026-34375
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 851
Reset filters
Medium
CVE-2026-34369
AVideo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification
Medium
CVE-2026-34368
AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance
Medium
CVE-2026-34364
AVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.php
Medium
CVE-2026-34362
AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket()
Medium
CVE-2026-34247
AVideo: IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket Notifications
Medium
CVE-2026-34245
AVideo: Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast Hijacking
High
CVE-2026-56341
AVideo: Unauthenticated Access to Payment Log DataTables Endpoints Exposes Transaction Data, PayPal Tokens, and User Financial Records
Medium
CVE-2026-34036
Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php
Medium
CVE-2026-33766
AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints
Medium
CVE-2026-33764
AVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and Transcriptions
Medium
CVE-2026-33761
AVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User Mappings
Medium
CVE-2026-33759
AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents
High
CVE-2026-6204
LibreNMS is Vulnerable to Remote Code Execution by Arbitrary File Write
Low
CVE-2026-56385
Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata
High
CVE-2026-33723
AVideo is Vulnerable to SQL Injection through Subscribe Endpoint via Unsanitized user_id Parameter
High
CVE-2026-33719
AVideo: Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment
High
CVE-2026-33717
AVideo: Remote Code Execution via PHP Temp File in Encoder downloadURL
Critical
CVE-2026-33716
AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php
Medium
CVE-2026-33690
AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()
Medium
ghsa-wxjx-r2j2-96fx
AVideo: Full-Read SSRF Through Unvalidated statsURL Parameter in plugin/Live/test.php
Medium
CVE-2026-33688
AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint
Medium
CVE-2026-33685
AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data
Medium
CVE-2026-33683
AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About Field
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.