CVE-2026-61569

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at objects/login.json.php passes the user parameter to Streamer::get in objects/Streamer.php, where it is interpolated into a single-quoted MariaDB SELECT without parameterization or escaping. Although...

CVE-2026-61569 AVideo-Encoder: pre-authentication streamer-login SQL injection

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at objects/login.json.php passes the user parameter to Streamer::get in objects/Streamer.php, where it is interpolated into a single-quoted MariaDB SELECT without parameterization or escaping. Although...

CVE-2026-61569

The video-sharing platform AVideo is vulnerable to a pre-authentication SQL injection in versions prior to 8.1.0 . The vulnerability exists because the user parameter at objects/login.json.php is passed to Streamer::get in objects/Streamer.php and interpolated into a MariaDB SELECT query without ...

CVE-2026-100852 AzuraCast before 0.23.8 Command Injection via Streamer Username

AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls. Authenticated station users with Streamers and Profile permissions can set a username containing shell...

CVE-2026-100852 AzuraCast before 0.23.8 Command Injection via Streamer Username

AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls. Authenticated station users with Streamers and Profile permissions can set a username containing shell...

CVE-2026-100852 AzuraCast before 0.23.8 Command Injection via Streamer Username

AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls. Authenticated station users with Streamers and Profile permissions can set a username containing shell...

CVE-2026-100852

AzuraCast versions through 0.23.x are vulnerable to a command injection vulnerability within the Liquidsoap config generation for live recording. The root cause is the failure to properly quote the streamer username in process.run calls. Authenticated station users possessing Streamers and Profil...

CVE-2026-100852: Improper Neutralization of Special Elements used in an OS Command

AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls. Authenticated station users with Streamers and Profile permissions can set a username containing shell...

PT-2026-99472

Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.23.8 Description Command injection occurs during Liquidsoap configuration generation for live recording because the streamer username is not properly quoted in process.run calls. Authenticated station users...

current-impact (1.0.0), nmea-streamer (>=1.0.1, <=2.2.0) potentially affected by CVE-2026-55591 via signalk-server (1.46.3)

signalk-server NPM version 1.46.3 is affected by a known vulnerability. The following packages have a transitive dependency on signalk-server and may be impacted: - current-impact 1.0.0 - nmea-streamer =1.0.1, =2.2.0 Source cves: CVE-2026-55591 Source advisory: MEND:CVE-2026-55591...

CVE-2026-86726

AVideo through 29.0 contains an information disclosure vulnerability in restreamsActive.json.php that allows authenticated streamers to enumerate source stream keys and identities of all other streamers' active restreams. The endpoint fails to filter results by user ownership, exposing sensitive...

CVE-2026-86726: Insufficiently Protected Credentials

AVideo through 29.0 contains an information disclosure vulnerability in restreamsActive.json.php that allows authenticated streamers to enumerate source stream keys and identities of all other streamers' active restreams. The endpoint fails to filter results by user ownership, exposing sensitive...

SUSE CVE-2026-9147

uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file and compiles it at runtime. Some file-controlled streamer metadata fields for example, streamer element names are interpolated into the generated Python source without safe quoting via repr or the !r...

Nimble Streamer <=3.5.4-9 - Local File Inclusion Detection

Nimble Streamer 3.0.2-2 through 3.5.4-9 is vulnerable to local file inclusion. An attacker can traverse the file system to access files or directories that are outside of the restricted directory on the remote server. !/usr/bin/env python3 -- coding: utf-8 -- """Nimble Streamer 3.""" import re fr...

open-mjpg-streamer Detection

Open mjpg-streamer service sharing webcam/camera feed !/usr/bin/env python3 -- coding: utf-8 -- """Open mjpg-streamer service sharing webcam/camera feed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

Arbitrary Code Injection

Overview uproot is a ROOT I/O in pure Python and NumPy. Affected versions of this package are vulnerable to Arbitrary Code Injection via the TStreamerInfo metadata processing. An attacker can execute arbitrary Python code by supplying a crafted ROOT file containing malicious streamer metadata...

CVE-2026-9147

uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file and compiles it at runtime. Some file-controlled streamer metadata fields for example, streamer element names are interpolated into the generated Python source without safe quoting via repr or the !r...

EUVD-2026-45374

uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file and compiles it at runtime. Some file-controlled streamer metadata fields for example, streamer element names are interpolated into the generated Python source without safe quoting via repr or the !r...

CVE-2026-9147

CVE-2026-9147 affects uproot 5.7.4 and prior. The issue arises when uproot dynamically generates Python class source code from ROOT TStreamerInfo records and compiles it at runtime. Some file-controlled streamer metadata fields (e.g., streamer element names) are interpolated into the generated Py...

CVE-2026-9147

uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file and compiles it at runtime. Some file-controlled streamer metadata fields for example, streamer element names are interpolated into the generated Python source without safe quoting via repr or the !r...