AzuraCast's Missing RequireInternalConnection on Liquidsoap API Allows Low-Privilege Metadata Injection and Broadcast Disruption

Summary The /api/internal/stationid/liquidsoap/action endpoint is accessible from the public web interface because it lacks the RequireInternalConnection middleware that protects other internal endpoints /sftp-auth, /sftp-event. Combined with a logic flaw where the $asAutoDj flag is set based on...

GHSA-4FM3-GGG2-C6QX AzuraCast's Missing RequireInternalConnection on Liquidsoap API Allows Low-Privilege Metadata Injection and Broadcast Disruption

Summary The /api/internal/stationid/liquidsoap/action endpoint is accessible from the public web interface because it lacks the RequireInternalConnection middleware that protects other internal endpoints /sftp-auth, /sftp-event. Combined with a logic flaw where the $asAutoDj flag is set based on...

CVE-2026-4100

The Paid Memberships Pro plugin for WordPress is vulnerable to unauthorized modification and disruption of Stripe webhook configuration in all versions up to, and including, 3.6.5. This is due to missing capability checks on the wpajaxpmprostripecreatewebhook, wpajaxpmprostripedeletewebhook, and...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the configMapSyncProvider process. An attacker can create, read, update, or delete Kubernetes ConfigMaps containing synchronization limits by sending crafted requests with any Bearer token, including fake tokens...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the io.Copy process that handles binary import requests. An attacker can exhaust disk space on the host system by continuously streaming large amounts of data to the affected...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the io.Copy process that handles binary import requests. An attacker can exhaust disk space on the host system by continuously streaming large amounts of data to the affected...

Improper Resource Shutdown or Release

Overview Affected versions of this package are vulnerable to Improper Resource Shutdown or Release via the DecodeFromBytes function in the SRv6 L3 Service component. An attacker can cause a service disruption by sending specially crafted data to this function remotely. Remediation Upgrade...

Suricata dcerpc parser DoS

The vulnerability of the dcerpc parser in the Suricata intrusion detection and prevention system is related to its algorithmic complexity. Exploiting this vulnerability could allow a malicious actor, operating remotely, to cause service interruptions...

Google Chrome DoS

The vulnerability in the Google Chrome web browser is related to errors in HTTP requests. Exploiting this vulnerability can allow a malicious actor to cause a service failure through a specially created HTML page...

Libssh2 Heap Buffer Overflow DoS

The vulnerability of the libssh2ntohu32 function in the SSH2 protocol implementation library Libssh2 is related to reading data beyond the allowable buffer size. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

Suricata Krb5 DoS

The vulnerability of the krb5 parser in the Suricata intrusion detection and prevention system is related to its algorithmic complexity. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

Google Chrome Heap Buffer Overflow DoS

The vulnerability in the Google Chrome web browser is related to overflowing buffers in dynamic memory. Exploiting this vulnerability can allow a malicious actor to cause a service failure through a specially created HTML page...

CUPS scan_ps DoS

The vulnerability of the scanps function on the CUPS printing server is related to pointer arithmetic errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

Suricata DoS

The vulnerability of the Suricata intrusion detection and prevention system is related to the algorithmic complexity when using SMTP and MIME standards. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Firefox Thunderbird Buffer Overflow DoS

The vulnerability in the Firefox web browser and the Thunderbird email client is related to buffer overflow attacks. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

GC Component Firefox Thunderbird DoS

The vulnerability of the GC component in the Firefox web browser and the Thunderbird email client is related to the use of memory after it is released. Exploiting this vulnerability can allow an attacker to cause a service failure...

CUPS copy_stack() Heap Buffer Overflow DoS

The vulnerability of the copystack function in the CUPS printing server relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause service failures...

Tenda AC9 Router DoS

The vulnerability of the formQuickIndex function in the Tenda AC9 router’s microprogramming software is related to buffer overflow in the stack when processing the PPPOEPassword parameter. Exploiting this vulnerability can allow an attacker to cause a service failure...

Libxml2 Heap Buffer Overflow DoS

The vulnerability of the xmlMemStrdup function in the Libxml2 library is related to pointer manipulation errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

Kerberos Authentication Buffer Overflow DoS

The vulnerability of the krb5chpwmessage function in the Kerberos authentication protocol is related to insufficient input validation. Exploiting this vulnerability can allow attackers to access confidential data and also cause service interruptions...