CVE-2026-90542 WWBN AVideo Missing Authorization via remindMe.json.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate that logged-in users can access live schedules before creating reminders via remindMe.json.php. Authenticated attackers can create scheduler reminders for private live schedules they cannot view and learn the...

CVE-2026-90543 WWBN AVideo Missing Authentication via socketMessageLiveOwner.json.php

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier, with the Live plugin enabled, contains a missing authentication vulnerability in plugin/Live/socketMessageLiveOwner.json.php. The script reads the key and msg parameters from $REQUEST, resolves the stream owner via...

SUSE-SU-2026:23679-1 Security update for the Linux Kernel RT (Live Patch 4 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.9.1 fixes various security issues: The following security issues were fixed: - CVE-2026-46150: fanotify: fix false positive on permission events bsc1267388. - CVE-2026-53360: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in us...

PT-2026-90648

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier, with the Live plugin enabled, contains a missing authentication vulnerability in plugin/Live/socketMessageLiveOwner.json.php. The script reads the key and msg parameters from $ REQUEST, resolves the stream owner via...

CVE-2026-90552: Authorization Bypass Through User-Controlled Key

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist ownership in the Playlistsschedules/list.json.php and Live/calendar.json.php endpoints, allowing authenticated and unauthenticated users to read private playlist schedule metadata. Attackers with...

CVE-2026-90543: Missing Authentication for Critical Function

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier, with the Live plugin enabled, contains a missing authentication vulnerability in plugin/Live/socketMessageLiveOwner.json.php. The script reads the key and msg parameters from $REQUEST, resolves the stream owner via...

CVE-2026-90542: Authorization Bypass Through User-Controlled Key

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate that logged-in users can access live schedules before creating reminders via remindMe.json.php. Authenticated attackers can create scheduler reminders for private live schedules they cannot view and learn the...

CVE-2026-89625

A flaw was found in the Linux kernel's HID Human Interface Device Sony driver, affecting Guitar Hero Live GHL dongles. A race condition occurs during the driver unbinding process where a periodic timer can be re-armed after the memory it uses has been freed. This Use-After-Free UAF vulnerability...

CVE-2026-89250

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an unauthenticated file read vulnerability in the getRecordedFile.php endpoint. The endpoint streams recorded FLV files from a temporary directory without authentication or authorization checks, allowing attackers who kn...

CVE-2026-89250 WWBN AVideo Unauthenticated File Read via getRecordedFile.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an unauthenticated file read vulnerability in the getRecordedFile.php endpoint that streams recorded FLV files from the temporary directory. Attackers can request the endpoint with a known or guessed stream key to downlo...

DEBIAN-CVE-2026-89169

live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing...

CVE-2026-89169

live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing...

UBUNTU-CVE-2026-89169

live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing...

CVE-2026-89169

live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing...

CVE-2026-89169

live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing...

CVE-2026-89169

live-boot at commit ff8867c contains a vulnerability in its dm-verity-enforce-roothash-signature protection mechanism. When the .verity file is missing, an attacker can bypass this integrity verification, as shown in the code at lines 112–114 of 9990-overlay.sh. The Debian bug tracker records thi...

EUVD-2026-75949

live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing...

CVE-2026-89169

live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing...

PT-2026-89769

Name of the Vulnerable Software and Affected Versions live-boot version ff8867c Description An issue exists that allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism. This occurs specifically when the .verity file is missing. dm-verity is a kernel feature used ...

CVE-2026-89240: Improper Neutralization of Input During Web Page Generation

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Live/confirmLivePassword.php. The script interpolates the unauthenticated GET parameter u which is not covered by $securityFilter directly into an attribute withou...