CVE-2026-54337-PoC

CVE-2026-54337 PoC CVE-2026-54337 - Écriture/Remplacement de fichier non authentifié dans fireshare test.mp4 Étape 2 : Exécutez la commande curl suivante assurez-vous de modifier le placeholder $ curl -s -w "HTTP %httpcode\n" \ -F "file=@;filename= -selectstreams v.mp4" \ -F "folder=testfolder -o...

CVE-2026-100855

AzuraCast versions before 0.23.6 are vulnerable to a missing permission check in the GET /api/station/{station_id}/file/{id}/play endpoint. This flaw allows authenticated users to download media files from any station by enumerating sequential IDs. Consequently, an attacker can exfiltrate the com...

EUVD-2026-87820

AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/stationid/file/id/play endpoint that allows authenticated users to download media files from any station. Attackers can enumerate media files using sequential IDs and exfiltrate the complete media...

CVE-2026-100855 AzuraCast before 0.23.6 Missing Permission Check via /play

AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/stationid/file/id/play endpoint that allows authenticated users to download media files from any station. Attackers can enumerate media files using sequential IDs and exfiltrate the complete media...

CVE-2026-100853

AzuraCast versions prior to 0.23.8 are vulnerable to an authorization bypass in the public On-Demand download endpoint. The root cause is a failure to verify playlist-level access controls , which allows unauthenticated users to download media files that were intended to be excluded from On-Deman...

CVE-2026-100853 AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass

In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download media files excluded from On-Demand-enabled playlists. Attackers can bypass the station operator's intended access restrictions by directly...

CVE-2026-100855: Missing Authorization

AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/stationid/file/id/play endpoint that allows authenticated users to download media files from any station. Attackers can enumerate media files using sequential IDs and exfiltrate the complete media...

[SECURITY] [DSA 6515-1] vlc security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6515-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 25, 2026 https://www.debian.org/security/faq -...

CVE-2026-93366

Bludit CMS version 3.22.0 and earlier is vulnerable to an authorization bypass in the bl-kernel/ajax/ endpoints. Authenticated users with the Author role can enumerate and delete media files belonging to other users, including administrators, by providing arbitrary uuid parameters. The vulnerabil...

Debian dsa-6515 : libvlc-bin - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6515 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6515-1 [email protected] https://www.debian.org/securit...

Astra Linux – Vulnerability in Chromium

Before version 152.0.7977.65, reading out of bounds in Skia using Google Chrome allowed a remote attacker to potentially read memory within the sandbox through a crafted media file. Chromium security severity: Medium...

WordPress WP Travel Engine plugin < 6.8.1 - Subscriber+ Arbitrary Media File Move via user_profile_image vulnerability

Subscriber+ Arbitrary Media File Move via userprofileimage vulnerability discovered by marim00 in WordPress Plugin WP Travel Engine versions 6.8.1...

USN-8716-2: FFmpeg vulnerabilities

USN-8716-1 fixed several vulnerabilities in FFmpeg. This update provides the corresponding fix for Ubuntu 26.04 LTS. Original advisory details: It was discovered that FFmpeg incorrectly handled certain crafted media files in the VobSub subtitle demuxer. An attacker could possibly use this issue t...

[SECURITY] [DSA 6486-1] libde265 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6486-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 06, 2026 https://www.debian.org/security/faq -...

Debian dsa-6486 : libde265-0 - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6486 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6486-1 [email protected] https://www.debian.org/securit...

SUSE CVE-2026-79020

Out of bounds read in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted media file. Chromium security severity: Medium...

CVE-2026-79020

An out of bounds read flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=514017820...

EUVD-2026-66343

CAYIN CMS-WS and CMS-SE developed by CAYIN Technology have a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain media file lists via specific functionality, resulting in partial information disclosure...

CVE-2026-80234 CAYIN Technology｜CAYIN CMS-WS/CMS-SE - Missing Authentication

CAYIN CMS-WS and CMS-SE developed by CAYIN Technology have a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain media file lists via specific functionality, resulting in partial information disclosure...

CVE-2026-80234

CAYIN CMS-WS and CMS-SE , developed by CAYIN Technology, are affected by a Missing Authentication vulnerability. An unauthenticated remote attacker can leverage a specific functionality to obtain media file lists , resulting in partial information disclosure . The CNA TW CERT assigned a CVSS 3.1 ...