CVE-2026-119596

UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to download other members' private playlists. Attackers can enumerate sequential playlist ids at the /playlist-zips/playlist endpoint to obtain zips of all torrents,...

EUVD-2026-113933

UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to download other members' private playlists. Attackers can enumerate sequential playlist ids at the /playlist-zips/playlist endpoint to obtain zips of all torrents,...

CVE-2026-119596: HDInnovations UNIT3D: UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows…

UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to download other members' private playlists. Attackers can enumerate sequential playlist ids at the /playlist-zips/playlist endpoint to obtain zips of all torrents,...

PT-2026-133548

UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to download other members' private playlists. Attackers can enumerate sequential playlist ids at the /playlist-zips/playlist endpoint to obtain zips of all torrents,...

CVE-2026-114048

WWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endpoints like playlistStatus.php that bypass the .json.php-only autoCSRFGuard check. Attackers can lure logged-in users to a page with an auto-submitting form to make private playlists public, remove playlist...

CVE-2026-114048 WWBN AVideo before 24.0 CSRF via Legacy Playlist and Video Endpoints

WWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endpoints like playlistStatus.php that bypass the .json.php-only autoCSRFGuard check. Attackers can lure logged-in users to a page with an auto-submitting form to make private playlists public, remove playlist...

CVE-2026-114048 WWBN AVideo before 24.0 CSRF via Legacy Playlist and Video Endpoints

WWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endpoints like playlistStatus.php that bypass the .json.php-only autoCSRFGuard check. Attackers can lure logged-in users to a page with an auto-submitting form to make private playlists public, remove playlist...

EUVD-2026-106999

WWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endpoints like playlistStatus.php that bypass the .json.php-only autoCSRFGuard check. Attackers can lure logged-in users to a page with an auto-submitting form to make private playlists public, remove playlist...

CVE-2026-114048

Versions of WWBN AVideo prior to 24.0 are vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability. The root cause is that legacy endpoints, such as playlistStatus.php , bypass the .json.php-only autoCSRFGuard() check. An attacker can lure authenticated users to a malicious page with an au...

CVE-2026-114048 WWBN AVideo before 24.0 CSRF via Legacy Playlist and Video Endpoints

WWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endpoints like playlistStatus.php that bypass the .json.php-only autoCSRFGuard check. Attackers can lure logged-in users to a page with an auto-submitting form to make private playlists public, remove playlist...

World Wide Broadcast Network AVideo cross-site request forgery vulnerability

Versions prior to AVideo 24.0 of the World Wide Broadcast Network contain a cross-site request forgery vulnerability. This flaw stems from older endpoints such as playlistStatus.php, which bypasses the autoCSRFGuard check specifically applied to .json.php. As a result, attackers can exploit this...

PT-2026-120174

WWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endpoints like playlistStatus.php that bypass the .json.php-only autoCSRFGuard check. Attackers can lure logged-in users to a page with an auto-submitting form to make private playlists public, remove playlist...

PT-2026-108113

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 8.1.3 Description A protection mechanism failure exists in the HLS demuxer. This issue allows attackers to bypass protocol and allowed extensions restrictions when opening child playlists. By providing a crafted master...

CVE-2026-63269 LFI and GET SSRF via GStreamer and HLS playlists

LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In...

CVE-2026-63269 LFI and GET SSRF via GStreamer and HLS playlists

LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In...

CVE-2026-63269

On Linux , LibreOffice is vulnerable to Local File Inclusion (LFI) and GET Server-Side Request Forgery (SSRF) due to how it handles linked media via GStreamer . An attacker can provide a linked HLS playlist that causes GStreamer to read local files or remote URLs during document loading, potentia...

CVE-2026-63269

LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In...

CVE-2026-105089: Improper Neutralization of Input During Web Page Generation

WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of oncli...

Improper Resource Shutdown or Release

Overview Affected versions of this package are vulnerable to Improper Resource Shutdown or Release in the parseplaylist function of the Duration Parser component when processing the duration or targetduration arguments. An attacker can cause a denial of service by providing specially crafted...

Astra Linux – Vulnerability in ffmpeg5

A flaw was discovered in FFmpeg’s TTY Demuxer. This vulnerability allows for potential data exfiltration through improper parsing of input files that do not comply with TTY standards in HLS playlists...