WWBN AVideo Authorization Issue Vulnerability

WWBN AVideo is a video platform building system developed by the WWBN team using PHP. Versions of WWBN AVideo prior to 26.0 contained an authorization vulnerability. This vulnerability stemmed from the lack of permission verification for the overrideStatus parameter in the video processing...

CVE-2026-34738: Improper Authorization

WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's video processing pipeline accepts an overrideStatus request parameter that allows any uploader to set a video's status to any valid state, including "active" a. This bypasses the admin-controlled moderation and dra...

PT-2026-29361

Name of the Vulnerable Software and Affected Versions AVideo versions 26.0 and prior Description The AVideo platform, specifically the Live plugin, has an issue where the on publish done.php endpoint does not perform authentication or authorization checks. Unauthenticated users can terminate acti...

PT-2026-29365

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 26.0 Description AVideo is an open source video platform. Versions 26.0 and earlier allow any uploader to set a video’s status to any valid state, including "active", through the overrideStatus request parameter. This...

Multiple Mozilla Products Code Issues Vulnerabilities

Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox the web browser.Mozilla Thunderbird is a suite of email client software separate from the Mozilla Application Suite. A code issue vulnerability exists in multiple Mozilla products that stem...

PT-2026-29367

Name of the Vulnerable Software and Affected Versions AVideo versions 26.0 and earlier Description AVideo, an open source video platform, contains a stored server-side request forgery SSRF issue in the Electronic Program Guide EPG link feature. Authenticated users with upload permissions can stor...

PT-2026-29364

Name of the Vulnerable Software and Affected Versions AVideo versions 26.0 and prior Description AVideo is an open source video platform. A debug endpoint, test.php, within the StripeYPT plugin is accessible to all logged-in users, not just administrators. This endpoint processes Stripe...

PJSIP buffer error vulnerability

PJSIP is an open-source, free and open-source multimedia communication library developed in C language. It implements standards-based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. Prior to PJSIP 2.17, there was a buffer error vulnerability. This vulnerability stemmed from the VP9 RTP...

CVE-2026-30280

The RAREPROB SOLUTIONS PRIVATE LIMITED Video player Play All Videos (version v1.0.135 ) is vulnerable to an arbitrary file overwrite vulnerability. The issue occurs during the file import process , where an attacker can overwrite critical internal files. This flaw could lead to arbitrary code exe...

Mozilla Firefox and Mozilla Thunderbird Security Bypass Vulnerability (CNVD-2026-16378)

Mozilla Firefox is an open source web browser.Mozilla Thunderbird is a set of e-mail client software separate from the Mozilla Application Suite. The software supports IMAP, POP mail protocols and HTML mail format. A security bypass vulnerability exists in Mozilla Firefox and Mozilla Thunderbird...

PT-2026-29363

Name of the Vulnerable Software and Affected Versions AVideo versions 26.0 and prior Description AVideo is an open source video platform. The installation script, install/deleteSystemdPrivate.php, contains a PHP operator precedence bug in its command-line interface CLI-only access guard. The guar...

WWBN AVideo security vulnerability

WWBN AVideo is a video platform building system developed by the WWBN team using PHP. Versions of WWBN AVideo prior to 26.0 contained security vulnerabilities. These vulnerabilities stemmed from a lack of administrator permission checks at the plugin/YPTWallet/view/users.json.php endpoint, which...

PT-2026-29329

Name of the Vulnerable Software and Affected Versions RAREPROB SOLUTIONS PRIVATE LIMITED Video player Play All Videos version 1.0.135 Description An arbitrary file overwrite issue exists during the file import process. This allows attackers to overwrite critical internal files, which can result i...

CVE-2026-33986

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. A remote attacker could exploit a memory allocation vulnerability in the H.264 codec by enticing a user to connect to a malicious server. This flaw occurs when internal buffer dimensions are incorrectly updated aft...

CVE-2026-33986 FreeRDP: H.264 YUV Buffer Dimension Desync - Heap OOB Write

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in yuvensurebuffer in libfreerdp/codec/h264.c, h264-width and h264-height are updated before the reallocation loop. If any winpralignedrecalloc call fails, the function returns FALSE but width/height are...

CVE-2026-33986

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in yuvensurebuffer in libfreerdp/codec/h264.c, h264-width and h264-height are updated before the reallocation loop. If any winpralignedrecalloc call fails, the function returns FALSE but width/height are...

CVE-2026-33986 FreeRDP: H.264 YUV Buffer Dimension Desync - Heap OOB Write

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in yuvensurebuffer in libfreerdp/codec/h264.c, h264-width and h264-height are updated before the reallocation loop. If any winpralignedrecalloc call fails, the function returns FALSE but width/height are...

Missing Authorization

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Missing Authorization through the getapivideofile and getapivideo API endpoints in plugin/API/API.php. An attacker can retrieve direct playback URLs for...

EUVD-2026-16748

AVideo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification...

AVideo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification

Summary The getapivideofile and getapivideo API endpoints in AVideo return full video playback sources direct MP4 URLs, HLS manifests for password-protected videos without verifying the video password. While the normal web playback flow enforces password checks via the CustomizeUser::getModeYouTu...