CVE-2025-66956

CVE-2025-66956 Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote attackers to access and execute attachments via a computable URL. CVSS Vectors CVSS 3.1: 9.8, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS 4.0: 10.0,...

PT-2026-89385

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 does not enforce the Live stream password check on the stats endpoint or on the HLS origin. Live:: getStats plugin/Live/Live.php returns a password-protected transmission's RTMP stream key, its isPasswordProtected...

Network-Detection-Engine

version: 0.001 Network Detection Engine root@kitploit: A lightweight 'Network Intrusion Detecion Engine' captures Live Traffic and detects real-world live attacks in real time. Zig0.15.2 . Featuress root@kitploit: - Live packet capture using libpcap - Custom packet parsing: - Ethernet - IPv4 - TC...

CVE-Disclosures

CVE Disclosures This repository contains security advisories and vulnerability disclosures researched and reported by Sahil Arya. List of CVEs CVE-2025-70336 — PodcastGenerator 3.2.9 Stored XSS Live Items...

CVE-2026-81640

Softish C6 Ear Camera and its companion EarVision Android application are affected by a use of hard-coded credentials vulnerability (CVSS 3.1: 8.8 HIGH ). An attacker in an adjacent network position, with low complexity , no privileges required , and no user interaction , can derive the camera's ...

CVE-2026-81330 Softish C6 Ear Camera and EarVision Android Application Cleartext transmission of sensitive information

The C6 ear camera transmits live video to the EarVision Android application over unencrypted UDP streams. The application manifest permits cleartext traffic, and captured network traffic contains reconstructable JPEG or WEBP video frames transmitted over UDP. An attacker within local wireless ran...

cve-2015-3456

Experiments related to CVE-2015-3456 There is: exploit/ is an "exploit" it just crashes QEMU. mock/ contains a stripped down version of QEMU. Only the vulnerability remains. patch/ contains a program to patch a running instance of QEMU. The main point is to not need debug symbols, nor the origina...

CVE-2026-53637 Sylius: Cart FormComponent allows modification or deletion of an already-completed order

Sylius is an Open Source eCommerce Framework on Symfony. Versions 2.0.0 through 2.0.17, 2.1.0 through 2.1.14, and 2.2.0 through 2.2.5 contain an improper workflow enforcement vulnerability in the cart FormComponent. When an order is completed while its cart page remains open, the stale...

CVE-2020-24088

CVE-2020-24088 Windows Privilege Escalation An issue was discovered in MmMapIoSpace routine in Foxconn Live Update Utility 2.1.6.26, allows local attackers to escalate privileges. CVE link - https://vulners.com/cve/CVE-2020-24088...

EUVD-2026-70734

MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize via Live NamedNodeMap Removal Skip...

hassh

"HASSH" - a Profiling Method for SSH Clients and Servers. NOTE: This Corelight repository was created so that it can be actively maintained, as per a request from Salesforce whose original repository is not being maintained. "HASSH" is a network fingerprinting standard which can be used to identi...

CVE-2026-86728

AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-stream keys and private EPG schedules to unauthenticated users. Attackers can request the endpoint with sequential user or playlist IDs to retrieve sensitive credentials, server...

CVE-2026-86718

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in deleteHistory.json.php and finishAll.json.php that allows unauthenticated attackers to mutate live history by making GET requests without CSRF token validation. Attackers can...

CVE-2026-86720

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ownership of liverestreamsid in resendRestreamer.json.php, allowing authenticated users with canStream to access other users' restream destinations. Attackers can broadcast their live stream to victim-configured...

EUVD-2026-72864

AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-stream keys and private EPG schedules to unauthenticated users. Attackers can request the endpoint with sequential user or playlist IDs to retrieve sensitive credentials, server...

CVE-2026-86728 AVideo through 29.0 Unauthenticated Disclosure via epg.json.php

AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-stream keys and private EPG schedules to unauthenticated users. Attackers can request the endpoint with sequential user or playlist IDs to retrieve sensitive credentials, server...

CVE-2026-86728

AVideo through version 29.0 contains an authentication bypass vulnerability in the plugin/PlayLists/epg.json.php endpoint. Unauthenticated attackers can request the endpoint with sequential user or playlist IDs to retrieve live-stream keys , private EPG schedules , sensitive credentials, and serv...

CVE-2026-86728 AVideo through 29.0 Unauthenticated Disclosure via epg.json.php

AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-stream keys and private EPG schedules to unauthenticated users. Attackers can request the endpoint with sequential user or playlist IDs to retrieve sensitive credentials, server...

CVE-2026-86727

AVideo through version 29.0 is affected by an information disclosure vulnerability in plugin/Live/stats.json.php . The endpoint is accessible without authentication and returns a hidden_applications array in its JSON response, allowing unauthenticated attackers to retrieve stream keys and m3u8 UR...

CVE-2026-86727 AVideo through 29.0 Information Disclosure via stats.json.php

AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthenticated attackers to retrieve stream keys and m3u8 URLs by accessing the endpoint without authentication. Attackers can enumerate private, unlisted, and group-restricted live...