CVE-2026-41056

WWBN AVideo is an open source video platform. In versions 29.0 and below, the allowOrigin$allowAll=true function in objects/functions.php reflects any arbitrary Origin header back in Access-Control-Allow-Origin along with Access-Control-Allow-Credentials: true. This function is called by both...

EUVD-2026-24531

WWBN AVideo is an open source video platform. In versions 29.0 and below, the allowOrigin$allowAll=true function in objects/functions.php reflects any arbitrary Origin header back in Access-Control-Allow-Origin along with Access-Control-Allow-Credentials: true. This function is called by both...

CVE-2026-41056

WWBN AVideo (versions 29.0 and below) is affected by a cross-origin vulnerability where allowOrigin($allowAll=true) reflects arbitrary Origin headers in Access-Control-Allow-Origin together with Access-Control-Allow-Credentials: true. The reflection occurs in objects/functions.php and is invoked ...

CVE-2026-41056

WWBN AVideo is an open source video platform. In versions 29.0 and below, the allowOrigin$allowAll=true function in objects/functions.php reflects any arbitrary Origin header back in Access-Control-Allow-Origin along with Access-Control-Allow-Credentials: true. This function is called by both...

PT-2026-34202

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions 29.0 and earlier Description The allowOrigin$allowAll=true function in objects/functions.php reflects any arbitrary Origin header back in Access-Control-Allow-Origin along with Access-Control-Allow-Credentials: true. This...

GHSA-CCQ9-R5CW-5HWQ WWBN AVideo has CORS Origin Reflection with Credentials on Sensitive API Endpoints Enables Cross-Origin Account Takeover

Summary The allowOrigin$allowAll=true function in objects/functions.php reflects any arbitrary Origin header back in Access-Control-Allow-Origin along with Access-Control-Allow-Credentials: true. This function is called by both plugin/API/get.json.php and plugin/API/set.json.php — the primary API...

Livestream Replay: The War Machine

A panel of WIRED experts dissected the defense tech industry’s impact on modern warfare...

CVE-2025-23164

A misconfigured access token mechanism in the Unifi Protect Application Version 5.3.41 and earlier could permit the recipient of a "Share Livestream" link to maintain access to the corresponding livestream subsequent to such link becoming disabled...

EUVD-2019-2775

Malware in sbrugna...

EUVD-2014-4467

Malware in sbrugna...

EUVD-2023-31357

Malicious code in bioql PyPI...

EUVD-2025-27705

Malicious code in bioql PyPI...

CVE-2025-6528

A vulnerability has been found in 70mai M300 up to 20250611 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /livestream/12 of the component RTSP Live Video Stream Endpoint. The manipulation leads to improper authentication. The attack needs to...

70mai M300 授权问题漏洞

70mai M300 is a smart recorder from 70mai 70mai, a Chinese company. An authorization issue vulnerability exists in 70mai M300 20250611 and prior versions, which stems from improper authentication due to incorrect operation of file /livestream/12...

CVE-2025-23164

A misconfigured access token mechanism in the Unifi Protect Application Version 5.3.41 and earlier could permit the recipient of a "Share Livestream" link to maintain access to the corresponding livestream subsequent to such link becoming disabled...

CVE-2025-23164

A misconfigured access token mechanism in the Unifi Protect Application Version 5.3.41 and earlier could permit the recipient of a "Share Livestream" link to maintain access to the corresponding livestream subsequent to such link becoming disabled...

CVE-2025-23164

A misconfigured access token mechanism in the Unifi Protect Application Version 5.3.41 and earlier could permit the recipient of a "Share Livestream" link to maintain access to the corresponding livestream subsequent to such link becoming disabled...

CVE-2025-23164

CVE-2025-23164 affects UniFi Protect Application (versions 5.3.41 and earlier). A misconfigured access token mechanism in the Share Livestream feature can let the recipient of a Share Livestream link maintain access to the livestream after the link is disabled, constituting an authorization bypas...

The vulnerability of the Share Livestream module in the UniFi Protect video surveillance system allows a intruder to gain unauthorized access to protected information.

The vulnerability of the Share Livestream module in the UniFi Protect video surveillance system is related to deficiencies in access control. Exploiting this vulnerability could allow an intruder, operating remotely, to gain unauthorized access to protected information...

PT-2025-20553 · Ubiquiti · Unifi Protect Application

Name of the Vulnerable Software and Affected Versions: Unifi Protect Application versions 5.3.41 and earlier Description: The issue is related to a misconfigured access token mechanism in the Share Livestream feature of the Unifi Protect Application. This could allow an unauthorized user to...