37244 matches found
CVE-2026-86726 AVideo through 29.0 Information Disclosure via restreamsActive.json.php
AVideo through 29.0 contains an information disclosure vulnerability in restreamsActive.json.php that allows authenticated streamers to enumerate source stream keys and identities of all other streamers' active restreams. The endpoint fails to filter results by user ownership, exposing sensitive...
CVE-2026-86725 AVideo SocialMediaPublisher Missing Authorization via add.json.php
AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in the SocialMediaPublisher plugin's add.json.php endpoint that allows authenticated users to modify other users' OAuth token records. Attackers can supply arbitrary row IDs to overwrite another...
CVE-2026-86725
AVideo 's SocialMediaPublisher plugin contains a missing authorization flaw in its add.json.php endpoint, affecting versions through commit c3edcc274c389816d434acadac07ee78eaf330c1 . An authenticated attacker can supply arbitrary row IDs to overwrite another user's stored OAuth access_token and r...
EUVD-2026-72861
AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in the SocialMediaPublisher plugin's add.json.php endpoint that allows authenticated users to modify other users' OAuth token records. Attackers can supply arbitrary row IDs to overwrite another...
CVE-2026-86725 AVideo SocialMediaPublisher Missing Authorization via add.json.php
AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in the SocialMediaPublisher plugin's add.json.php endpoint that allows authenticated users to modify other users' OAuth token records. Attackers can supply arbitrary row IDs to overwrite another...
CVE-2026-86725 AVideo SocialMediaPublisher Missing Authorization via add.json.php
AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in the SocialMediaPublisher plugin's add.json.php endpoint that allows authenticated users to modify other users' OAuth token records. Attackers can supply arbitrary row IDs to overwrite another...
CVE-2026-86725
AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in the SocialMediaPublisher plugin's add.json.php endpoint that allows authenticated users to modify other users' OAuth token records. Attackers can supply arbitrary row IDs to overwrite another...
CVE-2026-86720 WWBN AVideo Missing Authorization via resendRestreamer.json.php
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ownership of liverestreamsid in resendRestreamer.json.php, allowing authenticated users with canStream to access other users' restream destinations. Attackers can broadcast their live stream to victim-configured...
CVE-2026-86720
WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) contains a missing authorization flaw in resendRestreamer.json.php , which fails to validate ownership of the live_restreams_id parameter. An authenticated user with canStream permission can supply arbitrary live_restreams_id v...
CVE-2026-86720 WWBN AVideo Missing Authorization via resendRestreamer.json.php
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ownership of liverestreamsid in resendRestreamer.json.php, allowing authenticated users with canStream to access other users' restream destinations. Attackers can broadcast their live stream to victim-configured...
CVE-2026-86720 WWBN AVideo Missing Authorization via resendRestreamer.json.php
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ownership of liverestreamsid in resendRestreamer.json.php, allowing authenticated users with canStream to access other users' restream destinations. Attackers can broadcast their live stream to victim-configured...
CVE-2026-12647
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...
CVE-2026-12647
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before version 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server. The flaw enables privilege escalation beyond the attacker's initial credentials, reflected in a CVSS 3.1 score of 9.9 (Critical) w...
EUVD-2026-72815
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...
CVE-2026-12647
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...
CVE-2026-12646
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...
CVE-2026-12646
Ivanti Neurons for ITSM before version 2026.2 is affected by a Missing Authorization vulnerability that allows a remote authenticated attacker to execute arbitrary code on the server . The CVSS 3.1 base score is 9.9 (CRITICAL) , with a Changed Scope and High impact to confidentiality, integrity, ...
EUVD-2026-72814
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...