CVE-2026-86719

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 master contains a cross-site request forgery vulnerability in the CustomizeUser plugin endpoint plugin/CustomizeUser/swapUser.json.php. The endpoint takes usersid from $REQUEST and invokes User::swapUser without calling...

CVE-2026-82053

MongoDB Server's LDAP authorization integration is affected by an improper session handling issue. Under certain configurations, pooled LDAP connections can retain stale authentication identities after user authentication. Subsequent authorization queries may then execute under an unintended LDAP...

CVE-2026-82053 Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role Assignment

A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rather than the...

CVE-2026-82053 Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role Assignment

A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rather than the...

CVE-2026-82053 Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role Assignment

A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rather than the...

Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role Assignment

A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rather than the...

OPENSUSE-SU-2026:21811-1 Security update for tomcat11

This update for tomcat11 fixes the following issues: - CVE-2026-65182: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: TOCTOU when setting specific permissions for Unix Domain Sockets bsc1276894. - CVE-2026-65637: HTTP/2 no-authority bypass of strict SNI validation - fix...

CVE-2026-86724 AVideo YPTWallet saveBalance.php Cross-Site Request Forgery

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php that allows attackers to set arbitrary wallet balances by relying only on session cookies without token validation. Attackers can craft a...

CVE-2026-86724 AVideo YPTWallet saveBalance.php Cross-Site Request Forgery

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php that allows attackers to set arbitrary wallet balances by relying only on session cookies without token validation. Attackers can craft a...

EUVD-2026-72860

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php that allows attackers to set arbitrary wallet balances by relying only on session cookies without token validation. Attackers can craft a...

CVE-2026-86721 AVideo through c3edcc274c Authorization Bypass via Session Cookie

AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $REQUEST'key' parameter in saveLive.php and related endpoints. Attackers can publish to any user's RTMP stream without authentication by using the...

CVE-2026-86721

AVideo through commit c3edcc274c is affected by an authorization bypass in saveLive.php and related endpoints. A session cookie named key with a known constant value value overrides the $_REQUEST['key'] parameter, allowing an unauthenticated attacker to publish to any user's RTMP stream and hijac...

CVE-2026-86721 AVideo through c3edcc274c Authorization Bypass via Session Cookie

AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $REQUEST'key' parameter in saveLive.php and related endpoints. Attackers can publish to any user's RTMP stream without authentication by using the...

CVE-2026-86721

AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $REQUEST'key' parameter in saveLive.php and related endpoints. Attackers can publish to any user's RTMP stream without authentication by using the...

CVE-2026-86721 AVideo through c3edcc274c Authorization Bypass via Session Cookie

AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $REQUEST'key' parameter in saveLive.php and related endpoints. Attackers can publish to any user's RTMP stream without authentication by using the...

EUVD-2026-72857

AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $REQUEST'key' parameter in saveLive.php and related endpoints. Attackers can publish to any user's RTMP stream without authentication by using the...

CVE-2026-86719 WWBN AVideo CustomizeUser Cross-Site Request Forgery Session Hijacking

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 master contains a cross-site request forgery vulnerability in the CustomizeUser plugin endpoint plugin/CustomizeUser/swapUser.json.php. The endpoint takes usersid from $REQUEST and invokes User::swapUser without calling...

CVE-2026-86719

WWBN AVideo through commit c3edcc274c (master) is affected by a cross-site request forgery (CSRF) vulnerability in the CustomizeUser plugin at the endpoint plugin/CustomizeUser/swapUser.json.php. The endpoint reads users_id from $_REQUEST and calls User::swapUser() without CSRF protection, as the...

CVE-2026-86719 WWBN AVideo CustomizeUser Cross-Site Request Forgery Session Hijacking

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 master contains a cross-site request forgery vulnerability in the CustomizeUser plugin endpoint plugin/CustomizeUser/swapUser.json.php. The endpoint takes usersid from $REQUEST and invokes User::swapUser without calling...

CVE-2026-86719 WWBN AVideo CustomizeUser Cross-Site Request Forgery Session Hijacking

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 master contains a cross-site request forgery vulnerability in the CustomizeUser plugin endpoint plugin/CustomizeUser/swapUser.json.php. The endpoint takes usersid from $REQUEST and invokes User::swapUser without calling...