EUVD-2026-72863

AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthenticated attackers to retrieve stream keys and m3u8 URLs by accessing the endpoint without authentication. Attackers can enumerate private, unlisted, and group-restricted live...

CVE-2026-86727 AVideo through 29.0 Information Disclosure via stats.json.php

AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthenticated attackers to retrieve stream keys and m3u8 URLs by accessing the endpoint without authentication. Attackers can enumerate private, unlisted, and group-restricted live...

CVE-2026-86721 AVideo through c3edcc274c Authorization Bypass via Session Cookie

AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $REQUEST'key' parameter in saveLive.php and related endpoints. Attackers can publish to any user's RTMP stream without authentication by using the...

CVE-2026-86720

WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) contains a missing authorization flaw in resendRestreamer.json.php , which fails to validate ownership of the live_restreams_id parameter. An authenticated user with canStream permission can supply arbitrary live_restreams_id v...

CVE-2026-86721

AVideo through commit c3edcc274c is affected by an authorization bypass in saveLive.php and related endpoints. A session cookie named key with a known constant value value overrides the $_REQUEST['key'] parameter, allowing an unauthenticated attacker to publish to any user's RTMP stream and hijac...

EUVD-2026-72857

AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $REQUEST'key' parameter in saveLive.php and related endpoints. Attackers can publish to any user's RTMP stream without authentication by using the...

redis: Redis: Remote Code Execution via specially crafted RESTORE payload

A flaw was found in Redis. An authenticated attacker, in an unusual configuration where they can execute the RESTORE command, could exploit a double free vulnerability. This occurs when a specially crafted RESTORE payload references the same NACK pending entry by multiple consumers, and both...

Denial Of Service (DoS)

Spring Framework is vulnerable to Denial Of Service. The vulnerability is due to stream corruption when Server-Sent Events SSE are used with functional web framework applications in Spring MVC...

Insecure Deserialization

Spring Cloud Stream is vulnerable to insecure deserialization. The vulnerability is due to deserialization of untrusted types, where crafted serialized objects are deserialized without validation and attackers can supply malicious payloads to achieve code execution...

Important: Red Hat Security Advisory: valkey security, bug fix, and enhancement update

An update for valkey is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

valkey: Valkey: Remote code execution via use-after-free in stream deserialization

A flaw was found in Valkey, a distributed key-value database. A remote attacker could exploit a use-after-free vulnerability in the RESTORE command. This occurs when a malformed data stream is processed during stream deserialization, causing a shared resource to be improperly managed. If...

valkey: Valkey: Remote code execution via use-after-free in stream deserialization

A flaw was found in Valkey, a distributed key-value database. A remote attacker could exploit a use-after-free vulnerability in the RESTORE command. This occurs when a malformed data stream is processed during stream deserialization, causing a shared resource to be improperly managed. If...

Important: Red Hat Security Advisory: valkey security, bug fix, and enhancement update

An update for valkey is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

PT-2026-87123

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.0 Description An information disclosure issue exists in the 'restreamsActive.json.php' endpoint. Authenticated users with streaming capabilities can enumerate the identities and source stream keys of active restream...

ALSA-2026:64807 Important: valkey security, bug fix, and enhancement update

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing s...

RHEL 10 : valkey (RHSA-2026:64796)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:64796 advisory. Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists,...

RHEL 9 : valkey (RHSA-2026:64807)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:64807 advisory. Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, se...

PT-2026-87118

Name of the Vulnerable Software and Affected Versions AVideo versions prior to commit c3edcc274c Description An authorization bypass exists where a session cookie named key with the value value overrides the key parameter within the $ REQUEST array in the 'saveLive.php' endpoint and related...

PT-2026-87125

AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-stream keys and private EPG schedules to unauthenticated users. Attackers can request the endpoint with sequential user or playlist IDs to retrieve sensitive credentials, server...

PT-2026-87124

AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthenticated attackers to retrieve stream keys and m3u8 URLs by accessing the endpoint without authentication. Attackers can enumerate private, unlisted, and group-restricted live...