CVE-2026-121430

AzuraCast versions before 0.24.0 are susceptible to a missing authorization vulnerability (CWE-862) in the GET and POST routes for /api/station/{station_id}/waveform/{media_id}. Because these routes lack necessary Permissions middleware , any authenticated user—even those without specific station...

EUVD-2026-115852

AzuraCast before 0.24.0 contains a missing authorization vulnerability in the GET and POST /api/station/stationid/waveform/mediaid routes, which lack Permissions middleware. Any authenticated user without station assignment can read another station's cached waveform JSON and overwrite it with...

CVE-2026-121430: AzuraCast: AzuraCast before 0.24.0 contains a missing authorization vulnerability in the GET and POST…

AzuraCast before 0.24.0 contains a missing authorization vulnerability in the GET and POST /api/station/stationid/waveform/mediaid routes, which lack Permissions middleware. Any authenticated user without station assignment can read another station's cached waveform JSON and overwrite it with...

Waveform Randomization for Secure ISAC

This paper studies waveform-level security for Integrated Sensing and Communication ISAC. Instead of relying on spatial beamforming or power allocation, we randomize the sensing waveform itself using phase keys and tangent Artificial Noise AN applied to a Fourier-curve constellation. Coordinated...

CVE-2025-7963

The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcodeeasywaveformplayer function in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-7963 Easy Waveform Player <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode_easywaveformplayer Function

The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcodeeasywaveformplayer function in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-7963

The Easy Waveform Player WordPress plugin (versions ≤ 1.2.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) in the shortcode_easywaveformplayer() function due to insufficient input sanitization and output escaping. Authenticated users with Contributor-level access or above can inject arbitra...

CVE-2025-7963 Easy Waveform Player <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode_easywaveformplayer Function

The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcodeeasywaveformplayer function in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2025-210826

The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcodeeasywaveformplayer function in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2026-84644

The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcode easywaveformplayer function in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-7963: Improper Neutralization of Input During Web Page Generation

The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcodeeasywaveformplayer function in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress Easy Waveform Player plugin <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Easy Waveform Player versions = 1.2.2...

CVE-2026-19332

A security vulnerability has been detected in NellyW8 MCP4EDA 1.0.0. Affected by this vulnerability is an unknown functionality of the component runopenlane/viewwaveform. The manipulation of the argument designname/vcdfile leads to command injection. Local access is required to approach this...

CVE-2026-19332 NellyW8 MCP4EDA run_openlane/view_waveform command injection

A security vulnerability has been detected in NellyW8 MCP4EDA 1.0.0. Affected by this vulnerability is an unknown functionality of the component runopenlane/viewwaveform. The manipulation of the argument designname/vcdfile leads to command injection. Local access is required to approach this...

CVE-2026-19332

A security vulnerability has been detected in NellyW8 MCP4EDA 1.0.0. Affected by this vulnerability is an unknown functionality of the component runopenlane/viewwaveform. The manipulation of the argument designname/vcdfile leads to command injection. Local access is required to approach this...

CVE-2026-32837

A flaw was found in miniaudio. An attacker can exploit a heap out-of-bounds read vulnerability in the WAV BEXT metadata parser by processing a specially crafted WAV file. This vulnerability, caused by improper null-termination handling in the coding history field, allows for out-of-bounds reads...

[SECURITY] Fedora 42 Update: SDL2_sound-2.0.5^20260117git1be041b-1.fc42

SDLsound is a library that handles the decoding of several popular sound file formats, such as .WAV and .OGG. It is meant to make the programmer's sound playback tasks simpler. The programmer gives SDLsound a filename, or feeds it data directly from one of many sources, and then reads the decoded...

WAV Fuzzer 1.0

This script is a fuzzer tool for WAV file processing programs that targets memory corruption vulnerabilities...

CVE-2026-20777

A heap-based buffer overflow vulnerability exists in the Nicolet WFT parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch db9a9a63. A specially crafted .wft file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability...

EUVD-2026-9291

A heap-based buffer overflow vulnerability exists in the Nicolet WFT parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch db9a9a63. A specially crafted .wft file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability...