Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-33688AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery EndpointPackagist · wwbn/avideo
- CVE-2026-33685AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User DataPackagist · wwbn/avideo
- CVE-2026-33683AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About FieldPackagist · wwbn/avideo
- CVE-2026-33681AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin NamePackagist · wwbn/avideo
- CVE-2026-33651AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat()Packagist · wwbn/avideo
- CVE-2026-33650AVideo's Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video DeletionPackagist · wwbn/avideo
- CVE-2026-33649AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission ModificationPackagist · wwbn/avideo
- CVE-2026-33648AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File PathPackagist · wwbn/avideo
- CVE-2026-33647AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File UploadPackagist · wwbn/avideo
- CVE-2026-33513AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)Packagist · wwbn/avideo
- CVE-2026-33512AVideo has an unauthenticated decrypt oracle leaking any ciphertextPackagist · wwbn/avideo
- CVE-2026-33507AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin UploadPackagist · wwbn/avideo
- CVE-2026-33502AVideo has Unauthenticated SSRF via plugin/Live/test.phpPackagist · wwbn/avideo
- CVE-2026-33501AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions PluginPackagist · wwbn/avideo
- CVE-2026-33500AVideo Vulnerable to Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks SanitizationPackagist · wwbn/avideo
- CVE-2026-33499AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.phpPackagist · wwbn/avideo
- CVE-2026-33493AVideo has a Path Traversal in import.json.php that Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI ParameterPackagist · wwbn/avideo
- CVE-2026-33492AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session RegenerationPackagist · wwbn/avideo
- CVE-2026-33488AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl PluginPackagist · wwbn/avideo
- CVE-2026-4404Use of hard coded credentials in GoHarbor HarborGo · github.com/goharbor/harbor
- CVE-2026-33485AVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name ParameterPackagist · wwbn/avideo
- CVE-2026-33483AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.phpPackagist · wwbn/avideo
- CVE-2026-33482AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand()Packagist · wwbn/avideo
- CVE-2026-33480AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks ProxyPackagist · wwbn/avideo
- CVE-2026-33479AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against AdminPackagist · wwbn/avideo
- CVE-2026-33478AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command InjectionPackagist · wwbn/avideo
- CVE-2026-33354AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php`Packagist · wwbn/avideo
- CVE-2026-33352AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)Packagist · wwbn/avideo
- CVE-2026-33351AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification BypassPackagist · wwbn/avideo
- CVE-2026-33297AVideo has an IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.phpPackagist · wwbn/avideo