Security advisories

critical2026-03-26

CVE-2026-33867-AVideo has Plaintext Video Password Storage

wwbn/avideo · GHSA-363v-5rh8-23wg

high2026-03-26

CVE-2026-33770-AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables

wwbn/avideo · GHSA-584p-rpvq-35vf

high2026-03-26

CVE-2026-33767-AVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into Query

wwbn/avideo · GHSA-fj74-qxj7-r3vc

medium2026-03-26

CVE-2026-33766-AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints

wwbn/avideo · GHSA-f359-r3pv-2phf

medium2026-03-26

CVE-2026-33764-AVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and Transcriptions

wwbn/avideo · GHSA-g39v-qrj6-jxrh

medium2026-03-26

CVE-2026-33763-AVideo has an Unauthenticated Video Password Brute-Force Vulnerability via Unrate-Limited Boolean Oracle

wwbn/avideo · GHSA-8prq-2jr2-cm92

medium2026-03-26

CVE-2026-33761-AVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User Mappings

wwbn/avideo · GHSA-j724-5c6c-68g5

medium2026-03-26

CVE-2026-33759-AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents

wwbn/avideo · GHSA-75qq-68m8-pvfr

high2026-03-26

CVE-2026-6204-LibreNMS is Vulnerable to Remote Code Execution by Arbitrary File Write

librenms/librenms · GHSA-pr3g-phhr-h8fh

high2026-03-26

libcrux has an Incorrect Check of Signer Response Norm During Verification

cryspen/libcrux · GHSA-cp57-fq8g-qh6v

high2026-03-26

libcrux Panics During Standalone MAC Operations

cryspen/libcrux · GHSA-pv9v-5j35-xwcr

high2026-03-26

libcrux-sha3: Incorrect output from SHAKE squeeze functions

cryspen/libcrux · GHSA-q29p-9pfr-j652

high2026-03-26

libcrux has All-Zero Key Generation Upon Catastrophic RNG Failure

cryspen/libcrux · GHSA-434v-x5qv-pmh6

high2026-03-26

libcrux: Panic in Signature Hint Decoding During Verification

cryspen/libcrux · GHSA-xrf2-5r3p-5wgj

critical2026-03-26

splunk-otel-javaagent: Unsafe deserialization in RMI instrumentation may lead to Remote Code Execution

signalfx/splunk-otel-java · GHSA-h8w2-rv57-vc6f

medium2026-03-26

CVE-2026-33729-OpenFGA has an Authorization Bypass through cached keys

openfga/openfga · GHSA-h6c8-cww8-35hf

medium2026-03-26

CVE-2026-33535-ImageMagick has an Out-of-Bounds write of a zero byte in its X11 display interaction

imagemagick/imagemagick · GHSA-mw3m-pqr2-qv7c

low2026-03-26

CVE-2026-56385-Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata

craftcms/cms · GHSA-44px-qjjc-xrhq

critical2026-03-26

Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR

go-vikunja/vikunja · GHSA-2pv8-4c52-mf8j

medium2026-03-26

CVE-2026-33732-srvx is vulnerable to middleware bypass via absolute URI in request line

h3js/srvx · GHSA-p36q-q72m-gchr