AZ
Product
AzuraCast
17
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 11Medium 4Low 1
Watch
Add AzuraCast to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-2531 | 9.8 | May 5 | Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3 Affected: before 0.18.3 |
| CVE-2026-100856 | 8.8 | Sep 27 | AzuraCast before 0.23.6 Code Injection via Remote Relay Password Affected: before 0.23.6 |
| CVE-2026-100852 | 8.8 | Sep 27 | AzuraCast before 0.23.8 Command Injection via Streamer Username Affected: before 0.23.8 |
| CVE-2026-76836 | 8.8 | Aug 24 | AzuraCast through 0.23.8 Liquidsoap Configuration Write via Profile Edit Serialization Group Bypass Affected: through 0.23.8 |
| CVE-2026-42605 | 8.8 | May 9 | AzuraCast: Path Traversal in `currentDirectory` Parameter Enables Remote Code Execution via Media Upload Affected: < 0.23.6 |
| CVE-2026-42606 | 8.8 | May 9 | AzuraCast: Password Reset Poisoning via Untrusted X-Forwarded-Host Header Leads to Account Takeover and 2FA Bypass Affected: < 0.23.6 |
| CVE-2026-100857 | 8.0 | Sep 27 | AzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolation Affected: before 0.23.4 |
| CVE-2026-100850 | 7.7 | Sep 27 | AzuraCast before 0.23.8 SSRF and Local File Read via Remote Playlist Affected: before 0.23.8 |
| CVE-2026-100851 | 7.6 | Sep 27 | AzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profile Affected: before 0.23.8 |
| CVE-2026-100847 | 7.5 | Sep 27 | AzuraCast before 0.23.8 DQL Injection via sortOrder Affected: before 0.23.8 |
| CVE-2026-100849 | 7.1 | Sep 27 | AzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPs Affected: before 0.23.8 |
| CVE-2026-100848 | 7.1 | Sep 27 | AzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URL Affected: before 0.23.8 |
| CVE-2026-100855 | 6.5 | Sep 27 | AzuraCast before 0.23.6 Missing Permission Check via /play Affected: before 0.23.6 |
| CVE-2026-100854 | 6.3 | Sep 27 | AzuraCast before 0.23.6 Metadata Injection via Liquidsoap API Affected: before 0.23.6 |
| CVE-2026-100853 | 5.9 | Sep 27 | AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass Affected: before 0.23.8 |
| CVE-2023-2191 | 4.8 | Apr 20 | Cross-site Scripting (XSS) - Stored in GitHub repository azuracast/azuracast prior to 0.18 Affected: before 0.18.0 |
| CVE-2025-67737 | 3.7 | Dec 12 | AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE Affected: < 0.23.2 |
Showing 17