AZ
Product
AzuraCast
17
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 11Medium 4Low 1
Watch
Add AzuraCast to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-100856 | 8.8 | Sep 27 | AzuraCast before 0.23.6 Code Injection via Remote Relay Password Affected: before 0.23.6 |
| CVE-2026-100852 | 8.8 | Sep 27 | AzuraCast before 0.23.8 Command Injection via Streamer Username Affected: before 0.23.8 |
| CVE-2026-76836 | 8.8 | Aug 24 | AzuraCast through 0.23.8 Liquidsoap Configuration Write via Profile Edit Serialization Group Bypass Affected: through 0.23.8 |
| CVE-2026-42605 | 8.8 | May 9 | AzuraCast: Path Traversal in `currentDirectory` Parameter Enables Remote Code Execution via Media Upload Affected: < 0.23.6 |
| CVE-2026-42606 | 8.8 | May 9 | AzuraCast: Password Reset Poisoning via Untrusted X-Forwarded-Host Header Leads to Account Takeover and 2FA Bypass Affected: < 0.23.6 |
| CVE-2026-100857 | 8.0 | Sep 27 | AzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolation Affected: before 0.23.4 |
| CVE-2026-100850 | 7.7 | Sep 27 | AzuraCast before 0.23.8 SSRF and Local File Read via Remote Playlist Affected: before 0.23.8 |
| CVE-2026-100851 | 7.6 | Sep 27 | AzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profile Affected: before 0.23.8 |
| CVE-2026-100847 | 7.5 | Sep 27 | AzuraCast before 0.23.8 DQL Injection via sortOrder Affected: before 0.23.8 |
| CVE-2026-100849 | 7.1 | Sep 27 | AzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPs Affected: before 0.23.8 |
| CVE-2026-100848 | 7.1 | Sep 27 | AzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URL Affected: before 0.23.8 |
Showing 11