AZ
Vendor
AzuraCast
17
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-100857 | AZ AzuraCast AzuraCast | 8.0 | Sep 27 | AzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolation |
| CVE-2026-100856 | AZ AzuraCast AzuraCast | 8.8 | Sep 27 | AzuraCast before 0.23.6 Code Injection via Remote Relay Password |
| CVE-2026-100855 | AZ AzuraCast AzuraCast | 6.5 | Sep 27 | AzuraCast before 0.23.6 Missing Permission Check via /play |
| CVE-2026-100854 | AZ AzuraCast AzuraCast | 6.3 | Sep 27 | AzuraCast before 0.23.6 Metadata Injection via Liquidsoap API |
| CVE-2026-100853 | AZ AzuraCast AzuraCast | 5.9 | Sep 27 | AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass |
| CVE-2026-100852 | AZ AzuraCast AzuraCast | 8.8 | Sep 27 | AzuraCast before 0.23.8 Command Injection via Streamer Username |
| CVE-2026-100851 | AZ AzuraCast AzuraCast | 7.6 | Sep 27 | AzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profile |
| CVE-2026-100850 | AZ AzuraCast AzuraCast | 7.7 | Sep 27 | AzuraCast before 0.23.8 SSRF and Local File Read via Remote Playlist |
| CVE-2026-100849 | AZ AzuraCast AzuraCast | 7.1 | Sep 27 | AzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPs |
| CVE-2026-100848 | AZ AzuraCast AzuraCast | 7.1 | Sep 27 | AzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URL |
| CVE-2026-100847 | AZ AzuraCast AzuraCast | 7.5 | Sep 27 | AzuraCast before 0.23.8 DQL Injection via sortOrder |
| CVE-2026-76836 | AZ AzuraCast AzuraCast | 8.8 | Aug 24 | AzuraCast through 0.23.8 Liquidsoap Configuration Write via Profile Edit Serialization Group Bypass |
| CVE-2026-42605 | AZ AzuraCast AzuraCast | 8.8 | May 9 | AzuraCast: Path Traversal in `currentDirectory` Parameter Enables Remote Code Execution via Media Upload |
| CVE-2026-42606 | AZ AzuraCast AzuraCast | 8.8 | May 9 | AzuraCast: Password Reset Poisoning via Untrusted X-Forwarded-Host Header Leads to Account Takeover and 2FA Bypass |
| CVE-2025-67737 | AZ AzuraCast AzuraCast | 3.7 | Dec 12 | AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE |
| CVE-2023-2531 | AZ Azuracast Azuracast | 9.8 | May 5 | Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3 |
| CVE-2023-2191 | AZ Azuracast Azuracast | 4.8 | Apr 20 | Cross-site Scripting (XSS) - Stored in GitHub repository azuracast/azuracast prior to 0.18 |