Vulnerabilities in WWBN

323 results
Vexday analysis

O portfólio de vulnerabilidades do WWBN reúne 187 CVEs catalogadas, com 30 classificadas como críticas e 67 surgidas apenas nos últimos 90 dias — volume recente que indica aceleração no ritmo de descoberta e demanda atenção contínua ao ciclo de atualização. Embora nenhuma CVE esteja no catálogo KEV da CISA, situando a taxa de exploração ativa abaixo da média geral do catálogo, o CVE-2022-30690 apresenta EPSS de 0,8358, sinalizando alta probabilidade estimada de exploração e devendo ser tratado com prioridade. A falha mais recorrente é CWE-79 (Cross-Site Scripting), categoria que, combinada com a existência de ao menos uma prova de conceito pública, amplia a superfície de risco para ambientes que ainda não aplicaram as correções disponíveis.

CVE-2026-89248MEDIUMAVideo WebRTC Plugin Information Disclosure via status.json.phpEPSS 0.4%CVE-2026-91966MEDIUMAVideo through 29.0 Unauthenticated SSRF via Host HeaderEPSS 0.4%CVE-2026-33761MEDIUMAVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User MappingsEPSS 0.4%CVE-2026-89250HIGHWWBN AVideo Unauthenticated File Read via getRecordedFile.phpEPSS 0.4%CVE-2026-41055HIGHAVideo has an incomplete fix for CVE-2026-33039 (SSRF)EPSS 0.4%CVE-2026-34732MEDIUMAVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 EndpointsEPSS 0.4%CVE-2026-34369MEDIUMAVIdeo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password VerificationEPSS 0.4%CVE-2026-35450MEDIUMWWBN AVideo has Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.phpEPSS 0.4%CVE-2026-35452MEDIUMWWBN AVideo has Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.phpEPSS 0.4%CVE-2026-33507HIGHAVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin UploadEPSS 0.4%CVE-2026-30885MEDIUMWWBN AVideo - Unauthenticated IDOR - Playlist Information DisclosureEPSS 0.4%CVE-2026-84478MEDIUMWWBN AVideo Unauthenticated Arbitrary Log File DeletionEPSS 0.4%CVE-2026-89243CRITICALWWBN AVideo Stored XSS via UserGroups setGroup_nameEPSS 0.4%CVE-2026-33719HIGHAVideo Vulnerable to Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment in status.json.phpEPSS 0.4%CVE-2026-84187HIGHAVideo on_publish.php Missing Authentication Check via RTMP CallbackEPSS 0.3%CVE-2026-43884HIGHWWBN AVideo: SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()EPSS 0.3%CVE-2026-33651HIGHAVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat()EPSS 0.3%CVE-2026-89253CRITICALAVideo Stored XSS via donationLink in watch page buttonEPSS 0.3%CVE-2026-90543MEDIUMWWBN AVideo Missing Authentication via socketMessageLiveOwner.json.phpEPSS 0.3%CVE-2026-89255CRITICALAVideo LoginControl Stored XSS via PGP Public KeyEPSS 0.3%