[ Vendor · 11 CVEs ]
AzuraCast
CVEs affecting AzuraCast published in the last 30 days, plus any AzuraCast CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-100856 | 27 Sep 2026 | CVSS 8.8 | AzuraCastAzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable… | |
| CVE-2026-100857 | 27 Sep 2026 | CVSS 8.0 | AzuraCastAzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter::cleanUpString() method that fails to sanitize Liquidsoap string… | |
| CVE-2026-100850 | 27 Sep 2026 | CVSS 7.7 | AzuraCastAzuraCast before 0.23.8 contains a server-side request forgery and local file read vulnerability in the AutoDJ remote playlist fetch… | |
| CVE-2026-100851 | 27 Sep 2026 | CVSS 7.6 | AzuraCastAzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/{id}/vue/profile endpoint that allows authenticated… | |
| CVE-2026-100852 | 27 Sep 2026 | CVSS 8.8 | AzuraCastAzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the… | |
| CVE-2026-100853 | 27 Sep 2026 | CVSS 5.9 | AzuraCastIn AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to… | |
| CVE-2026-100854 | 27 Sep 2026 | CVSS 6.3 | AzuraCastAzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header… | |
| CVE-2026-100855 | 27 Sep 2026 | CVSS 6.5 | AzuraCastAzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/{station_id}/file/{id}/play endpoint that allows… | |
| CVE-2026-100847 | 27 Sep 2026 | CVSS 7.5 | AzuraCastAzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php. Attackers can… | |
| CVE-2026-100848 | 27 Sep 2026 | CVSS 7.1 | AzuraCastAzuraCast (Composer package azuracast/azuracast) before 0.23.8 validates a station's "Remote Relay" URL only for URL syntax and an http/https scheme… | |
| CVE-2026-100849 | 27 Sep 2026 | CVSS 7.1 | AzuraCastAzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in… |