CVE-2026-100857 | High | 8.0 | 2026-09-27 | AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter::cleanUpString() method that fails to sanitize Liquidsoap string interpolat… |
CVE-2026-100856 | High | 8.8 | 2026-09-27 | AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpStrin… |
CVE-2026-100855 | Medium | 6.5 | 2026-09-27 | AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/{station_id}/file/{id}/play endpoint that allows authenticate… |
CVE-2026-100854 | Medium | 6.3 | 2026-09-27 | AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence… |
CVE-2026-100853 | Medium | 5.9 | 2026-09-27 | In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download m… |
CVE-2026-100852 | High | 8.8 | 2026-09-27 | AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer user… |
CVE-2026-100851 | High | 7.6 | 2026-09-27 | AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/{id}/vue/profile endpoint that allows authenticated users with o… |
CVE-2026-100850 | High | 7.7 | 2026-09-27 | AzuraCast before 0.23.8 contains a server-side request forgery and local file read vulnerability in the AutoDJ remote playlist fetch (backend/src/Radio/AutoDJ/… |
CVE-2026-100849 | High | 7.1 | 2026-09-27 | AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl() (back… |
CVE-2026-100848 | High | 7.1 | 2026-09-27 | AzuraCast (Composer package azuracast/azuracast) before 0.23.8 validates a station's "Remote Relay" URL only for URL syntax and an http/https scheme (Utilities… |
CVE-2026-100847 | High | 7.5 | 2026-09-27 | AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php. Attackers can inject arbitra… |
CVE-2026-76836 | High | 8.8 | 2026-08-24 | AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not require the permission guarding them. The backend_config propert… |
CVE-2026-42606 | High | 8.1 | 2026-05-09 | AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the ApplyXForwarded middleware unconditionally trusts the client-su… |
CVE-2026-42605 | High | 8.8 | 2026-05-09 | AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the currentDirectory request parameter in the Flow.js media upload… |
CVE-2025-67737 | Low | 3.1 | 2025-12-12 | AzuraCast is a self-hosted, all-in-one web radio management suite. Versions 0.23.1 mistakenly include an API endpoint that is intended for internal use by the… |
CVE-2023-2531 | Critical | 9.8 | 2023-05-05 | Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3. |
CVE-2023-2191 | Medium | 4.8 | 2023-04-20 | Cross-site Scripting (XSS) - Stored in GitHub repository azuracast/azuracast prior to 0.18. |