AzuraCast AzuraCast

• CVE-2026-121433 Medium 5.4 AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media Export 0.2%
• CVE-2026-121432 Low 3.5 AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist 0.2%
• CVE-2026-121431 Medium 5.3 AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connectors 0.3%
• CVE-2026-121430 Medium 5.4 AzuraCast before 0.24.0 Missing Authorization via Station Waveform Endpoints 0.1%
• CVE-2026-121429 High 8.8 AzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe() 1.5%
• CVE-2026-121428 High 8.8 AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in Timezone 0.7%
• CVE-2026-121427 High 7.5 AzuraCast through 0.23.8 Config Injection via frontend_config.custom_config 0.3%
• CVE-2026-100857 High 8.0 AzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolation 0.4%
• CVE-2026-100856 High 8.8 AzuraCast before 0.23.6 Code Injection via Remote Relay Password 0.5%
• CVE-2026-100855 Medium 6.5 AzuraCast before 0.23.6 Missing Permission Check via /play 0.2%
• CVE-2026-100854 Medium 6.3 AzuraCast before 0.23.6 Metadata Injection via Liquidsoap API 0.2%
• CVE-2026-100853 Medium 5.9 AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass 0.3%
• CVE-2026-100852 High 8.8 AzuraCast before 0.23.8 Command Injection via Streamer Username 4.6%
• CVE-2026-100851 High 7.6 AzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profile 0.3%
• CVE-2026-100850 High 7.7 AzuraCast before 0.23.8 SSRF and Local File Read via Remote Playlist 0.3%
• CVE-2026-100849 High 7.1 AzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPs 0.3%
• CVE-2026-100848 High 7.1 AzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URL 0.2%
• CVE-2026-100847 High 7.5 AzuraCast before 0.23.8 DQL Injection via sortOrder 0.3%
• CVE-2026-76836 High 8.8 AzuraCast through 0.23.8 Liquidsoap Configuration Write via Profile Edit Serialization Group Bypass 0.4%
• CVE-2026-42605 High 8.8 AzuraCast: Path Traversal in `currentDirectory` Parameter Enables Remote Code Execution via Media Upload 0.8%
• CVE-2026-42606 High 8.1 AzuraCast: Password Reset Poisoning via Untrusted X-Forwarded-Host Header Leads to Account Takeover and 2FA Bypass 0.5%
• CVE-2025-67737 Low 3.1 AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE 0.2%