blakeblackshear frigate

• CVE-2026-75608 High 7.7 Frigate: Viewer-Role User Can Access go2rtc Internal API to obtain sensitive information 0.4%
• CVE-2026-75607 High 8.1 Frigate: WebSocket Missing Authorization — Viewer Can Execute Admin-Only Operations 0.6%
• CVE-2026-54652 High 8.1 Frigate viewer can read logs exposing admin and camera credentials 0.3%
• CVE-2026-33470 Medium 6.5 Frigate has cross-camera snapshot disclosure via unrestricted timeline IDs and missing authorization in /api/events/{event_id}/snapshot-clean.webp 0.3%
• CVE-2026-33469 Medium 6.5 Authenticated Frigate users can read the full unredacted configuration via `/api/config/raw 0.3%
• CVE-2026-33126 Medium 5.0 Frigate has SSRF vulnerability in /ffprobe endpoint 0.2%
• CVE-2026-33125 High 7.1 Frigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts 0.3%
• CVE-2026-33124 High 8.6 Frigate has insecure password change functionality 0.3%
• CVE-2026-25643 Critical 9.1 Frigate Affected by Authenticated Remote Command Execution (RCE) and Container Escape 3.0%
• CVE-2025-62382 High 7.7 Frigate Vulnerable to Arbitrary File Read via Export Thumbnail "image_path" parameter 0.4%
• CVE-2024-32874 Medium 6.8 In Frigate, Malicious Long Unicode filenames may cause a Multiple Application-level Denial of Service 0.8%
• CVE-2023-45672 High 7.5 Frigate unsafe deserialization in `load_config_with_no_duplicates` of `frigate/util/builtin.py` 1.6%
• CVE-2023-45671 Medium 4.7 Frigate reflected XSS through `/<camera_name>` API endpoints 1.4%
• CVE-2023-45670 High 7.5 Frigate cross-site request forgery in `config_save` and `config_set` request handlers 0.5%