AVideo-Encoder vulnerabilities
CVEs whose affected-version data names the AVideo-Encoder package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-61567Critical· 10.0AVideo-Encoder: unauthenticated command execution through streamer login trust
AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint `view/videosListToLive.php` accepts an attacker-named streamer in `webSiteRootURL`, calls `Login::run` in `objects/Login.php`, and trusts the returned JSON a…
CVE-2026-61571High· 7.3AVideo-Encoder: missing authentication on control and status endpoints
AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer and exposes control and status PHP endpoints to anonymous network callers. `view/run.php` has a commented-out guard and invokes `Encoder:…
CVE-2026-61564Critical· 10.0AVideo-Encoder: unauthenticated installer PHP code injection
AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.php` assembles `videos/configuration.php` by interpolating request parameters, including `webSiteRootURL`, into single…