ai-fusion-video vulnerabilities
CVEs whose affected-version data names the ai-fusion-video package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
CVE-2026-121940High· 8.8PoCStonewuu ai-fusion-video before 1.3.0 IDOR via Project, Asset and Script Controllers
Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows authenticated users to access other users' projects by supplying unscoped object ids. Attackers can enumerate auto-increment ids…
CVE-2026-110213Medium· 4.3Stonewuu ai-fusion-video through 1.2.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' generation results by supplying arbitrary task ids
Stonewuu ai-fusion-video through 1.2.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' generation results by supplying arbitrary task ids. Attackers can enumerate auto-incre…
CVE-2026-110212Medium· 4.3PoCStonewuu ai-fusion-video through 1.2.0 contains a path traversal vulnerability that allows authenticated users to write uploaded files outside the media directory via the subDir parameter of POST /api/storage/upload
Stonewuu ai-fusion-video through 1.2.0 contains a path traversal vulnerability that allows authenticated users to write uploaded files outside the media directory via the subDir parameter of POST /api/storage/upload. Attackers can supply…
CVE-2026-110209Medium· 6.5PoCStonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerability that allows authenticated non-admin users to read stored secrets through unprotected ApiConfigController and SystemConfigController endpoints
Stonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerability that allows authenticated non-admin users to read stored secrets through unprotected ApiConfigController and SystemConfigController endpoints. Attacker…