AzuraCast
- Total products in the ecosystem
- 2
- Total vulnerabilities (90 days)
- 20
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/09/2026, AzuraCast recorded 20 security vulnerabilities in the last 90 days across 1 products, including 14 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, AzuraCast had the most security vulnerabilities in the AzuraCast ecosystem, with 20 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-124442AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connector RedirectsCVE-2026-121433Stored CSV formula injection in AzuraCast bulk media exportsCVE-2026-121432AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS PlaylistCVE-2026-121431AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook ConnectorsCVE-2026-121430AzuraCast before 0.24.0 Missing Authorization via Station Waveform Endpoints| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-124442AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connector Redirects | Exploitation statusNot confirmed | FixYes |
| Published11/08/2026 |
| SeverityHigh |
CVE-2026-121433Stored CSV formula injection in AzuraCast bulk media exports | Exploitation statusActively exploited | FixYes | Affected productAzuraCast | Published11/03/2026 | SeverityMedium |
|---|
CVE-2026-121432AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist | Exploitation statusNot exploited | FixYes | Affected productAzuraCast | Published11/03/2026 | SeverityMedium |
|---|
CVE-2026-121431AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connectors | Exploitation statusNot confirmed | FixYes | Affected productAzuraCast | Published11/03/2026 | SeverityMedium |
|---|
CVE-2026-121430AzuraCast before 0.24.0 Missing Authorization via Station Waveform Endpoints | Exploitation statusNot confirmed | FixYes | Affected productAzuraCast | Published11/03/2026 | SeverityMedium |
|---|
CVE-2026-121429AzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe() | Exploitation statusActively exploited | FixYes | Affected productAzuraCast | Published11/03/2026 | SeverityHigh |
|---|
CVE-2026-121428AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in Timezone | Exploitation statusNot exploited | FixYes | Affected productAzuraCast | Published11/03/2026 | SeverityHigh |
|---|
CVE-2026-121427AzuraCast through 0.23.8 Config Injection via frontend_config.custom_config | Exploitation statusNot confirmed | FixYes | Affected productAzuraCast | Published11/03/2026 | SeverityHigh |
|---|
CVE-2026-100857AzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolation | Exploitation statusActively exploited | FixYes | Affected productAzuraCast | Published09/27/2026 | SeverityHigh |
|---|
CVE-2026-100856AzuraCast before 0.23.6 Code Injection via Remote Relay Password | Exploitation statusActively exploited | FixYes | Affected productAzuraCast | Published09/27/2026 | SeverityHigh |
|---|
CVE-2026-100855AzuraCast before 0.23.6 Missing Permission Check via /play | Exploitation statusActively exploited | FixYes | Affected productAzuraCast | Published09/27/2026 | SeverityHigh |
|---|
CVE-2026-100854AzuraCast before 0.23.6 Metadata Injection via Liquidsoap API | Exploitation statusActively exploited | FixYes | Affected productAzuraCast | Published09/27/2026 | SeverityMedium |
|---|
CVE-2026-100853AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass | Exploitation statusActively exploited | FixYes | Affected productAzuraCast | Published09/27/2026 | SeverityHigh |
|---|
CVE-2026-100852AzuraCast before 0.23.8 Command Injection via Streamer Username | Exploitation statusActively exploited | FixYes | Affected productAzuraCast | Published09/27/2026 | SeverityHigh |
|---|
CVE-2026-100851AzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profile | Exploitation statusActively exploited | FixYes | Affected productAzuraCast | Published09/27/2026 | SeverityHigh |
|---|
CVE-2026-100850AzuraCast before 0.23.8 SSRF and Local File Read via Remote Playlist | Exploitation statusActively exploited | FixYes | Affected productAzuraCast | Published09/27/2026 | SeverityMedium |
|---|
CVE-2026-100849AzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPs | Exploitation statusActively exploited | FixYes | Affected productAzuraCast | Published09/27/2026 | SeverityHigh |
|---|
CVE-2026-100848AzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URL | Exploitation statusActively exploited | FixYes | Affected productAzuraCast | Published09/27/2026 | SeverityHigh |
|---|
CVE-2026-100847AzuraCast before 0.23.8 DQL Injection via sortOrder | Exploitation statusActively exploited | FixYes | Affected productAzuraCast | Published09/27/2026 | SeverityHigh |
|---|
CVE-2026-76836AzuraCast through 0.23.8 Liquidsoap Configuration Write via Profile Edit Serialization Group Bypass | Exploitation statusActively exploited | FixYes | Affected productAzuraCast | Published08/24/2026 | SeverityHigh |
|---|
CVE-2026-42606AzuraCast: Password Reset Poisoning via Untrusted X-Forwarded-Host Header Leads to Account Takeover and 2FA Bypass | Exploitation statusActively exploited | FixYes | Affected productAzuraCast | Published05/09/2026 | SeverityHigh |
|---|
CVE-2026-42605AzuraCast: Path Traversal in `currentDirectory` Parameter Enables Remote Code Execution via Media Upload | Exploitation statusActively exploited | FixYes | Affected productAzuraCast | Published05/09/2026 | SeverityHigh |
|---|
CVE-2025-67737AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE | Exploitation statusNot exploited | FixYes | Affected productAzuraCast | Published12/12/2025 | SeverityLow |
|---|
CVE-2023-2531Improper Restriction of Excessive Authentication Attempts in azuracast/azuracast | Exploitation statusActively exploited | FixYes | Affected productazuracast/azuracast | Published05/05/2023 | SeverityHigh |
|---|
CVE-2023-2191Cross-site Scripting (XSS) - Stored in azuracast/azuracast | Exploitation statusActively exploited | FixYes | Affected productazuracast/azuracast | Published04/20/2023 | SeverityLow |
|---|
25 Results | Page 1 of 1