How many wwbn avideo CVEs are in CISA KEV?

None of wwbn avideo's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of wwbn avideo are affected?

161 distinct wwbn avideo versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in wwbn avideo CVEs?

wwbn avideo's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-918 (Server-Side Request Forgery (SSRF)), CWE-862 (Missing Authorization), CWE-352 (Cross-Site Request Forgery (CSRF)).

How many critical wwbn avideo vulnerabilities are there?

wwbn avideo has 34 critical and 87 high-severity CVEs.

What is the average severity of wwbn avideo CVEs?

The average CVSS base score across wwbn avideo's scored CVEs is 7.2.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

wwbn

223 CVEs

wwbn avideo Vulnerabilities

Name: wwbn avideo vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for avideo by wwbn.

223

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

183

Public exploits

PoC or exploit code

7.2

Avg CVSS

2019–2026

Last updated July 20, 2026

Overview

wwbn avideo has 223 published CVE records since 2019, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 183 have a known public exploit. The average CVSS base score across scored CVEs is 7.2.

This page aggregates every publicly disclosed vulnerability (CVE) affecting wwbn avideo, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of wwbn avideo's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical34

High87

Medium100

Low2

In CISA’s Known Exploited Vulnerabilities catalog

0

None of wwbn avideo's CVEs are currently listed in CISA's KEV catalog.

Public exploits

183

183 of wwbn avideo's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every wwbn avideo version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

2.2199 CVEs
2.7199 CVEs
3.4199 CVEs
4.0199 CVEs
7.2199 CVEs
7.3198 CVEs
7.4198 CVEs
7.6197 CVEs
7.7197 CVEs
7.8197 CVEs
8.1197 CVEs
8.5194 CVEs
8.6194 CVEs
8.7194 CVEs
10.8192 CVEs
11192 CVEs
11.1192 CVEs
11.1.1192 CVEs
11.5192 CVEs
11.6192 CVEs
8.9192 CVEs
8.9.1192 CVEs
12.4161 CVEs
14.3160 CVEs
14.3.1160 CVEs
18.0153 CVEs
21.0152 CVEs
22.0151 CVEs
24.0148 CVEs
25.0146 CVEs
26.0127 CVEs
29.048 CVEs
dev master commit 3f7c036422 CVEs
14.47 CVEs
dev master commit 8a8954ff7 CVEs
dev master commit 15fed957fb2 CVEs
dev master commit 3c6bb3ff1 CVE

Version ranges

<= 26.073 CVEs
<= 29.048 CVEs
11.6 <= v <= 11.625 CVEs
< 26.018 CVEs
>= dev master commit 15fed957fb11 CVEs
15fed957fb <= v <= 15fed957fb10 CVEs
< 20.09 CVEs
< 4a53ab20569 CVEs
14.4 <= v <= 14.47 CVEs
< 12.44 CVEs
< 29.04 CVEs
< 24.03 CVEs
8.1 <= v <= 8.13 CVEs
< 8.9

Fixed in

aee1e11ee8d9343f87b7643e49cc32924b07979b19 CVEs
26.017 CVEs
20.09 CVEs
4a53ab20569 CVEs
2386f39caea1d2ef36267b252fa76af2832946235 CVEs
12.44 CVEs
25305ffb07b87798db52536cda0329c988e6dac74 CVEs
24.03 CVEs
b4f150163b5cd6db86972cff1675c5db39899d153 CVEs
> 29.02 CVEs
2375eb5e0a6d3cbcfb05377657d0820a7d470b1d2 CVEs
8.92 CVEs

Find a version

223 CVEs

Sort

AVideo Encoder downloadURL SSRF via unpinned retry fallback
CVE-2026-64626
Public exploit
Patch
CWE-918
Medium · CVSS 5.3
EPSS 0.2% (9th pct)2026-07-20
AVideo before 29.0 OS Command Injection via execAsync
CVE-2026-64625
Patch
CWE-78
Critical · CVSS 9.3
EPSS 0.4% (28th pct)2026-07-20
AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data
CVE-2026-33731
Public exploit
Patch
CWE-345
Medium · CVSS 6.5
EPSS 0.1% (4th pct)2026-07-16
AVideo incomplete fix for CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink
CVE-2026-55173
Public exploit
Patch
CWE-78
High · CVSS 8.1
EPSS 2.2% (80th pct)2026-07-16
AVideo Has Unauthenticated .env File Exposure via Official Docker Compose Configuration
CVE-2026-33692
Public exploit
Patch
CWE-20
High · CVSS 7.5
EPSS 0.3% (18th pct)2026-07-16
AVideo through 29.0 OS Command Injection via ffmpeg.json.php
CVE-2026-63305
Public exploit
Patch
CWE-78
Critical · CVSS 9.2
EPSS 1.4% (69th pct)2026-07-16
AVideo through 29.0 OS Command Injection via listFFmpegProcesses
CVE-2026-63304
Public exploit
Patch
CWE-78
Critical · CVSS 9.2
EPSS 1.4% (69th pct)2026-07-16
AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin
CVE-2026-54458
Public exploit
Patch
CWE-79
Critical · CVSS 9.6
EPSS 0.3% (23th pct)2026-07-15
WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section
CVE-2026-50183
Public exploit
Patch
CWE-79
Medium · CVSS 4.7
EPSS 0.2% (6th pct)2026-07-15
AVideo Has Unauthenticated Reflected XSS via $_GET['search'] in YouTubeAPI Gallery Pagination
CVE-2026-50182
Public exploit
Patch
CWE-79
Medium · CVSS 6.1
EPSS 0.2% (8th pct)2026-07-15
WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)
CVE-2026-49279
Public exploit
Patch
CWE-79
High · CVSS 7.7
EPSS 0.3% (25th pct)2026-07-15
AVideo's Privilege AVideo: Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions
CVE-2026-33684
Public exploit
Patch
CWE-862
Medium · CVSS 5.3
EPSS 0.2% (11th pct)2026-07-15
AVideo - Stored Cross-Site Scripting via Unescaped User-Agent in Participants Panel
CVE-2026-60092
Public exploit
Patch
CWE-79
Medium · CVSS 5.1
EPSS 0.2% (10th pct)2026-07-08
AVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item Fields
CVE-2026-56347
Public exploit
Patch
CWE-79
Medium · CVSS 5.3
EPSS 0.3% (18th pct)2026-06-20
AVideo - Unauthenticated PGP Message Decryption via decryptMessage.json.php Endpoint
CVE-2026-56346
Public exploit
Patch
CWE-306
Medium · CVSS 6.9
EPSS 0.6% (46th pct)2026-06-20
AVideo - Arbitrary User Session Hijacking via Meet Plugin uploadRecordedVideo Endpoint
CVE-2026-56345
Patch
CWE-287
Critical · CVSS 9.2
EPSS 0.5% (37th pct)2026-06-20
AVideo - Unauthenticated Access to Payment Log DataTables Endpoints via list.json.php
CVE-2026-56341
Public exploit
Patch
CWE-862
High · CVSS 8.7
EPSS 0.5% (37th pct)2026-06-20
WWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute
CVE-2026-45580CWE-79
Medium · CVSS 5.4
EPSS 0.1% (3th pct)2026-05-29
WWBN AVideo Live: OS command injection in on_publish.php execAsync via unescaped m3u8 URL
CVE-2026-45578CWE-78
High · CVSS 8.8
EPSS 0.3% (24th pct)2026-05-29
WWBN AVideo plugin/LoginControl/set.json.php: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA
CVE-2026-45610
Public exploit
CWE-352
Medium · CVSS 6.5
EPSS 0.1% (1th pct)2026-05-29
AVideo CVE-2026-43884 incomplete fix - `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post
CVE-2026-45619CWE-918
Medium · CVSS 6.5
EPSS 0.1% (3th pct)2026-05-29
AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration
CVE-2026-45620CWE-204
Medium · CVSS 5.3
EPSS 0.2% (9th pct)2026-05-29
WWBN AVideo: Authenticated Arbitrary File Read in view/update.php
CVE-2026-45731
Public exploit
CWE-22
Medium · CVSS 6.9
EPSS 0.5% (38th pct)2026-05-29
WWBN AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php`
CVE-2026-46337
Public exploit
CWE-22
Medium · CVSS 6.9
EPSS 0.5% (37th pct)2026-05-29
WWBN AVideo: Stored XSS via unescaped Gallery category description
CVE-2026-47694
Public exploit
CWE-79
Medium · CVSS 5.4
EPSS 0.2% (6th pct)2026-05-29
WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint
CVE-2026-47696
Public exploit
CWE-345
High · CVSS 7.1
EPSS 0.1% (2th pct)2026-05-29
WWBN AVideo: Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization
CVE-2026-43885
Public exploit
Patch
CWE-862
High · CVSS 7.7
EPSS 0.3% (17th pct)2026-05-11
WWBN AVideo: SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()
CVE-2026-43884
Patch
CWE-918
High · CVSS 7.7
EPSS 0.3% (27th pct)2026-05-11
WWBN AVideo: IDOR in PayPalYPT agreementCancel.json.php Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements
CVE-2026-43883
Public exploit
Patch
CWE-639
Medium · CVSS 4.2
EPSS 0.2% (6th pct)2026-05-11
WWBN AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing
CVE-2026-43882
Public exploit
Patch
CWE-93
Medium · CVSS 4.3
EPSS 0.2% (8th pct)2026-05-11

Showing 30 of 223

Common weakness types

The CWE weakness categories most often found in wwbn avideo CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many wwbn avideo CVEs were published each year.

2019

2

2020

2

2021

1

2022

24

2023

5

2024

16

2025

17

2026

156

Other wwbn products

Browse vulnerabilities for other products by wwbn.

wwbn/avideo153 CVEs avideo-encoder3 CVEs

All wwbn vulnerabilities

Frequently asked questions

Common questions about wwbn avideo vulnerabilities.

How many CVEs does wwbn avideo have?: wwbn avideo has 223 published CVE records since 2019.
How many wwbn avideo CVEs are in CISA KEV?: None of wwbn avideo's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for wwbn avideo vulnerabilities?: Yes — 183 of wwbn avideo's CVEs have a known public exploit.
Which versions of wwbn avideo are affected?: 161 distinct wwbn avideo versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in wwbn avideo CVEs?: wwbn avideo's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-918 (Server-Side Request Forgery (SSRF)), CWE-862 (Missing Authorization), CWE-352 (Cross-Site Request Forgery (CSRF)).
How many critical wwbn avideo vulnerabilities are there?: wwbn avideo has 34 critical and 87 high-severity CVEs.
What is the average severity of wwbn avideo CVEs?: The average CVSS base score across wwbn avideo's scored CVEs is 7.2.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track wwbn avideo vulnerabilities

Monitor new wwbn avideo vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing

2 CVEs

< c279999cbd2 CVEs

<= 11.62 CVEs

<= 15fed957fb2 CVEs

< 10.21 CVE

< 1416c517e21 CVE

< 21.01 CVE

< 22.01 CVE

< 25.01 CVE

< 275a54268b1 CVE

< 4a53ab21 CVE

< 77c70019b01 CVE

< 88bc40427b1 CVE

< a2bdbff1 CVE

< c2feaf25cb1 CVE

< d411f918051 CVE

< dbe3e91c541 CVE

<= 12.41 CVE

<= 3c6bb3ff1 CVE

<= an1 CVE

<= unauthenticated1 CVE

10.4 <= v <= 12.41 CVE

12.4 <= v <= 14.21 CVE

3c6bb3ff <= v <= 3c6bb3ff1 CVE

9210dc1378e29341b622c3fb55db6b4db3909ba7

2 CVEs

96b6c99150d1a5a174adeb244f4644a2fdd2d4bd2 CVEs

c279999cbd2 CVEs

> 14.21 CVE

> 26.01 CVE

033e83ae904cacb99495dbea7cbcfb3738cf42e41 CVE

078c4342eb9969a70425a9cdca3eefa7f8a86d531 CVE

0da3dcff1eda2f497694bf82b559829471c292c21 CVE

0dbadbcaaa1b415c7db078a72dc4b26d9fac04851 CVE

0e56382921fc71e64829cd1ec35f04e338c709171 CVE

10.21 CVE

1416c517e21 CVE

184f36b1896f3364f864f17c1acca3dd8df3af271 CVE

1c36f229d0a103528fb9f64d0a1cc0e1e8f5999b1 CVE

1df4af01f80d56ff2c4c43b89d0bac151e7fb6e31 CVE

1e6cf03e93b5a5318204b010ea28440b0d9a5ab31 CVE

21.01 CVE

218c98cbd4a4a2c15745852bcd0f29faf101bd8c1 CVE

22.01 CVE

25.01 CVE

275a54268b1 CVE

29.01 CVE

2b44dee815b208da85e1dcafa9839391c3de26551 CVE

3058e9e70bca5e610d220263ec02b4f66b42fb441 CVE

3298ced2bcf92e4f3acff6ce9bde14edf42ecb5b1 CVE

3722335f808484e6bfb5e71028fedddd942add4a1 CVE

3ae02fa240939dbefc5949d64f05790fd25d728d1 CVE

3c729717c26f160014a5c86b0b6accdbd613e7b21 CVE

3e0b3ce2bfa766183ff0ae227439394db57b1a231 CVE

473c609fc2defdea8b937b00e86ce88eba1f15bb1 CVE

4a53ab21 CVE

4e3709895857a5857f0edb46b0ee984de0d9e1a21 CVE

57f89ffbc27d37c9d9dd727212334846e78ac21a1 CVE

5e2b897ccac61eb6daca2dee4a6be3c4c2d93e131 CVE

603e7bf77a835584387327e35560262feb075db31 CVE

7292129eaee5f609beae103b5cb387d55f17b8771 CVE

764db592f99e545aa86bb9a4ad664ffd14c38ba51 CVE

77c70019b01 CVE

77e9aa6411ff4b97571eb82e587139ec05ff894c1 CVE

78bccae74634ead68aa6528d631c9ec4fd7aa5361 CVE

7aaad601bd9cd7b993ba0ee1b1bea6c32ee7b77c1 CVE

7f418de1a95ab87bb8c8c3eb3702d71c351e098d1 CVE

88bc40427b1 CVE

891843d547f7db5639925a67b7f2fd66721f703a1 CVE

8be71e53ccbe9b84b30870db386fb4d2b11e1c161 CVE

8d8fc0cadb425835b4861036d589abcea4d78ee81 CVE

8f53e9d9c6aaa07d51ace30691981edbbfb5ca1c1 CVE

941decd6d19e2e694acb75e86317d10fbb5602841 CVE

977cd6930a97571a26da4239e25c8096dd4ecbc11 CVE

9c38468041505e637101c5943c5370c68f48e3ac1 CVE

9f3006f9a89a34daa67a83c6ad35f450cb91fcce1 CVE

a0156a6398362086390d949190f9d52a823000ba1 CVE

a2bdbff1 CVE

aaacd48f29f1ff71d1eb5fc81d37605f593cefa91 CVE

b32b410c9191c3c5db888514c29d7921f124d8831 CVE

bcba324644df8b4ed1f891462455f1cd26822a451 CVE

bd11c16ec894698e54e2cdae25026c61ad1ed4411 CVE

bf1c76989e6a9054be4f0eb009d68f0f2464b4531 CVE

c08694bf6264eb4decceb78c711baee2609b4efd1 CVE

c1cfa2bea8a351a1d07f5758f82887403e3abf1f1 CVE

c2feaf25cb1 CVE

cae8f0dadbdd962c89b91d0095c76edb8aadcacf1 CVE

caf705f38eae0ccfac4c3af1587781355d24495e1 CVE

ce8da5d6b641f94da5762619339263915f40fdbd1 CVE

d411f918051 CVE

d5992fff2811df4adad1d9fc7d0a5837b882aed71 CVE

d9cdc702481a626b15f814f6093f1e2a9c20d3751 CVE

dbe3e91c541 CVE

e0212add4aad0f1e97758a4b4fdc57df58ce68e81 CVE

e6566f56a28f4556b2a0a09d03717a719dcb49da1 CVE

e8d6119f3cb1b849149906efeb0a41fc024f59f81 CVE

ecc5f40470bbafff231133f58db1df70f47bfb331 CVE

ee5615153c40628ab3ec6fe04962d1f92e67d3e21 CVE

f50fc033b7adb36f1ffd6640e7826468bdafdec31 CVE

f9492f5e6123dff0292d5bb3164fde7665dc36b41 CVE