CVE 検索
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
| 27/09/2026 |
| CVE-2026-100854 | 中6.3 | AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value. Users with View station permission can inject arbitrary now-playing metadata, disrupt live broadcasts, and disclose filesystem paths | 27/09/2026 |
| CVE-2026-42606 | 高8.8 | AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the ApplyXForwarded middleware unconditionally trusts the client-supplied X-Forwarded-Host HTTP header with no trusted proxy allowlist. An unauthenticated attacker can poison the password reset URL sent to any user by injecting | 09/05/2026 |
| CVE-2026-42605 | 高8.8 | AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the currentDirectory request parameter in the Flow.js media upload endpoint (POST /api/station/{station_id}/files/upload) is not sanitized for path traversal sequences. When combined with a local filesystem storage backend (the | 09/05/2026 |
| CVE-2025-67737 | 低3.7 | AzuraCast is a self-hosted, all-in-one web radio management suite. Versions 0.23.1 mistakenly include an API endpoint that is intended for internal use by the SFTP software sftpgo, exposing it to the public-facing HTTP API for AzuraCast installations. A user with specific internal knowledge of a station's operations ca | 12/12/2025 |
| CVE-2023-2531 | 緊急9.8 | Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3. | 05/05/2023 |
| CVE-2023-2191 | 中4.8 | Cross-site Scripting (XSS) - Stored in GitHub repository azuracast/azuracast prior to 0.18. | 20/04/2023 |