Most recent entries from all https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 22:46:46 +0000 CVE-2026-92586 — AVideo through 29.0 Missing Authorization via comment API endpoint https://db.gcve.eu/vuln/cve-2026-92586 <p><strong>Affected:</strong> WWBN AVideo</p> <p>AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to verify video access permissions in the set_api_comment function, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can submit POST requests to the comment API endpoint with arbitrary video IDs to write comments on videos they cannot watch.</p> <p><strong>Affected:</strong> WWBN AVideo</p> <p>AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to verify video access permissions in the set_api_comment function, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can submit POST requests to the comment API endpoint with arbitrary video IDs to write comments on videos they cannot watch.</p> https://db.gcve.eu/vuln/cve-2026-92586