CVE Watch3 nov 2026

CVE-2026-121427

AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users lacking the Manage statio

CVSS

7.5

Alto

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 3 nov 2026 · Última mod.: 3 nov 2026 · CWE-15

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shoutcast sc_serv.conf file. An authenticated user with only the Manage station profile permission can override adminpassword, password, and portbase, or inject arbitrary directives via newlines in keys, hijacking the station's Shoutcast frontend.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2025-68403—

1.1%

——0An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system. We have already fixed the vulnerability in the following version: QuRouter 2.7.2.113 and later15d CVE-2026-110845—

27.0%

——8n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerability in the Git node Log operation, which fails to strip a repository's local git configuration before invoking an external program. Authenticated members who can point the node, including as an agent tool, at a repository whose local configuration they control can execute programs as the n8n process user.8d CVE-2026-962185.5 MED

46.1%

——14Improper access control in Windows Update Stack allows an authorized attacker to perform tampering locally.18d CVE-2026-961887.3 ALT

31.6%

——9External control of system or configuration setting in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.21d CVE-2026-730277.8 ALT

44.2%

——13External control of system or configuration setting in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.6d CVE-2026-1078188.4 ALT

34.4%

——10MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.20d