CVE-2026-18994

In AVideo before 8.1.0, the live-streaming endpoint `view/videosListToLive.php` trusts attacker-supplied data in `webSiteRootURL` as session state, allowing an unauthenticated attacker to self-grant `isLogged` and `canStream`. Video-list paths are interpolated without escaping into `ffprobe` and `ffmpeg` commands executed via `exec`, enabling OS command injection. This is fixed in version 8.1.0.

In AVideo before 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.php` assembles `videos/configuration.php` by interpolating request parameters, including `webSiteRootURL`, into single-quoted PHP literals without escaping. An attacker can terminate a literal and inject PHP executed as the web-server user. Exploitation requires `videos/configuration.php` to be absent, and database parameters can point to an attacker-controlled server. This is fixed in version 8.1.0.

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the `/skServer/ziplogs` endpoint. Attackers can extract the JWT `secretKey` from `security.json` in the ZIP, forge administrator tokens, and create persistent admin accounts. This is fixed in version 2.33.0.

Prior to version 0.1.4, FearlessCMS contains five debug/test PHP scripts under admin/ that perform privileged operations without authentication, CSRF protection, or adequate path validation. On PHP's built-in server (including the default Docker deployment), the /./admin/ path bypasses the login gate, enabling arbitrary .md writes, directory enumeration, stored/reflected XSS, and disk exhaustion.

In ai-gateway-payload-processing, an authenticated remote attacker can specify another tenant's model identifier in the request body or header. The service does not verify authorization before retrieving credentials from the shared store, so it injects the target tenant's API keys into the request.

In the Echo Go web framework from 4.0.0 until 4.16.1 and in 5.4.1, the Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the connection are sent directly to that upstream, bypassing Echo's router and route-specific middleware. This can bypass authentication or authorization enforced only by Echo routes.

A missing authentication for a critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root. The vulnerability can only be exploited prior to the device being onboarded to Mist/Conductor; it can no longer be exploited once the device is onboarded.

An improper neutralization of special elements used in an OS command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID.

The `excerpt-include` macro in XWiki Remote Macros does not properly escape the included page's title and executes `excerpt` content with the macro's rights. Both the title handling and the rendering of `excerpt` content into XWiki syntax allow syntax injection. Any user able to edit a page, even without script rights, can supply executable macro syntax and cause remote code execution when the page is included.

A deserialization of untrusted data vulnerability in the Ultimate Member WordPress plugin allows Object Injection. Affects versions up to and including 2.13.1.