https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T14:10:14.507124+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-73090 CVE-2026-73090 — PeerTube: Cross-origin remote video takeover via Update activity 2026-10-09T14:10:14.509577+00:00

Affected: Chocobozzz PeerTube

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the host in videoObject.id, allowing a malicious federated server to rewrite another server's video metadata, visibility, media file, and HLS URLs. This issue is fixed in version 8.2.2.