https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T17:02:31.925348+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-85163 CVE-2026-85163 — AVideo Server-Side Request Forgery via epg_link parameter 2026-10-09T17:02:31.926633+00:00

Affected: WWBN AVideo

AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the EPG parser that allows authenticated uploaders to fetch arbitrary internal URLs. An attacker can supply an internal URL via the epg_link parameter during video upload, which is validated only for syntax and later fetched server-side during EPG generation without SSRF protection checks.