{"schema_version":1,"title":"AzuraCast vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 14 vulnerabilities in AzuraCast: 11 in the last 7 days and 12 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-100857, was published on 27 September 2026.","url":"https://junglewise.ai/threats/technologies/azuracast","json_url":"https://junglewise.ai/threats/technologies/azuracast.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/azuracast","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":11,"all_time":14,"critical":0,"exploited":0,"last_7_days":11,"last_30_days":11,"last_90_days":12,"last_365_days":14},"latest":[{"cve":"CVE-2026-100857","cvss":8,"slug":"cve-2026-100857-azuracast-before-0-23-4-contains-a-code-injection-vulnerability","title":"AzuraCast code injection in ConfigWriter via Liquidsoap string interpolation","severity":"high","exploited":false,"published_at":"2026-09-27T02:17:25.197+00:00","url":"https://junglewise.ai/threats/cve-2026-100857-azuracast-before-0-23-4-contains-a-code-injection-vulnerability"},{"cve":"CVE-2026-100856","cvss":8.8,"slug":"cve-2026-100856-azuracast-before-0-23-6-contains-a-code-injection-vulnerability","title":"AzuraCast code injection in remote relay password field","severity":"high","exploited":false,"published_at":"2026-09-27T02:17:25.05+00:00","url":"https://junglewise.ai/threats/cve-2026-100856-azuracast-before-0-23-6-contains-a-code-injection-vulnerability"},{"cve":"CVE-2026-100855","cvss":6.5,"slug":"cve-2026-100855-azuracast-before-0-23-6-contains-a-missing-permission-check","title":"AzuraCast media file download permission bypass","severity":"medium","exploited":false,"published_at":"2026-09-27T02:17:24.893+00:00","url":"https://junglewise.ai/threats/cve-2026-100855-azuracast-before-0-23-6-contains-a-missing-permission-check"},{"cve":"CVE-2026-100854","cvss":6.3,"slug":"cve-2026-100854-azuracast-before-0-23-6-lacks-requireinternalconnection","title":"AzuraCast Liquidsoap API authorization bypass","severity":"medium","exploited":false,"published_at":"2026-09-27T02:17:24.747+00:00","url":"https://junglewise.ai/threats/cve-2026-100854-azuracast-before-0-23-6-lacks-requireinternalconnection"},{"cve":"CVE-2026-100853","cvss":5.9,"slug":"cve-2026-100853-in-azuracast-before-0-23-8-the-public-on-demand-download","title":"AzuraCast On-Demand download endpoint authorization bypass","severity":"medium","exploited":false,"published_at":"2026-09-27T02:17:24.59+00:00","url":"https://junglewise.ai/threats/cve-2026-100853-in-azuracast-before-0-23-8-the-public-on-demand-download"},{"cve":"CVE-2026-100852","cvss":8.8,"slug":"cve-2026-100852-azuracast-through-0-23-x-contains-a-command-injection","title":"AzuraCast command injection in Liquidsoap config generation","severity":"high","exploited":false,"published_at":"2026-09-27T02:17:24.437+00:00","url":"https://junglewise.ai/threats/cve-2026-100852-azuracast-through-0-23-x-contains-a-command-injection"},{"cve":"CVE-2026-100851","cvss":7.6,"slug":"cve-2026-100851-azuracast-before-0-23-8-contains-a-broken-access-control","title":"AzuraCast broken access control in profile endpoint","severity":"high","exploited":false,"published_at":"2026-09-27T02:17:24.233+00:00","url":"https://junglewise.ai/threats/cve-2026-100851-azuracast-before-0-23-8-contains-a-broken-access-control"},{"cve":"CVE-2026-100850","cvss":7.7,"slug":"cve-2026-100850-azuracast-before-0-23-8-contains-a-server-side-request-forgery","title":"AzuraCast AutoDJ server-side request forgery and local file read","severity":"high","exploited":false,"published_at":"2026-09-27T02:17:24.007+00:00","url":"https://junglewise.ai/threats/cve-2026-100850-azuracast-before-0-23-8-contains-a-server-side-request-forgery"},{"cve":"CVE-2026-100849","cvss":7.1,"slug":"cve-2026-100849-azuracast-is-a-self-hosted-web-radio-management-suite-in","title":"AzuraCast station webhook SSRF filter bypass","severity":"high","exploited":false,"published_at":"2026-09-27T02:17:23.757+00:00","url":"https://junglewise.ai/threats/cve-2026-100849-azuracast-is-a-self-hosted-web-radio-management-suite-in"},{"cve":"CVE-2026-100848","cvss":7.1,"slug":"cve-2026-100848-azuracast-composer-package-azuracast-azuracast-before-0-23-8","title":"AzuraCast Remote Relay server-side request forgery","severity":"high","exploited":false,"published_at":"2026-09-27T02:17:23.583+00:00","url":"https://junglewise.ai/threats/cve-2026-100848-azuracast-composer-package-azuracast-azuracast-before-0-23-8"},{"cve":"CVE-2026-100847","cvss":7.5,"slug":"cve-2026-100847-azuracast-before-0-23-8-contains-a-dql-injection-vulnerability","title":"AzuraCast DQL injection in sortOrder API parameter","severity":"high","exploited":false,"published_at":"2026-09-27T02:17:23.437+00:00","url":"https://junglewise.ai/threats/cve-2026-100847-azuracast-before-0-23-8-contains-a-dql-injection-vulnerability"},{"cve":"CVE-2026-76836","cvss":8.8,"epss":0.0057,"slug":"cve-2026-76836-azuracast-privilege-escalation-via-liquidsoap-custom","title":"AzuraCast privilege escalation via Liquidsoap custom configuration","severity":"high","exploited":false,"published_at":"2026-08-24T18:17:21.733+00:00","url":"https://junglewise.ai/threats/cve-2026-76836-azuracast-privilege-escalation-via-liquidsoap-custom"},{"cve":"CVE-2026-42606","cvss":8.1,"epss":0.0057,"slug":"cve-2026-42606-azuracast-password-reset-poisoning-in-applyxforwarded-middleware","title":"AzuraCast password reset poisoning in ApplyXForwarded middleware","severity":"high","exploited":false,"published_at":"2026-05-09T20:16:30.17+00:00","url":"https://junglewise.ai/threats/cve-2026-42606-azuracast-password-reset-poisoning-in-applyxforwarded-middleware"},{"cve":"CVE-2026-42605","cvss":8.8,"epss":0.0103,"slug":"cve-2026-42605-azuracast-path-traversal-and-rce-in-flow-js-media-upload","title":"AzuraCast path traversal and RCE in Flow.js media upload","severity":"high","exploited":false,"published_at":"2026-05-09T20:16:30.02+00:00","url":"https://junglewise.ai/threats/cve-2026-42605-azuracast-path-traversal-and-rce-in-flow-js-media-upload"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":11}],"related":[],"technology":{"hub":true,"name":"AzuraCast","slug":"azuracast","vendor":{"name":"AzuraCast","slug":"azuracast","url":"https://junglewise.ai/threats/vendors/azuracast"},"aliases":[],"category":"web-application","homepage":"https://www.azuracast.com/","repo_url":"https://github.com/AzuraCast/AzuraCast","description":"AzuraCast is a self-hosted, all-in-one web radio management suite.","url":"https://junglewise.ai/threats/technologies/azuracast"},"most_severe":[{"cve":"CVE-2026-42605","cvss":8.8,"epss":0.0103,"slug":"cve-2026-42605-azuracast-path-traversal-and-rce-in-flow-js-media-upload","title":"AzuraCast path traversal and RCE in Flow.js media upload","severity":"high","exploited":false,"published_at":"2026-05-09T20:16:30.02+00:00","url":"https://junglewise.ai/threats/cve-2026-42605-azuracast-path-traversal-and-rce-in-flow-js-media-upload"},{"cve":"CVE-2026-76836","cvss":8.8,"epss":0.0057,"slug":"cve-2026-76836-azuracast-privilege-escalation-via-liquidsoap-custom","title":"AzuraCast privilege escalation via Liquidsoap custom configuration","severity":"high","exploited":false,"published_at":"2026-08-24T18:17:21.733+00:00","url":"https://junglewise.ai/threats/cve-2026-76836-azuracast-privilege-escalation-via-liquidsoap-custom"},{"cve":"CVE-2026-100856","cvss":8.8,"slug":"cve-2026-100856-azuracast-before-0-23-6-contains-a-code-injection-vulnerability","title":"AzuraCast code injection in remote relay password field","severity":"high","exploited":false,"published_at":"2026-09-27T02:17:25.05+00:00","url":"https://junglewise.ai/threats/cve-2026-100856-azuracast-before-0-23-6-contains-a-code-injection-vulnerability"},{"cve":"CVE-2026-100852","cvss":8.8,"slug":"cve-2026-100852-azuracast-through-0-23-x-contains-a-command-injection","title":"AzuraCast command injection in Liquidsoap config generation","severity":"high","exploited":false,"published_at":"2026-09-27T02:17:24.437+00:00","url":"https://junglewise.ai/threats/cve-2026-100852-azuracast-through-0-23-x-contains-a-command-injection"},{"cve":"CVE-2026-42606","cvss":8.1,"epss":0.0057,"slug":"cve-2026-42606-azuracast-password-reset-poisoning-in-applyxforwarded-middleware","title":"AzuraCast password reset poisoning in ApplyXForwarded middleware","severity":"high","exploited":false,"published_at":"2026-05-09T20:16:30.17+00:00","url":"https://junglewise.ai/threats/cve-2026-42606-azuracast-password-reset-poisoning-in-applyxforwarded-middleware"},{"cve":"CVE-2026-100857","cvss":8,"slug":"cve-2026-100857-azuracast-before-0-23-4-contains-a-code-injection-vulnerability","title":"AzuraCast code injection in ConfigWriter via Liquidsoap string interpolation","severity":"high","exploited":false,"published_at":"2026-09-27T02:17:25.197+00:00","url":"https://junglewise.ai/threats/cve-2026-100857-azuracast-before-0-23-4-contains-a-code-injection-vulnerability"},{"cve":"CVE-2026-100850","cvss":7.7,"slug":"cve-2026-100850-azuracast-before-0-23-8-contains-a-server-side-request-forgery","title":"AzuraCast AutoDJ server-side request forgery and local file read","severity":"high","exploited":false,"published_at":"2026-09-27T02:17:24.007+00:00","url":"https://junglewise.ai/threats/cve-2026-100850-azuracast-before-0-23-8-contains-a-server-side-request-forgery"},{"cve":"CVE-2026-100851","cvss":7.6,"slug":"cve-2026-100851-azuracast-before-0-23-8-contains-a-broken-access-control","title":"AzuraCast broken access control in profile endpoint","severity":"high","exploited":false,"published_at":"2026-09-27T02:17:24.233+00:00","url":"https://junglewise.ai/threats/cve-2026-100851-azuracast-before-0-23-8-contains-a-broken-access-control"},{"cve":"CVE-2026-100847","cvss":7.5,"slug":"cve-2026-100847-azuracast-before-0-23-8-contains-a-dql-injection-vulnerability","title":"AzuraCast DQL injection in sortOrder API parameter","severity":"high","exploited":false,"published_at":"2026-09-27T02:17:23.437+00:00","url":"https://junglewise.ai/threats/cve-2026-100847-azuracast-before-0-23-8-contains-a-dql-injection-vulnerability"},{"cve":"CVE-2026-100849","cvss":7.1,"slug":"cve-2026-100849-azuracast-is-a-self-hosted-web-radio-management-suite-in","title":"AzuraCast station webhook SSRF filter bypass","severity":"high","exploited":false,"published_at":"2026-09-27T02:17:23.757+00:00","url":"https://junglewise.ai/threats/cve-2026-100849-azuracast-is-a-self-hosted-web-radio-management-suite-in"}],"generated_at":"2026-09-27T03:07:00.185062+00:00"}