# MacWarrior Clipbucket vulnerabilities Source: https://junglewise.ai/threats/technologies/clipbucket Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 11 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/clipbucket.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 17 vulnerabilities in MacWarrior Clipbucket: 0 in the last 7 days and 10 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-110626, was published on 14 October 2026. 2 vulnerabilities in the last four weeks, down 75% on the four before (8). ## Counts - Last 7 days: 0 - Last 30 days: 2 - Last 90 days: 10 - All time: 17 (3 critical, 0 exploited in the wild) ## About MacWarrior Clipbucket ClipBucket is a video content management system. ## Latest MacWarrior Clipbucket vulnerabilities - [CVE-2026-110626: ClipBucket reflected XSS in language settings](https://junglewise.ai/threats/cve-2026-110626-clipbucket-v5-through-5-5-3-206-contains-a-reflected-cross-site) (medium, CVSS 6.1, published 14 Oct 2026) - [CVE-2026-110625: ClipBucket v5 reflected XSS in admin flagged_item.php](https://junglewise.ai/threats/cve-2026-110625-clipbucket-v5-through-5-5-3-206-contains-a-reflected-cross-site) (medium, CVSS 6.1, published 14 Oct 2026) - [CVE-2026-103766: ClipBucket SQL injection in ads manager](https://junglewise.ai/threats/cve-2026-103766-clipbucket-v5-through-5-5-3-197-contains-an-sql-injection) (high, CVSS 7.2, published 2 Oct 2026) - [CVE-2026-102570: ClipBucket time-based blind SQL injection in language update](https://junglewise.ai/threats/cve-2026-102570-clipbucket-v5-through-5-5-3-197-contains-a-time-based-blind-sql) (medium, CVSS 5.5, published 29 Sep 2026) - [CVE-2026-102569: ClipBucket time-based SQL injection in admin video edit](https://junglewise.ai/threats/cve-2026-102569-clipbucket-v5-through-5-5-3-197-contains-a-time-based-blind-sql) (medium, CVSS 5.5, published 29 Sep 2026) - [CVE-2026-100372: ClipBucket path traversal in admin template editor](https://junglewise.ai/threats/cve-2026-100372-clipbucket-v5-before-5-5-3-197-contains-a-path-traversal) (high, CVSS 7.2, published 25 Sep 2026) - [CVE-2026-96272: ClipBucket SQL injection in photo search](https://junglewise.ai/threats/cve-2026-96272-clipbucket-v5-before-5-5-3-182-contains-a-blind-sql-injection) (high, CVSS 7.5, published 23 Sep 2026) - [CVE-2026-95812: ClipBucket reflected cross-site scripting in sort_link helper](https://junglewise.ai/threats/cve-2026-95812-clipbucket-v5-before-5-5-3-182-contains-a-reflected-cross-site) (medium, CVSS 6.1, published 22 Sep 2026) - [CVE-2026-77929: ClipBucket file upload remote code execution](https://junglewise.ai/threats/cve-2026-77929-clipbucket-file-upload-remote-code-execution) (high, CVSS 8.8, published 18 Sep 2026) - [CVE-2026-77928: ClipBucket SQL injection in private message deletion](https://junglewise.ai/threats/cve-2026-77928-clipbucket-sql-injection-in-private-message-deletion) (medium, CVSS 6.5, published 18 Sep 2026) - [CVE-2026-49482: MacWarrior ClipBucket SQL wildcard injection in subtitle editing endpoint](https://junglewise.ai/threats/cve-2026-49482-macwarrior-clipbucket-sql-wildcard-injection-in-subtitle-editing) (medium, CVSS 4.3, published 12 Jun 2026) - [CVE-2026-47238: MacWarrior ClipBucket IDOR in video subtitle editor](https://junglewise.ai/threats/cve-2026-47238-macwarrior-clipbucket-idor-in-video-subtitle-editor) (medium, CVSS 6.5, published 11 Jun 2026) - [CVE-2026-45418: MacWarrior ClipBucket SQL injection in subtitle_edit.php](https://junglewise.ai/threats/cve-2026-45418-macwarrior-clipbucket-sql-injection-in-subtitle-edit-php) (high, CVSS 8.8, published 11 Jun 2026) - [CVE-2026-45060: MacWarrior ClipBucket blind SQL injection in progress_video.php](https://junglewise.ai/threats/cve-2026-45060-macwarrior-clipbucket-blind-sql-injection-in-progress-video-php) (critical, CVSS 9.8, published 11 Jun 2026) - [CVE-2026-42846: MacWarrior ClipBucket OS command injection in Remote Play](https://junglewise.ai/threats/cve-2026-42846-macwarrior-clipbucket-os-command-injection-in-remote-play) (critical, CVSS 9.8, published 11 Jun 2026) - [CVE-2026-42847: MacWarrior ClipBucket SQL injection in action_logs.php](https://junglewise.ai/threats/cve-2026-42847-macwarrior-clipbucket-sql-injection-in-action-logs-php) (info, CVSS 7.1, published 14 May 2026) - [CVE-2025-67418: Oxygenz ClipBucket hardcoded default credentials in admin panel](https://junglewise.ai/threats/cve-2025-67418-oxygenz-clipbucket-hardcoded-default-credentials-in-admin-panel) (critical, CVSS 9.8, published 22 Dec 2025) ## Most severe MacWarrior Clipbucket vulnerabilities - [CVE-2025-67418: Oxygenz ClipBucket hardcoded default credentials in admin panel](https://junglewise.ai/threats/cve-2025-67418-oxygenz-clipbucket-hardcoded-default-credentials-in-admin-panel) (critical, CVSS 9.8, published 22 Dec 2025) - [CVE-2026-45060: MacWarrior ClipBucket blind SQL injection in progress_video.php](https://junglewise.ai/threats/cve-2026-45060-macwarrior-clipbucket-blind-sql-injection-in-progress-video-php) (critical, CVSS 9.8, published 11 Jun 2026) - [CVE-2026-42846: MacWarrior ClipBucket OS command injection in Remote Play](https://junglewise.ai/threats/cve-2026-42846-macwarrior-clipbucket-os-command-injection-in-remote-play) (critical, CVSS 9.8, published 11 Jun 2026) - [CVE-2026-77929: ClipBucket file upload remote code execution](https://junglewise.ai/threats/cve-2026-77929-clipbucket-file-upload-remote-code-execution) (high, CVSS 8.8, published 18 Sep 2026) - [CVE-2026-45418: MacWarrior ClipBucket SQL injection in subtitle_edit.php](https://junglewise.ai/threats/cve-2026-45418-macwarrior-clipbucket-sql-injection-in-subtitle-edit-php) (high, CVSS 8.8, published 11 Jun 2026) - [CVE-2026-96272: ClipBucket SQL injection in photo search](https://junglewise.ai/threats/cve-2026-96272-clipbucket-v5-before-5-5-3-182-contains-a-blind-sql-injection) (high, CVSS 7.5, published 23 Sep 2026) - [CVE-2026-103766: ClipBucket SQL injection in ads manager](https://junglewise.ai/threats/cve-2026-103766-clipbucket-v5-through-5-5-3-197-contains-an-sql-injection) (high, CVSS 7.2, published 2 Oct 2026) - [CVE-2026-100372: ClipBucket path traversal in admin template editor](https://junglewise.ai/threats/cve-2026-100372-clipbucket-v5-before-5-5-3-197-contains-a-path-traversal) (high, CVSS 7.2, published 25 Sep 2026) - [CVE-2026-77928: ClipBucket SQL injection in private message deletion](https://junglewise.ai/threats/cve-2026-77928-clipbucket-sql-injection-in-private-message-deletion) (medium, CVSS 6.5, published 18 Sep 2026) - [CVE-2026-47238: MacWarrior ClipBucket IDOR in video subtitle editor](https://junglewise.ai/threats/cve-2026-47238-macwarrior-clipbucket-idor-in-video-subtitle-editor) (medium, CVSS 6.5, published 11 Jun 2026) ## Vulnerabilities per week 2 vulnerabilities in the last four weeks, down 75% on the four before (8). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 2 | 0 | 0 | | 21 Sep 2026 | 3 | 0 | 0 | | 28 Sep 2026 | 3 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 2 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "MacWarrior Clipbucket vulnerabilities", https://junglewise.ai/threats/technologies/clipbucket, 11 November 2026.