CVE-2026-40928
1 advisory.
Packagist/wwbn/avideo CVE-2026-40928: medium 5.4, EPSS 0.15%
WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 29.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-x2pw-9c38-cp2j
- https://github.com/WWBN/AVideo/security/advisories/GHSA-x2pw-9c38-cp2j
- https://nvd.nist.gov/vuln/detail/CVE-2026-40928
- https://github.com/WWBN/AVideo/commit/7aaad601bd9cd7b993ba0ee1b1bea6c32ee7b77c
- https://github.com/WWBN/AVideo
CVE-2026-40928 · published · modified · JSON