{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"29.0"}],"component":"wwbn/avideo","cve_ids":["CVE-2026-40928"],"ecosystem":"Packagist","epss":0.00115,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-x2pw-9c38-cp2j","id":"tcs_01M5KFAHVWH0P2W1GJ8Q7T1WRB","modified_at":"2026-05-05T16:26:34.614521Z","published_at":"2026-04-14T23:12:53Z","references":["https://osv.dev/vulnerability/GHSA-x2pw-9c38-cp2j","https://github.com/WWBN/AVideo/security/advisories/GHSA-x2pw-9c38-cp2j","https://nvd.nist.gov/vuln/detail/CVE-2026-40928","https://github.com/WWBN/AVideo/commit/7aaad601bd9cd7b993ba0ee1b1bea6c32ee7b77c","https://github.com/WWBN/AVideo"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-x2pw-9c38-cp2j","url":"https://osv.dev/vulnerability/GHSA-x2pw-9c38-cp2j"}],"summary":"WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion"}