CVE-2026-39367

Summary

WWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG Page

Severity

medium

EPSS

0.2% (p9)

Also known as

GHSA-rqp3-gf5h-mrqx

Published

2026-04-08

References

• https://github.com/WWBN/AVideo/security/advisories/GHSA-rqp3-gf5h-mrqx
• https://nvd.nist.gov/vuln/detail/CVE-2026-39367
• https://github.com/WWBN/AVideo/commit/e0212add4aad0f1e97758a4b4fdc57df58ce68e8

Related advisories

• CVE-2026-40911 — critical · Packagist/wwbn/avideo
• CVE-2026-33867 — critical · Packagist/wwbn/avideo
• CVE-2026-33716 — critical · Packagist/wwbn/avideo
• CVE-2026-33502 — critical · Packagist/wwbn/avideo
• CVE-2026-33478 — critical · Packagist/wwbn/avideo
• CVE-2026-33352 — critical · Packagist/wwbn/avideo
• CVE-2026-33351 — critical · Packagist/wwbn/avideo
• CVE-2026-29058 — critical · Packagist/wwbn/avideo

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity