{"vulnerability": "CVE-2026-45578", "sightings": [{"uuid": "fe2c4c92-a9a5-4feb-a3a7-d171a4f05546", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45578", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mmysj634ah27", "content": "\ud83d\udfe0 CVE-2026-45578 - High (8.8)\n\nWWBN AVideo is an open source video platform. In 29.0 and earlier, there is a classic shell-metac...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-45578/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-29T15:01:24.512097Z"}, {"uuid": "9855650c-94ef-44ad-9c0d-646dcf3c0622", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45578", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmyungunn52c", "content": "CVE-2026-45578 - WWBN AVideo Live: OS command injection in on_publish.php execAsync via unescaped m3u8 URL\nCVE ID : CVE-2026-45578\n \n Published : May 29, 2026, 2:16 p.m. | 55\u00a0minutes ago\n \n Description : WWBN AVideo is an open source video platform. In 29.0 and earlier, there ...", "creation_timestamp": "2026-05-29T15:39:35.006228Z"}, {"uuid": "af61edee-cc4e-4d22-aa14-532e8658bc07", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45578", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mr4fk6afcg2l", "content": "\ud83d\udd34 CVE-2026-64625 - Critical (9.8)\n\nAVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escap...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-64625/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-20T23:00:44.995558Z"}, {"uuid": "5eda6521-1896-4901-9189-932ccb5336ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45578", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mr4iuofsq62x", "content": "CVE-2026-64625 - AVideo before 29.0 OS Command Injection via execAsync\nCVE ID : CVE-2026-64625\n \n Published : July 20, 2026, 10:17 p.m. | 1\u00a0hour, 25\u00a0minutes ago\n \n Description : AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped...", "creation_timestamp": "2026-07-21T00:00:18.454499Z"}, {"uuid": "3cffe132-a277-40c3-a0c0-db3f7d80eeae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45578", "type": "seen", "source": "https://bsky.app/profile/euvd-bot.bsky.social/post/3mr4iv57n6w2g", "content": "\ud83d\udea8 EUVD-2026-46119\n\ud83d\udcca 9.3/10\n\ud83c\udfe2 WWBN\n\n\ud83d\udcdd AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped commands in double-quoted sh -c, allowing command substit...\n\n\ud83d\udd17 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-46119\n\n#cybersecurity #infosec #cve #euvd", "creation_timestamp": "2026-07-21T00:00:33.762092Z"}, {"uuid": "fdca0931-f037-4177-a1d0-8f9aaab416d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45578", "type": "seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mr4jgdrpjg2b", "content": "One Bad Quote Turns AVideo Into A Remote Shell Factory\nPANIC 88% | Lag 0.0h | AVideo before 29.0 contains an incomplete fix for CVE-2026-45578: execAsync() can re-wrap escaped co\n#AfterShockIndex\nREAD MORE", "creation_timestamp": "2026-07-21T00:10:11.111691Z"}]}