https://vulnfeed.org/Every disclosure, as it lands. Critical-only feed available.enhttps://vulnfeed.org/cve/CVE-2026-121429/https://vulnfeed.org/cve/CVE-2026-121429/Tue, 03 Nov 2026 14:28:23 +0000AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission to execute OS commands via StereoTool settings. Attackers can inject shell metacharacters into stereo_tool_configuration_path or stereo_tool_license_key, which are executed via /bin/sh on station restart, compromising the container.https://vulnfeed.org/cve/CVE-2026-121427/https://vulnfeed.org/cve/CVE-2026-121427/Tue, 03 Nov 2026 14:28:22 +0000AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shoutcast sc_serv.conf file. An authenticated user with only the Manage station profile permission can override adminpassword, password, and portbase, or inject arbitrary directives via newlines in keys, hijacking the station's Shoutcast frontend.https://vulnfeed.org/cve/CVE-2026-121428/https://vulnfeed.org/cve/CVE-2026-121428/Tue, 03 Nov 2026 14:28:22 +0000AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor configuration through the station timezone field. Attackers can submit a timezone containing newlines to the profile edit API, defining a new Supervisor program that executes OS commands as root when configuration regenerates.