Critical vulnerabilities
2 critical vulnerabilities in AVideo and Directus
2 vulnerabilities rated critical (CVSS 9.0 or higher) found on 11 November 2026: Authentication bypass in servers and applications, Broken access control in servers and applications.
- 2 critical
Authentication bypass in AVideo · Servers and applications
CVE-2026-126542
WWBN AVideo 6.5 through 29.7.1 Authentication Bypass via Hybridauth Social Login
- Severity
- Critical 9.3
- Published
- 11 Nov 2026
| Software | Affected versions |
|---|---|
| AVideoServers and applications |
|
- CVE.org https://www.cve.org/CVERecord?id=CVE-2026-126542
Broken access control in Directus · Servers and applications
CVE-2026-126539
Directus before 12.1.0 Authorization Bypass via Public WebSocket REST Interface
- Severity
- Critical 9.2
- Published
- 11 Nov 2026
- Fixed in
- 12.1.0
| Software | Affected versions |
|---|---|
| DirectusServers and applications |
|
- CVE.org https://www.cve.org/CVERecord?id=CVE-2026-126539
From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.