CVE-2026-123029

HighCVSS 7.5/10Last modified Nov 10, 2026

Description

Wowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote attackers to read local files with the privileges of the Wowza Streaming Engine process.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Wowza	Streaming Engine	< 4.12.2

References

https://www.wowza.com/docs/xxe-allows-reading-local-files

Timeline

Published: Nov 5, 2026
Last modified: Nov 10, 2026
NVD status: Received

Related CVEs from 2026

CVE-2026-123034.3Information disclosure due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 a CVE-2026-1230327.3A security flaw has been discovered in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function CVE-2026-1230338.3Authentication bypass in the HA heartbeat origin check in middlewared in TrueNAS SCALE before 25.10.8 (and in release trains before their re CVE-2026-1230365.5A flaw was found in ansible-core. When a task marked `no_log: true` fails, the task result is censored before being emitted, but the `except CVE-2026-1230376.7A flaw was found in the ansible-core user module. When generate_ssh_key is enabled, User.ssh_key_gen() guards the key files against symlinks CVE-2026-1230397.8The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connect CVE-2026-123049.1Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird CVE-2026-1230407.8An attacker who gains the ability to execute arbitrary code on a system with TrueConf Server (Linux) versions from 4.7.2 up to, but not incl CVE-2026-1230418.2The request-callout plugin in Kong Gateway Enterprise and Kong AI Gateway omits callout headers not sent by the client from its cache key, a CVE-2026-1230447.5The ContentPen WordPress plugin before 1.1.1 discloses its REST API key to unauthenticated users, who can then use it to create posts contai CVE-2026-1230477.5In Eclipse BaSyx Helm Charts versions 3.0.0-rc.1 to 3.12.1 of the `basyx` chart, deployments with the bundled Keycloak enabled store the pas CVE-2026-123057.5Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbir