Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

frigate — Vulnerabilities & Security Advisories 14

All 14 CVE vulnerabilities found in frigate, with AI-generated Chinese analysis, references, and POCs.

Vendor: blakeblackshear

CVE ID Title CVSS Severity Published
CVE-2026-75608 Frigate: Viewer-Role User Can Access go2rtc Internal API to obtain sensitive information CWE-863 7.7 High 2026-09-22
CVE-2026-75607 Frigate: WebSocket Missing Authorization — Viewer Can Execute Admin-Only Operations CWE-862 8.1 High 2026-09-22
CVE-2026-54652 Frigate viewer can read logs exposing admin and camera credentials CWE-269 8.1 High 2026-07-08
CVE-2026-33470 Frigate has cross-camera snapshot disclosure via unrestricted timeline IDs and missing authorization in /api/events/{event_id}/snapshot-clean.webp CWE-862 6.5 Medium 2026-03-26
CVE-2026-33469 Authenticated Frigate users can read the full unredacted configuration via `/api/config/raw CWE-863 6.5 Medium 2026-03-26
CVE-2026-33126 Frigate has SSRF vulnerability in /ffprobe endpoint CWE-918 5.0 Medium 2026-03-20
CVE-2026-33125 Frigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts CWE-285 7.1 High 2026-03-20
CVE-2026-33124 Frigate has insecure password change functionality CWE-287 6.5 - 2026-03-20
CVE-2026-25643 Frigate Affected by Authenticated Remote Command Execution (RCE) and Container Escape CWE-78 9.1 Critical 2026-02-06
CVE-2025-62382 Frigate Vulnerable to Arbitrary File Read via Export Thumbnail "image_path" parameter CWE-73 7.7 High 2025-10-15
CVE-2024-32874 In Frigate, Malicious Long Unicode filenames may cause a Multiple Application-level Denial of Service CWE-770 6.8 Medium 2024-05-09
CVE-2023-45672 Frigate unsafe deserialization in `load_config_with_no_duplicates` of `frigate/util/builtin.py` CWE-502 7.5 High 2023-10-30
CVE-2023-45671 Frigate reflected XSS through `/<camera_name>` API endpoints CWE-79 4.7 Medium 2023-10-30
CVE-2023-45670 Frigate cross-site request forgery in `config_save` and `config_set` request handlers CWE-352 7.5 High 2023-10-30

All 14 known CVE vulnerabilities affecting frigate with full Chinese analysis, references, and POCs where available.