CVE-2026-75928

The Brushfire platform's video content streaming application (https://online.brushfire.com) exposes database path in requests to users, allowing a remote, unauthenticated attacker to read information about other users. Fixed February 2026.

Scoring

Severity

MEDIUM

CVSS base score

6.9

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS probability

0.39%

CWE

CWE-497

Published

2026-08-21

Last modified

2026-08-21

Affected products

• Brushfire Online Experience
• Brushfire Online Experience

Weakness type

• CWE-497

Related vulnerabilities

• CVE-2026-61911 — An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An...
• CVE-2026-81394 — Microsoft Excel Information Disclosure Vulnerability
• CVE-2026-81387 — Microsoft Excel Information Disclosure Vulnerability
• CVE-2026-69315 — Windows License Manager Information Disclosure Vulnerability
• CVE-2026-68842 — Windows MIDI Service Module Information Disclosure Vulnerability
• CVE-2026-71330 — Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability
• CVE-2026-69832 — Win32k Information Disclosure Vulnerability
• CVE-2026-69723 — Windows Kernel Information Disclosure Vulnerability

Markdown version · Browse all CVEs