Wowza develops a narrowly focused media streaming platform whose vulnerability footprint, despite modest product scope, reaches among the more prominent vendors in the landscape due to the critical role streaming infrastructure plays in content delivery. Vulnerabilities affecting the vendor skew toward serious outcomes, with an elevated share reaching critical severity, and concentrate in the flagship Streaming Engine product across recurring weakness classes including cross-site scripting, path traversal, cross-site request forgery, improper permission assignment, and resource-exhaustion conditions. These flaws reflect the complexity of a web-facing media server that must handle untrusted input, manage file access, and enforce session and rate-limiting controls. Defenders operating streaming infrastructure should prioritize updates to this vendor's releases and audit administrative interfaces for exposure; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Wowza over time
Signals from CVEs in this vendor scope (26 CVEs).
26 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-19365CRITICAL The REST API in Wowza Streaming Engine 4.7.4.01 allows traversal of the directory structure and retrieval of a file via a remote, specifically crafted HTTP request. | Mar 21, 2019 | 9.1 | 49 | NO | YES |
CVE-2018-7047CRITICAL An issue was discovered in the MBeans Server in Wowza Streaming Engine before 4.7.1. The file system may be read and written to via JMX using the default JMX credentials (remote co | Mar 1, 2018 | 9.8 | 30 | NO | NO |
CVE-2020-9004HIGH A remote authenticated authorization-bypass vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any read-only user to issue requests to the administration panel in ord | Apr 14, 2020 | 8.8 | 29 | NO | NO |
CVE-2016-20034HIGH Wowza Streaming Engine 4.5.0 contains a privilege escalation vulnerability that allows authenticated read-only users to elevate privileges to administrator by manipulating POST par | Mar 16, 2026 | 8.0 | 26 | NO | NO |
CVE-2024-52053CRITICAL Stored Cross-Site Scripting in the Manager component of Wowza Streaming Engine below 4.9.1 allows an unauthenticated attacker to inject client-side JavaScript into the web dashboar | Nov 21, 2024 | 9.6 | 26 | NO | NO |
CVE-2021-35491HIGH A Cross-Site Request Forgery (CSRF) vulnerability in Wowza Streaming Engine through 4.8.11+5 allows a remote attacker to delete a user account via the /enginemanager/server/user/de | Oct 5, 2021 | 8.1 | 26 | NO | NO |
CVE-2019-19455HIGH Wowza Streaming Engine before 4.8.5 has Insecure Permissions which may allow a local attacker to escalate privileges in / usr / local / WowzaStreamingEngine / manager / bin / in th | Aug 3, 2020 | 7.8 | 26 | NO | NO |
CVE-2016-20033HIGH Wowza Streaming Engine 4.5.0 contains a local privilege escalation vulnerability that allows authenticated users to escalate privileges by replacing executable files due to imprope | Mar 16, 2026 | 7.8 | 25 | NO | NO |
CVE-2019-19454HIGH An arbitrary file download was found in the "Download Log" functionality of Wowza Streaming Engine <= 4.x.x. This issue was resolved in Wowza Streaming Engine 4.8.0. | May 18, 2020 | 7.5 | 25 | NO | NO |
CVE-2018-7048HIGH An issue was discovered in Wowza Streaming Engine before 4.7.1. There is a denial of service (memory consumption) via a crafted HTTP request. | Mar 1, 2018 | 7.5 | 25 | NO | NO |
Signals from CVEs in this vendor scope (26 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Wowza.
Media articles that mention a CVE ID that affects a product developed by Wowza — matched by CVE ID, not by vendor name.