Streaming Engine
Vendor:
First CVE: Mar 1, 2018 · Active for 8 years
26
Total CVEs
More Total CVEs than 95% of tracked products
4.3
Avg CVEs / Year
Higher CVE frequency than 86% of tracked products
6.8
Avg CVSS
Higher Avg CVSS than 39% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Streaming Engine over time
Volume of CVEsAvg CVSS Base Score
First CVE
Mar 1, 2018
8 years ago
Most Recent CVE
Mar 16, 2026
130 days ago
CVE Severity & Scoring
Streaming Engine26 CVEs
46%
38%
12%
All CVEs352,231 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local5 (19.2%)
Network21 (80.8%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low26 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None16 (61.5%)
Unknown0 (0.0%)
Required10 (38.5%)
Privileges Required
Low10 (38.5%)
High4 (15.4%)
None12 (46.2%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (26 CVEs).
26 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-19365CRITICAL The REST API in Wowza Streaming Engine 4.7.4.01 allows traversal of the directory structure and retrieval of a file via a remote, specifically crafted HTTP request. | Mar 21, 2019 | 9.1 | 49 | NO | YES |
CVE-2018-7047CRITICAL An issue was discovered in the MBeans Server in Wowza Streaming Engine before 4.7.1. The file system may be read and written to via JMX using the default JMX credentials (remote co | Mar 1, 2018 | 9.8 | 30 | NO | NO |
CVE-2020-9004HIGH A remote authenticated authorization-bypass vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any read-only user to issue requests to the administration panel in ord | Apr 14, 2020 | 8.8 | 29 | NO | NO |
CVE-2016-20034HIGH Wowza Streaming Engine 4.5.0 contains a privilege escalation vulnerability that allows authenticated read-only users to elevate privileges to administrator by manipulating POST par | Mar 16, 2026 | 8.0 | 26 | NO | NO |
CVE-2024-52053CRITICAL Stored Cross-Site Scripting in the Manager component of Wowza Streaming Engine below 4.9.1 allows an unauthenticated attacker to inject client-side JavaScript into the web dashboar | Nov 21, 2024 | 9.6 | 26 | NO | NO |
CVE-2021-35491HIGH A Cross-Site Request Forgery (CSRF) vulnerability in Wowza Streaming Engine through 4.8.11+5 allows a remote attacker to delete a user account via the /enginemanager/server/user/de | Oct 5, 2021 | 8.1 | 26 | NO | NO |
CVE-2019-19455HIGH Wowza Streaming Engine before 4.8.5 has Insecure Permissions which may allow a local attacker to escalate privileges in / usr / local / WowzaStreamingEngine / manager / bin / in th | Aug 3, 2020 | 7.8 | 26 | NO | NO |
CVE-2016-20033HIGH Wowza Streaming Engine 4.5.0 contains a local privilege escalation vulnerability that allows authenticated users to escalate privileges by replacing executable files due to imprope | Mar 16, 2026 | 7.8 | 25 | NO | NO |
CVE-2019-19454HIGH An arbitrary file download was found in the "Download Log" functionality of Wowza Streaming Engine <= 4.x.x. This issue was resolved in Wowza Streaming Engine 4.8.0. | May 18, 2020 | 7.5 | 25 | NO | NO |
CVE-2018-7048HIGH An issue was discovered in Wowza Streaming Engine before 4.7.1. There is a denial of service (memory consumption) via a crafted HTTP request. | Mar 1, 2018 | 7.5 | 25 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (26 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
1 CVE
3.8% of CVEs· 97th percentile
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (26 CVEs).
Media Mentions
Signals from CVEs in this product scope (26 CVEs).
Top CNAs Publishing CVEs For Streaming Engine
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 4.7.4.0.1 | 1 | 9.1 | 22.3% | 0 | 1 |
| 4.5.0 | 4 | 6.5 | 0.2% | 0 | 0 |