coturn project records

14 published records for vendor coturn project.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 1
With a fix record: 100%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

14 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
41Plan	CVE-2020-6061No exploit	An exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests.coturn project · coturn · CWE-125 Pre-auth Memory safety	Critical9.8	—	5.1%	Feb 19, 2020
40Plan	CVE-2018-4056No exploit	An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4.5.0.9.coturn project · coturn · CWE-89 Pre-auth Auth bypass SQL injection	Critical9.8	—	2.9%	Feb 5, 2019
40Plan	CVE-2018-4059No exploit	An exploitable unsafe default configuration vulnerability exists in the TURN server function of coTURN prior to version 4.5.0.9.coturn project · coturn · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.8	—	1.8%	Mar 21, 2019
39Monitor	CVE-2026-43994No exploit	Coturn: Stack buffer overflow in decode_oauth_token_gcm()coturn project · coturn · CWE-120 pre-auth RCE Memory safety	Critical9.8	—	0.6%	Jun 18, 2026
32Monitor	CVE-2020-6062No exploit	An exploitable denial-of-service vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests.coturn project · coturn · CWE-476 Pre-auth Memory safety Denial of service	High7.5	—	6.1%	Feb 19, 2020
31Monitor	CVE-2020-4067No exploit	Improper Initialization in coturncoturn project · coturn · CWE-665 Pre-auth	High7.5	—	1.8%	Jun 29, 2020
30Monitor	CVE-2026-40613No exploit	Coturn: Misaligned Memory Access in coturn STUN Attribute Parser (Remote DoS on ARM64)coturn project · coturn · CWE-704 Pre-auth Denial of service	High7.5	—	1.1%	Apr 21, 2026
30Monitor	CVE-2018-4058No exploit	An exploitable unsafe default configuration vulnerability exists in the TURN server functionality of coTURN prior to 4.5.0.9.coturn project · coturn	High7.7	—	0.9%	Mar 21, 2019
29Monitor	CVE-2026-53450No exploit	Coturn: IPv4-mapped 127.0.0.1 bypasses default loopback peer protectioncoturn project · coturn · CWE-918 SSRF	High7.4	—	0.2%	Jul 10, 2026
28Monitor	CVE-2020-26262No exploit	Loopback bypass in Coturncoturn project · coturn · CWE-441 Pre-auth	High7.2	—	1.5%	Jan 13, 2021
28Monitor	CVE-2026-53448No exploit	Coturn: SQL Injection in HTTPS Admin Panel Delete Operationscoturn project · coturn · CWE-89 SQL injection	High7.2	—	0.7%	Jul 10, 2026
26Monitor	CVE-2026-27624No exploit	Coturn: IPv4-mapped IPv6 (::ffff:0:0/96) bypasses denied-peer-ip ACLcoturn project · coturn · CWE-284 Pre-auth Broken access control (IDOR)	Medium6.5	—	0.3%	Feb 25, 2026
24Monitor	CVE-2026-53449No exploit	Coturn: Arbitrary File Write via CLI psd Commandcoturn project · coturn · CWE-73 Path traversal	Medium6.0	—	0.2%	Jul 10, 2026
21Monitor	CVE-2026-43915No exploit	Coturn: Stored Cross-Site Scripting (XSS) in web-admin interface via TURN usernamecoturn project · coturn · CWE-79 XSS	Medium5.4	—	0.2%	Jun 18, 2026

CVE-2020-6061
41Plan
An exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests.
CriticalCVSS 9.8No exploitEPSS 5%
- Pre-auth
- Memory safety
coturn project · coturnFeb 19, 2020
CVE-2018-4056
40Plan
An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4.5.0.9.
CriticalCVSS 9.8No exploitEPSS 2%
coturn project · coturnFeb 5, 2019
CVE-2018-4059
40Plan
An exploitable unsafe default configuration vulnerability exists in the TURN server function of coTURN prior to version 4.5.0.9.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Broken access control (IDOR)
coturn project · coturnMar 21, 2019
CVE-2026-43994
39Monitor
Coturn: Stack buffer overflow in decode_oauth_token_gcm()
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
coturn project · coturnJun 18, 2026
CVE-2020-6062
32Monitor
An exploitable denial-of-service vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests.
HighCVSS 7.5No exploitEPSS 6%
coturn project · coturnFeb 19, 2020
CVE-2020-4067
31Monitor
Improper Initialization in coturn
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
coturn project · coturnJun 29, 2020
CVE-2026-40613
30Monitor
Coturn: Misaligned Memory Access in coturn STUN Attribute Parser (Remote DoS on ARM64)
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Denial of service
coturn project · coturnApr 21, 2026
CVE-2018-4058
30Monitor
An exploitable unsafe default configuration vulnerability exists in the TURN server functionality of coTURN prior to 4.5.0.9.
HighCVSS 7.7No exploitEPSS 0%
coturn project · coturnMar 21, 2019
CVE-2026-53450
29Monitor
Coturn: IPv4-mapped 127.0.0.1 bypasses default loopback peer protection
HighCVSS 7.4No exploitEPSS 0%
- SSRF
coturn project · coturnJul 10, 2026
CVE-2020-26262
28Monitor
Loopback bypass in Coturn
HighCVSS 7.2No exploitEPSS 1%
- Pre-auth
coturn project · coturnJan 13, 2021
CVE-2026-53448
28Monitor
Coturn: SQL Injection in HTTPS Admin Panel Delete Operations
HighCVSS 7.2No exploitEPSS 0%
- SQL injection
coturn project · coturnJul 10, 2026
CVE-2026-27624
26Monitor
Coturn: IPv4-mapped IPv6 (::ffff:0:0/96) bypasses denied-peer-ip ACL
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
coturn project · coturnFeb 25, 2026
CVE-2026-53449
24Monitor
Coturn: Arbitrary File Write via CLI psd Command
MediumCVSS 6.0No exploitEPSS 0%
- Path traversal
coturn project · coturnJul 10, 2026
CVE-2026-43915
21Monitor
Coturn: Stored Cross-Site Scripting (XSS) in web-admin interface via TURN username
MediumCVSS 5.4No exploitEPSS 0%
- XSS
coturn project · coturnJun 18, 2026