CVE-2026-75928: Brushfire Online Experience

Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days.

The Brushfire platform's video content streaming application (https://online.brushfire.com) exposes database path in requests to users, allowing a remote, unauthenticated attacker to read information about other users. Fixed February 2026.

Affected products

• Brushfire Online Experience: before 2026-02-26 (fixed in 2026-02-26)

Published 2026-08-21. Last modified 2026-08-26.