This release includes 1 security fix for security teams reviewing exposed deployments.
Published 4mo
Media Servers
✓ No known CVEs patched
This release patches 1 known CVE
Topics
ffmpeg
lightweight
local-storage
nvr
opensource
privacy
+1 more
video-surveillance
Affected surfaces
auth
rbac
Summary
AI summaryAdded bulk camera deletion, duplicate detection, and full‑screen import overlay.
Full changelog
Full Changelog: https://github.com/spupuz/VibeNVR/compare/v1.14.0...v1.14.1
🚀 Release Notes v1.14.1
✨ New Features
Bulk Camera Management
- Mass Deletion: You can now select multiple cameras for bulk deletion.
- Bulk Actions Bar: Automatically appears when selecting 2 or more cameras.
Intelligent Duplicate Detection
- Added advanced logic to extract Host/IP from RTSP URLs.
- The system now skips duplicate cameras during JSON or MotionEye imports, even when stream paths differ.
Enhanced UI Feedback
- Introduced a full‑screen processing overlay with dynamic icons and messages
(e.g., “Importing Data…”, “Deleting Cameras…”) for long-running operations.
Precise Selection System
- Camera selection is now restricted to a dedicated checkbox, preventing accidental selections when clicking Edit/Delete.
🐛 Bug Fixes & Improvements
Modal Persistence Fix
- Resolved an issue where RTSP fields (Username, Password, Host) would clear after clicking Apply in the edit modal.
User Registration Patch
- Fixed a potential 500 Server Error when creating a user with a duplicate email.
The system now correctly returns 400 Bad Request.
Security Hardening
- The Bulk Actions bar and sensitive RTSP details are now hidden from Read‑Only users.
- Added server-side admin verification for all new bulk and import endpoints.
- Log Masking: Passwords in RTSP transition URLs are now masked with asterisks in backend logs.
🛠️ Technical Internal Changes
- Integrated
urllib.parsefor more robust Host/IP extraction. - Added new API endpoint:
POST/api/cameras/bulk-deletewith cascade cleanup of media files. - Improved MotionEye backup parsing to better handle split credentials (
netcam_userpass).
Security Fixes
- Hides Bulk Actions bar and RTSP details from Read‑Only users; adds server‑side admin verification for bulk/import endpoints; masks RTSP passwords in backend logs
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About spupuz/VibeNVR
All releases →Related context
Related tools
Earlier breaking changes
- v1.28.3 Must update docker-compose.yml with TZ variable for all services
Beta — feedback welcome: [email protected]