30657 matches found
CVE-2026-14860
The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated attackers to make the server issue requests to arbitrary hosts and read back responses that parse as RSS/XML...
EUVD-2026-55019
The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated attackers to make the server issue requests to arbitrary hosts and read back responses that parse as RSS/XML...
CVE-2026-14860 Podcast Player < 8.3.1 - Unauthenticated Server-Side Request Forgery
The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated attackers to make the server issue requests to arbitrary hosts and read back responses that parse as RSS/XML...
CVE-2026-14860
The Podcast Player WordPress plugin (versions before 8.3.1 ) is vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) . The flaw exists because the plugin fails to validate the destination of a server-side request constructed from user-supplied input. This allows an unauthenticated ...
CVE-2026-14860: Server-Side Request Forgery (SSRF)
The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated attackers to make the server issue requests to arbitrary hosts and read back responses that parse as RSS/XML...
Malicious code in tidal-embed-player (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 005d40bc86aa5e012bfb9a0cd23cf5de5c4d93b1f65880b2273b8708891fa7e5 package.json declares a preinstall hook that runs index.js on npm install. index.js collects host identifiers os.hostname, os.userInfo.username,...
MAL-2026-11152 Malicious code in tidal-embed-player (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 005d40bc86aa5e012bfb9a0cd23cf5de5c4d93b1f65880b2273b8708891fa7e5 package.json declares a preinstall hook that runs index.js on npm install. index.js collects host identifiers os.hostname, os.userInfo.username,...
OESA-2026-3168 fluidsynth security update
FluidSynth is a free software synthesizer. Its currently based on the SoundFont 2 specifications and supports real time MIDI effect controls. It can be used as a shared library for embedding in other applications, can play MIDI files and has a command line shell. Many other applications use...
PT-2026-67247
Name of the Vulnerable Software and Affected Versions FluidSynth affected versions not specified Description A heap-based buffer overflow exists in the MIDI player. When the synthesizer is configured with the synth.midi-channels variable set to a value greater than 16, an out-of-bounds memory...
CVE-2026-65506
Unauthenticated Broken Access Control in MP3 Audio Player for Music, Radio & Podcast by Sonaar = 5.12 versions...
CVE-2026-27422
Missing Authorization vulnerability in bPlugins YT Player yt-player allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YT Player: from n/a through 2.1.2...
CVE-2026-65506 WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.12 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in MP3 Audio Player for Music, Radio & Podcast by Sonaar = 5.12 versions...
CVE-2026-65506
CVE-2026-65506 affects the WordPress plugin MP3 Audio Player for Music, Radio & Podcast by Sonaar, versions
CVE-2026-65506
Unauthenticated Broken Access Control in MP3 Audio Player for Music, Radio & Podcast by Sonaar = 5.12 versions...
CVE-2026-65506 WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.12 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in MP3 Audio Player for Music, Radio & Podcast by Sonaar = 5.12 versions...
CVE-2026-27422
The CVE-2026-27422 entry concerns the WordPress YT Player plugin (versions
CVE-2026-27422 WordPress YT Player plugin <= 2.1.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in bPlugins YT Player yt-player allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YT Player: from n/a through 2.1.2...
EUVD-2026-48160
Unauthenticated Broken Access Control in YT Player = 2.0.9 versions...
CVE-2026-27422 WordPress YT Player plugin <= 2.1.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in bPlugins YT Player yt-player allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YT Player: from n/a through 2.1.2...