CVE-2026-17739

Google Chrome versions prior to 151.0.7922.72 are vulnerable to insufficient policy enforcement in Extensions. An attacker could trick a user into installing a malicious extension, enabling the injection of arbitrary scripts or HTML (UXSS) via a crafted Chrome Extension. This vulnerability affect...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path via the music/playlists/update API endpoint. An attacker can execute arbitrary code by bypassing file extension enforcement and writing malicious files to arbitrary locations on the filesystem, such...

CVE-2026-26975

Music Assistant is an open-source media library manager that integrates streaming services with connected speakers. Versions 2.6.3 and below allow unauthenticated network-adjacent attackers to execute arbitrary code on affected installations. The music/playlists/update API allows users to bypass...