CVE-2026-17739

Google Chrome Extensions could bypass policy enforcement, enabling UXSS via a crafted extension. Affected: the Extensions component in Chrome before 151.0.7922.72. Root cause: insufficient policy enforcement in Extensions. Impact: an attacker convincing a user to install a malicious extension cou...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path via the music/playlists/update API endpoint. An attacker can execute arbitrary code by bypassing file extension enforcement and writing malicious files to arbitrary locations on the filesystem, such...

CVE-2026-26975

Music Assistant is an open-source media library manager that integrates streaming services with connected speakers. Versions 2.6.3 and below allow unauthenticated network-adjacent attackers to execute arbitrary code on affected installations. The music/playlists/update API allows users to bypass...