5131 matches found
GHSA-7J2F-6H2R-6CQC Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs
Summary Koel validates the podcast feed URL via the SafeUrl rule DNS resolution + public IP check, but the individual episode values extracted from the RSS XML are stored directly into the database without any SSRF validation. When a user plays an episode, the server downloads the full HTTP...
CVE-2026-45707
creationtimestamp| type| source ---|---|--- 2026-05-29 15:00:28+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmyshiifaa2m 2026-05-29 16:23:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmyx4hyvj52m...
PT-2026-45047
Name of the Vulnerable Software and Affected Versions Koel versions prior to 9.3.5 Description Koel fails to validate individual episode enclosure URLs extracted from RSS XML feeds, despite validating the main podcast feed URL. These unvalidated URLs are stored in the database and subsequently...
CVE-2026-49130
MPD (Music Player Daemon) prior to version 0.24.11 is affected by a CRLF injection vulnerability in the XSPF playlist plugin’s xspf_char_data function. By supplying a malicious XSPF playlist that exploits XML numeric character references, an attacker can cause Expat decoding to insert literal CR/...
BIT-JOOMLA-2026-25900 Joomla! Core - [20260501] - XSS in feed modules
Lack of output escaping leads to a XSS vector in the feed modules...
JLSEC-2026-562 In GnuPG through 2.4.8, if a signed message has `\f` at the end of a plaintext line, an adversary...
In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds although an "invalid armor" message is printed...
CVE-2026-24520
Missing Authorization vulnerability in bPlugins Tiktok Feed allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Tiktok Feed: from n/a through 1.0.24...
CVE-2026-24520
Missing Authorization vulnerability in bPlugins Tiktok Feed allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Tiktok Feed: from n/a through 1.0.24...
CVE-2026-24520 WordPress Tiktok Feed plugin <= 1.0.24 - Broken Access Control vulnerability
Missing Authorization vulnerability in bPlugins Tiktok Feed allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Tiktok Feed: from n/a through 1.0.24...
CVE-2026-24520
CVE-2026-24520 concerns the WordPress Tiktok Feed plugin with a Missing Authorization vulnerability leading to Broken Access Control. Affected: Tiktok Feed versions up to and including 1.0.24. Root cause: incorrectly configured access control, enabling exploitation of access levels. CVSS 3.1 base...
CVE-2026-24520 WordPress Tiktok Feed plugin <= 1.0.24 - Broken Access Control vulnerability
Missing Authorization vulnerability in bPlugins Tiktok Feed allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Tiktok Feed: from n/a through 1.0.24...
EUVD-2026-31966
Missing Authorization vulnerability in bPlugins Tiktok Feed allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Tiktok Feed: from n/a through 1.0.24...
WordPress Tiktok Feed plugin <= 1.0.24 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Tiktok Feed versions = 1.0.24...
CVE-2026-25900
Lack of output escaping leads to a XSS vector in the feed modules...
CVE-2026-25900
Lack of output escaping leads to a XSS vector in the feed modules...
CVE-2026-25900
Lack of output escaping leads to a XSS vector in the feed modules...
CVE-2026-25900 Joomla! Core - [20260501] - XSS in feed modules
Lack of output escaping leads to a XSS vector in the feed modules...
EUVD-2026-31876
Lack of output escaping leads to a XSS vector in the feed modules...
CVE-2026-25900
CVE-2026-25900 affects Joomla! Core – Feed Modules. The issue stems from a lack of output escaping in the feed modules, enabling a cross-site scripting (XSS) vector. Documented impact is an XSS entry in feed-related functionality; explicit exploit steps, affected versions, and remediation are not...