Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview yt-dlp is an A youtube-dl fork with additional features and patches Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via improper validation of input in the --write-link, --write-url-link,...

CVE-2026-55596

creationtimestamp| type| source ---|---|--- 2026-07-08 22:35:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq66jmihnl27 2026-08-25 17:32:46+00:00| seen| https://gist.github.com/alon710/fe6f5c87f44e8737a1f8abea57fa2cd5 2026-08-25 18:35:09+00:00| published-proof-of-concept|...

CVE-2026-58208

creationtimestamp| type| source ---|---|--- 2026-07-08 22:19:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq65o5u3x42x 2026-07-11 10:25:23+00:00| seen| https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqeh56pdjb27 2026-07-11 10:25:25+00:00| seen|...

CVE-2026-8801

creationtimestamp| type| source ---|---|--- 2026-07-08 22:13:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq65cl2ju42g 2026-07-09 19:26:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqaeg6yw7v2h 2026-07-10 19:56:03+00:00| seen|...

GHSA-VMWX-M75V-QVCH

creationtimestamp| type| source ---|---|--- 2026-07-08 22:12:23+00:00| seen| https://gist.github.com/alon710/f5073530cad3dd719e641dcee2ba88b8...

CVE-2026-59935

creationtimestamp| type| source ---|---|--- 2026-07-08 22:07:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq64xsux7c24 2026-07-10 07:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqbllqmplz25...

CVE-2017-17990

creationtimestamp| type| source ---|---|--- 2026-07-08 22:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq64x7paqs2k...

CVE-2026-60105

creationtimestamp| type| source ---|---|--- 2026-07-08 22:01:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mq64ms7gqd2w 2026-07-09 09:14:21+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mq7cadytwy26 2026-07-11 00:30:32+00:00| seen|...

CVE-2026-59879

creationtimestamp| type| source ---|---|--- 2026-07-08 21:43:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq63ma3dqe2i 2026-07-11 08:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqe7fxgexo2n...

GHSA-37H2-6P4F-MP3Q

creationtimestamp| type| source ---|---|--- 2026-07-08 21:42:03+00:00| seen| https://gist.github.com/alon710/faf458b17f73f7d92e775ebdde2a6b10...

CVE-2026-59936

creationtimestamp| type| source ---|---|--- 2026-07-08 21:36:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq637k3iih2w 2026-07-10 07:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqbnbfawqa2n 2026-07-10 07:43:10+00:00| seen|...

Malicious code in tslint-conf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31b464b1646f8e2d36ce68a86af599cc49d5381f08af70302ff01f42957234a1 The package presents itself as the pino logger README, index.d.ts, docs/, and lib/ files all reference pinojs/pino but is published under the unrelat...

CVE-2026-55596 Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript

Plate is a rich-text editor with AI and shadcn/ui. From 53.0.0 until 53.1.4, the media embed renderer trusts serialized provider or sourceUrl metadata in useMediaState and skips parseMediaUrl protocol validation, allowing a crafted Plate document to set a known video provider while keeping url as...

CVE-2026-58494 Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination

Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite...

CVE-2026-58494 Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination

Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite...

UBUNTU-CVE-2026-55404

yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpageurl or filename metadata without sufficient validation or escaping,...

CVE-2026-59929

creationtimestamp| type| source ---|---|--- 2026-07-08 20:05:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5w64e2ij2q 2026-07-20 22:35:21+00:00| published-proof-of-concept| https://github.com/lepture/mistune/security/advisories/GHSA-qfrw-5rxm-mhh2...

CVE-2026-59890

creationtimestamp| type| source ---|---|--- 2026-07-08 19:55:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5vm6vmlj2i 2026-07-21 20:35:09+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-h35f-9h28-mq5c 2026-07-22 12:00:52+00:00| seen|...

CVE-2026-59882

creationtimestamp| type| source ---|---|--- 2026-07-08 19:40:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5urdn5uw2z...

CVE-2026-55404 yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpageurl or filename metadata without sufficient validation or escaping,...