533 matches found
GHSA-69QJ-PVH9-C5WG yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp
Summary yt-dlp's --exec option is vulnerable to arbitrary command injection when handling untrusted metadata if the argument uses standard string formatting e.g. %titles or other unsafe conversions. An attacker could achieve remote code execution on the user's machine via maliciously crafted...
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Overview yt-dlp is an A youtube-dl fork with additional features and patches Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via insufficient sanitization of input passed to the aria2c external...
GHSA-VX4Q-3CR2-7CG2 yt-dlp: Arbitrary code execution via manifest downloads with aria2c
Summary If aria2c is used as an external downloader for a fragmented manifest format such as an HLS/DASH stream, yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file write. On Windows platforms, this can lead to immediate arbitrary code...
GHSA-C6MH-FPJC-4PR3 yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)
Summary A vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files such as .desktop, .url, .webloc to the user's filesystem, bypassing the remediation for CVE-2024-38519. Details The fix for CVE-2024-38519 enforced an allowlist for file extensions, in orde...
yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)
Summary A vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files such as .desktop, .url, .webloc to the user's filesystem, bypassing the remediation for CVE-2024-38519. Details The fix for CVE-2024-38519 enforced an allowlist for file extensions, in orde...
GHSA-F7J3-774F-RFHJ yt-dlp: File Downloader cookie leak with curl
Summary If curl is used an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest's. This is the equivalent to GHSA-v8mc-9377-rwjj for the curl downloader. The vulnerable behavior is...
yt-dlp: File Downloader cookie leak with curl
Summary If curl is used an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest's. This is the equivalent to GHSA-v8mc-9377-rwjj for the curl downloader. The vulnerable behavior is...
OPENSUSE-SU-2026:11019-1 python313-yt-dlp-2026.06.09-1.1 on GA media
These are all security issues fixed in the python313-yt-dlp-2026.06.09-1.1 package on the GA media of openSUSE Tumbleweed...
CVE-2026-2810
Netskope was notified about a potential gap in the Endpoint DLP Module for Netskope Client on Windows systems. The successful exploitation of the gap can potentially allow an unprivileged user to trigger an out-of-bounds read within a driver, leading to a Blue-Screen-of-Death BSOD. Successful...
CVE-2026-0247
Multiple authorization bypass vulnerabilities in the Endpoint DLP component of Prisma Access AgentĀ® allow a local attacker to bypass authentication controls and execute privileged operations...
CVE-2026-41952
Local privilege escalation due to improper input validation. The following products are affected: Acronis DeviceLock DLP Windows before build 9.0.93212, Acronis Cyber Protect Cloud Agent Windows before build 42183...
CVE-2026-41220
Local privilege escalation due to improper input validation. The following products are affected: Acronis DeviceLock DLP Windows before build 9.0.93212, Acronis Cyber Protect Cloud Agent Windows before build 42183...
CVE-2026-44609
Local privilege escalation due to EXE hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP Windows before build 9.0.15051.93227...
CVE-2026-44682
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP Windows before build 9.0.15051.93227...
CVE-2026-44682
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP Windows before build 9.0.15051.93227...
CVE-2026-44682
CVE-2026-44682 affects Acronis DeviceLock DLP (Windows) prior to build 9.0.15051.93227. It is a local privilege escalation via DLL hijacking, with a low-privilege attacker needing local access and user interaction to exploit. The CVSSv3.0 metrics indicate AV:L, AC:L, PR:L, UI:R, S:U, C:H/I:H/A:H ...
CVE-2026-42061
Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis DeviceLock DLP Windows before build 9.0.15051.93227...
EUVD-2026-34172
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP Windows before build 9.0.15051.93227...
CVE-2026-50033
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP Windows before build 9.0.15051.93227...
CVE-2026-50033
CVE-2026-50033 affects Acronis DeviceLock DLP for Windows prior to build 9.0.15051.93227, enabling local privilege escalation via DLL hijacking. CVSS v3.0 base score 7.3 (High); attack vector LOCAL, privileges required LOW, user interaction REQUIRED. No exploitation details are provided in the co...