CVE-2026-101051

Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in downloader metadata to write files to unexpected locations withi...

EUVD-2026-87980

Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in downloader metadata to write files to unexpected locations withi...

CVE-2026-101051: Improper Limitation of a Pathname to a Restricted Directory

Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in downloader metadata to write files to unexpected locations withi...

CVE-2026-55404

yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpageurl or filename metadata without sufficient validation or escaping,...

yt-dlp File Downloader cookie leak

ImpactDuring file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host.This vulnerable behavior is present in all versions of youtube-dl...

PYSEC-2026-2067 yt-dlp File Downloader cookie leak

Impact During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host. This vulnerable behavior is present in all versions of...

Top Video Downloaders in 2026: Why Wondershare UniConverter Remains a Strong Choice

As video content continues to dominate entertainment, education, and social media platforms, more users are searching for reliable…...

EUVD-2023-2146

Malicious code in bioql PyPI...

Malware in nayan-videos-downloaders

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-4493 Malicious code in nayan-videos-downloaders (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 32bc04005274ad27bb9498203c905d728f872255a98f5f19d99ca7d73b354554 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SideWinder APT Strikes Middle East and Africa With Stealthy Multi-Stage Attack

An advanced persistent threat APT actor with suspected ties to India has sprung forth with a flurry of attacks against high-profile entities and strategic infrastructures in the Middle East and Africa. The activity has been attributed to a group tracked as SideWinder, which is also known as...

Malicious code in rs-downloaders (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9808 Malicious code in rs-downloaders (npm)

--- -= Per source details. Do not edit below this line.=-...

GLSA-202407-28 : Freenet: Deanonymization Vulnerability

The remote host is affected by the vulnerability described in GLSA-202407-28 Freenet: Deanonymization Vulnerability This release fixes a severe vulnerability in path folding that allowed to distinguish between downloaders and forwarders with an adapted node that is directly connected via opennet...

DEBIAN-CVE-2024-38519

yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to the fixed versions, yt-dlp and youtube-dl do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder and path traversal on Windows. Since yt-dlp and youtube-...

CVE-2024-38519 yt-dlp and youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization

yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to the fixed versions, yt-dlp and youtube-dl do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder and path traversal on Windows. Since yt-dlp and youtube-...

PT-2024-28047

Name of the Vulnerable Software and Affected Versions yt-dlp versions prior to 2024.07.01 youtube-dl versions prior to 2024-07-03 Description The issue concerns command-line audio/video downloaders yt-dlp and youtube-dl. Prior to the fixed versions, these tools do not limit the extensions of...

[SECURITY] Fedora 40 Update: crosswords-0.3.13-1.fc40

A simple and fun game of crosswords. Load your crossword files, or play one of the included games. Features include: - Support for shaped and colored crosswords - Loading .ipuz and .puz files - Hint support, such as showing mistakes and suggesting words - Dark mode support - Locally installed...

Watch Out for 'Latrodectus' - This Malware Could Be In Your Inbox

Threat hunters have discovered a new malware called Latrodectus that has been distributed as part of email phishing campaigns since at least late November 2023. "Latrodectus is an up-and-coming downloader with various sandbox evasion functionality," researchers from Proofpoint and Team Cymru said...

Iranian State-Sponsored OilRig Group Deploys 3 New Malware Downloaders

The Iranian state-sponsored threat actor known as OilRig deployed three different downloader malware throughout 2022 to maintain persistent access to victim organizations located in Israel. The three new downloaders have been named ODAgent, OilCheck, and OilBooster by Slovak cybersecurity company...