CVE-2026-120441

OwnTone Server versions through 29.3 are vulnerable to an SQL injection in the mpd_sticker_find() function located in src/mpd.c. Unauthenticated remote attackers can exploit this by sending a crafted 'sticker find song' command to the MPD listener on TCP port 6600 . By injecting SQL via the URI a...

EUVD-2026-102686

The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating a gallery on demand, allowing unauthenticated users to enumerate and disclose the titles, descriptions and direct file URLs of media attached to unpublished, private or trashed...

CVE-2026-19717

The CatFolders Document Gallery & PDF Library WordPress plugin, in versions prior to 2.0.7 , is vulnerable to an unauthenticated attachment disclosure flaw. The root cause is a lack of authorisation checks in certain REST API endpoints , which allows unauthorized users to retrieve metadata—includ...