WordPress AudioIgniter <= 2.0.2 - Unauthenticated IDOR

The AudioIgniter plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. The handleplaylistendpoint function accepted a user-controlled playlist ID and returned track data without authentication. id: CVE-2026-8679 info: name: WordPress...

CVE-2009-0182

VUPlayer 2.49 Local Buffer Overflow to Arbitrary Code Execution Program Version: VUPlayer 2.49 Vulnerability: local buffer overflow when importing .wax playlist file that will lead to arbitrary code execution Exploitation: Local Buffer Overflow CVE: CVE-2009-0182 VUPlayer2.49poc.py : without bypa...

CVE-2010-1872-BlazeDVD-SEH-Exploit

BlazeDVD 5.0 - '.PLF' Playlist SEH Buffer Overflow Exploit CVE-2010-1872 Proof-of-Concept PoC exploit targeting a buffer overflow vulnerability in BlazeDVD version 5.0 via a crafted .plf playlist file. The exploit uses SEH Structured Exception Handler overwrite to achieve code execution. Details...

CVE-2026-123095

mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdlhook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass urlissafe to open file:// or av:// inputs, reading loca...

Linux Distros Unpatched Vulnerability : CVE-2026-123095

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdlhook script that allows remote attackers to add unchecked entries by...

UBUNTU-CVE-2026-123095

mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdlhook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass urlissafe to open file:// or av:// inputs, reading loca...

CVE-2026-123095

mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdlhook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass urlissafe to open file:// or av:// inputs, reading loca...

DEBIAN-CVE-2026-123095

mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdlhook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass urlissafe to open file:// or av:// inputs, reading loca...

CVE-2026-123095

The mpv media player (versions 0.29.0 before 0.42.0 ) is vulnerable to a playlist injection flaw in the bundled ytdl_hook script. The root cause is the improper neutralization of CRLF sequences, allowing remote attackers to bypass the url_is_safe() check by embedding newlines in playlist URLs. Th...

EUVD-2026-117540

mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdlhook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass urlissafe to open file:// or av:// inputs, reading loca...

CVE-2026-123095 mpv 0.29.0 before 0.42.0 Playlist Entry Injection via ytdl_hook Newlines

mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdlhook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass urlissafe to open file:// or av:// inputs, reading loca...

CVE-2026-123095 mpv 0.29.0 before 0.42.0 Playlist Entry Injection via ytdl_hook Newlines

mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdlhook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass urlissafe to open file:// or av:// inputs, reading loca...

CVE-2026-121432

AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedding CR/LF sequences in mount or remote relay displayname values. Attackers with Station:MountPoints or Station:RemoteRelays permission can inject FileN= and...

EUVD-2026-115854

AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedding CR/LF sequences in mount or remote relay displayname values. Attackers with Station:MountPoints or Station:RemoteRelays permission can inject FileN= and...

CVE-2026-119596

UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to download other members' private playlists. Attackers can enumerate sequential playlist ids at the /playlist-zips/playlist endpoint to obtain zips of all torrents,...

CVE-2026-119596 UNIT3D through 9.2.0 Private Playlist Disclosure via Playlist Zip Download

UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to download other members' private playlists. Attackers can enumerate sequential playlist ids at the /playlist-zips/playlist endpoint to obtain zips of all torrents,...

CVE-2026-119596

The UNIT3D software (versions through 9.2.0 ) is vulnerable to a missing authorization flaw in the PlaylistZipController::show function. This vulnerability allows authenticated users to access and download private playlists belonging to other members. By enumerating sequential playlist IDs at the...

CVE-2026-119596 UNIT3D through 9.2.0 Private Playlist Disclosure via Playlist Zip Download

UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to download other members' private playlists. Attackers can enumerate sequential playlist ids at the /playlist-zips/playlist endpoint to obtain zips of all torrents,...

CVE-2026-119596: HDInnovations UNIT3D: UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows…

UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to download other members' private playlists. Attackers can enumerate sequential playlist ids at the /playlist-zips/playlist endpoint to obtain zips of all torrents,...

PT-2026-133548

UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to download other members' private playlists. Attackers can enumerate sequential playlist ids at the /playlist-zips/playlist endpoint to obtain zips of all torrents,...