69 matches found
CVE-2026-77385
Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem path to the transcoder. The path handling in transcoder/src/api/path.go cleaned the value and checked only that it bega...
EUVD-2026-83204
Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem path to the transcoder. The path handling in transcoder/src/api/path.go cleaned the value and checked only that it bega...
CVE-2026-77385 Kyoo: Transcoder serves uncataloged files from the media directory
Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem path to the transcoder. The path handling in transcoder/src/api/path.go cleaned the value and checked only that it bega...
CVE-2026-77385
Kyoo , a self-hosted media server for movies, series, and anime, is affected by a missing catalog-level authorization in its transcoder component prior to version 5.1.0 . Specifically, transcoder/src/api/path.go validated only that a base64-encoded filesystem path began with Settings.SafePath, wh...
CVE-2026-77385 Kyoo: Transcoder serves uncataloged files from the media directory
Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem path to the transcoder. The path handling in transcoder/src/api/path.go cleaned the value and checked only that it bega...
CVE-2026-77385 Kyoo: Transcoder serves uncataloged files from the media directory
Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem path to the transcoder. The path handling in transcoder/src/api/path.go cleaned the value and checked only that it bega...
PT-2026-95549
Name of the Vulnerable Software and Affected Versions Kyoo versions prior to 5.1.0 Description A registered user with the core.play permission can provide a base64-encoded filesystem path to the transcoder. The path handling in transcoder/src/api/path.go cleans the value and verifies it starts wi...
CVE-2026-77385: Authorization Bypass Through User-Controlled Key
Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem path to the transcoder. The path handling in transcoder/src/api/path.go cleaned the value and checked only that it bega...
Plex_Vuln_PoCs
Plex Media Server Patch-Diff Vulnerability PoCs This reposito...
OSV-2026-853 Stack-buffer-overflow in log4cxx::helpers::Transcoder::decode
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=519671967 Crash type: Stack-buffer-overflow READ 1 Crash state: log4cxx::helpers::Transcoder::decode TranscoderFuzzer.cpp CentipedeRunnerMain...
PT-2026-49158
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=519671967 Crash type: Stack-buffer-overflow READ 1 Crash state: log4cxx::helpers::Transcoder::decode TranscoderFuzzer.cpp CentipedeRunnerMain...
apache-logging-log4cxx:TranscoderFuzzer-wchar_t: Stack-buffer-overflow in log4cxx::helpers::Transcoder::decode
Detailed Report: https://oss-fuzz.com/testcase?key=4974813507813376 Project: apache-logging-log4cxx Fuzzing Engine: centipede Fuzz Target: TranscoderFuzzer-wchart Job Type: centipedeasanapache-logging-log4cxx Platform Id: linux Crash Type: Stack-buffer-overflow READ 1 Crash Address: 0x7b2b222daa1...
CVE-2026-31804
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /pmsimageproxy endpoint accepts a user-supplied img parameter and forwards it to Plex Media Server's /photo/:/ transcode transcoder without authentication and without restricting the scheme...
CVE-2026-31804
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /pmsimageproxy endpoint accepts a user-supplied img parameter and forwards it to Plex Media Server's /photo/:/ transcode transcoder without authentication and without restricting the scheme...
EUVD-2026-17190
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /pmsimageproxy endpoint accepts a user-supplied img parameter and forwards it to Plex Media Server's /photo/:/ transcode transcoder without authentication and without restricting the scheme...
EUVD-2013-0258
Malware in sbrugna...
EUVD-2025-25923
Malicious code in bioql PyPI...
EUVD-2024-29201
Malicious code in bioql PyPI...
CVE-2025-58209
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rtCamp Transcoder transcoder allows Stored XSS.This issue affects Transcoder: from n/a through = 1.4.0...
CVE-2025-58209
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rtCamp Transcoder transcoder allows Stored XSS.This issue affects Transcoder: from n/a through = 1.4.0...