CVE-2026-63433

MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, shouldSkipCsrfProtection in backend/src/middleware/csrfConfig.ts delegates to isApiKeyRequest, which grants a CSRF exemption based only on the presence of an x-api-key header or an Authorization: ApiKey val...

EUVD-2026-116195

MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, shouldSkipCsrfProtection in backend/src/middleware/csrfConfig.ts delegates to isApiKeyRequest, which grants a CSRF exemption based only on the presence of an x-api-key header or an Authorization: ApiKey val...

CVE-2026-63433 MyTube: CSRF Protection Bypass via Arbitrary x-api-key Header Value

MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, shouldSkipCsrfProtection in backend/src/middleware/csrfConfig.ts delegates to isApiKeyRequest, which grants a CSRF exemption based only on the presence of an x-api-key header or an Authorization: ApiKey val...

CVE-2026-63433

The self-hosted video downloader and player MyTube is vulnerable to a Cross-Site Request Forgery (CSRF) attack in versions prior to 1.10.6 . The root cause is located in backend/src/middleware/csrfConfig.ts, where the shouldSkipCsrfProtection() function incorrectly grants a CSRF exemption by chec...

Log4Shell-PoC-Application

☕ Log4Shell PoC Application Spring framework based web application for proof of concept for log4shell vulnerabilities Install & Launch !Important JDK 1.88u131 in development is required to launch this project Use the provided Dockerfile to build and run the Docker image for poc application. docke...

CVE-2026-62979

jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, middleware/handle-error.ts serializes raw FetchError objects into HTTP responses. lib/servers/base.ts attaches outbound request headers on upstream non-success responses and schema-validation...

EUVD-2026-114471

jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, middleware/handle-error.ts serializes raw FetchError objects into HTTP responses. lib/servers/base.ts attaches outbound request headers on upstream non-success responses and schema-validation...

CVE-2026-62979

The jack application (a tool for sharing Radarr/Sonarr media libraries) is vulnerable to sensitive information exposure in versions prior to 0.1.0 . The root cause is that middleware/handle-error.ts serializes raw FetchError objects into HTTP responses. Because the extras field in lib/errors/Fetc...

CVE-2026-62979 jack: upstream error responses expose backend and peer credentials

jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, middleware/handle-error.ts serializes raw FetchError objects into HTTP responses. lib/servers/base.ts attaches outbound request headers on upstream non-success responses and schema-validation...

CVE-2026-62979 jack: upstream error responses expose backend and peer credentials

jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, middleware/handle-error.ts serializes raw FetchError objects into HTTP responses. lib/servers/base.ts attaches outbound request headers on upstream non-success responses and schema-validation...

CVE-2026-62979 jack: upstream error responses expose backend and peer credentials

jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, middleware/handle-error.ts serializes raw FetchError objects into HTTP responses. lib/servers/base.ts attaches outbound request headers on upstream non-success responses and schema-validation...

CVE-2026-62264 PDF Reader MCP: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY

PDF Reader MCP is a Model Context Protocol server for reading PDF documents. In versions 2.2.0 and later prior to 3.0.1, when MCPTRANSPORT=http enables the opt-in HTTP server, @sylphx/pdf-reader-mcp reads MCPAPIKEY and logs that X-API-Key authentication is enabled but never validates the X-API-Ke...

PT-2026-134214

jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, middleware/handle-error.ts serializes raw FetchError objects into HTTP responses. lib/servers/base.ts attaches outbound request headers on upstream non-success responses and schema-validation...

CVE-2026-62979: roziscoding jack: jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer

jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, middleware/handle-error.ts serializes raw FetchError objects into HTTP responses. lib/servers/base.ts attaches outbound request headers on upstream non-success responses and schema-validation...

GHSA-Q344-5V34-GM84 @sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY

Impact When @sylphx/pdf-reader-mcp is run as an HTTP server MCPTRANSPORT=http, it reads the MCPAPIKEY environment variable and logs API key authentication enabled X-API-Key header at startup, but it never validated the X-API-Key header on incoming requests. The key was read into a variable and...

follow-redirects: follow-redirects: Information disclosure via cross-domain redirects

A flaw was found in follow-redirects. When an HTTP request follows a cross-domain redirect a redirection to a different domain, custom authentication headers, such as X-API-Key or X-Auth-Token, are not properly stripped. This allows these sensitive headers to be forwarded verbatim to the redirect...

CVE-2026-111765

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Starting in version 1.3.0.Final and prior to version 1.3.2.Final, the AndroidA2AHttpClient synchronous POST path overrides the disabled-redirect setting in AndroidA2AHttpClient.createConnection with the PostBuilder default...

CVE-2026-111765 A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Starting in version 1.3.0.Final and prior to version 1.3.2.Final, the AndroidA2AHttpClient synchronous POST path overrides the disabled-redirect setting in AndroidA2AHttpClient.createConnection with the PostBuilder default...

CVE-2026-111765 A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Starting in version 1.3.0.Final and prior to version 1.3.2.Final, the AndroidA2AHttpClient synchronous POST path overrides the disabled-redirect setting in AndroidA2AHttpClient.createConnection with the PostBuilder default...

CVE-2026-111765

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Starting in version 1.3.0.Final and prior to version 1.3.2.Final, the AndroidA2AHttpClient synchronous POST path overrides the disabled-redirect setting in AndroidA2AHttpClient.createConnection with the PostBuilder default...