Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

7 records

Vendor: franklioxygen Component: Mytube Clear all filters
TI-2026-26286 CVE-2026-33935

MyTube has Unauthenticated Account Lockout via Shared Login Attempt State

Priority HIGH 67

MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.72, an unauthenticated attacker can lock out administrator and visitor accounts from password-based authentication by triggeri…

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00564 Published 2026-03-27 Fixed in 1.8.72 CWE-307
TI-2026-26248 CVE-2026-33890

MyTube has an Unauthenticated Admin Privilege Escalation via Passkey Registration

Priority HIGH 80

MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.71, an unauthenticated attacker can register an arbitrary passkey and subsequently authenticate with it to obtain a full admin…

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00501 Published 2026-03-27 Fixed in 1.8.71 CWE-284
TI-2026-26114 CVE-2026-33735

MyTube has an Improper Access Control that Allows Complete Application Takeover

Priority HIGH 74

MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.69, an authorization bypass in the `/api/settings/import-database` endpoint allows attackers with low-privilege credentials to…

CVSS 4.0HIGH 7.4 Network Low privileges No interaction EPSS 0.004 Published 2026-03-27 Fixed in 1.8.69 CWE-285