Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: iv-org Clear all filters
TI-2026-42057 CVE-2026-58447 · GHSA-85cg-fg77-rrm5

Invidious - Cross-User Playlist Video Deletion via Missing Ownership Check

Priority MEDIUM 64

Invidious through 2.20260626.0, fixed in commit 77ad416, contains a broken object level authorization vulnerability that allows authenticated attackers to delete videos from other users' playlists by supplying an arbitra…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00273 Published 2026-06-30 Fixed CWE-639
TI-2026-41712 CVE-2026-57946 · GHSA-vppr-73v3-3pc6

Invidious - Private Playlist Disclosure via Unauthenticated RSS Feed Endpoint

Priority MEDIUM 61

Invidious before version 2.20260626.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve private playlist contents by accessing the RSS feed playlist endpoint without authent…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00352 Published 2026-06-29 Fixed in 2.20260626.0 CWE-862