Vulnerabilities

TI-2026-39337 CVE-2026-54491 · GHSA-6qvr-wjmv-v8mm

Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths

MEDIUM 64

Koel is a free, open-source music streaming solution.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00384 Published 2026-08-19 Fixed in 9.7.1 CWE-918

TI-2026-39339 CVE-2026-54493 · GHSA-6p96-cfg5-4vhp

HIGH 67

Koel is a free, open-source music streaming solution.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00415 Published 2026-08-19 Fixed in 9.7.0 CWE-918

TI-2026-39340 CVE-2026-54494 · GHSA-rjg7-r26h-cfp2

MEDIUM 63

Koel is a free, open-source music streaming solution.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00427 Published 2026-08-19 Fixed in 9.7.1 CWE-918

TI-2026-39338 CVE-2026-54492 · GHSA-w79m-f3jx-779v

MEDIUM 53

Koel is a free, open-source music streaming solution.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00411 Published 2026-08-19 Fixed in 9.7.0 CWE-918

TI-2026-37274 CVE-2026-50552 · GHSA-jr4p-4xjh-fwvw

MEDIUM 61

Koel is a free, open-source music streaming solution.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00169 Published 2026-06-12 Fixed in 9.7.1 CWE-918

TI-2026-34840 CVE-2026-47260 · GHSA-7j2f-6h2r-6cqc

HIGH 67

Koel is a free, open-source music streaming solution.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00302 Published 2026-06-12 Fixed in 9.3.5 CWE-918

TI-2021-12956 CVE-2021-33563 · GHSA-r37h-j483-cjjm

LOW 34

Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows whether a failed login attempt had a valid username.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00809 Published 2021-05-24 Fixed in 5.1.4 CWE-916