Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: marcopiovanello Clear all filters
TI-2026-71734 CVE-2026-109967 · GHSA-vw64-j3q3-fxf9

NULL pointer dereference in yt-dlp-web-ui lets attackers crash the server

Priority HIGH 77

yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00562 Published 2026-10-13 No fix listed CWE-476
TI-2026-71733 CVE-2026-109966 · GHSA-g8v9-4g6m-3vc9

Argument injection in yt-dlp-web-ui via JSON-RPC Service.Formats

Priority HIGH 70

yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unauthenticated remote attackers to inject yt-dlp options by supplying a dash-prefixed url parameter to the Service.Formats JSON-RPC me…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00411 Published 2026-10-13 No fix listed CWE-88