Get real-time updates on Telegram
CVE-2026-112076: MeTube 2026.09.0, 2026.09.1, 2026.09.2, 2026.09.3, 2026.09.4, 2026.09.5, 2026.09.6, 2026.09.7, 2026.09.8, 2026.09.9…
CVE-2026-112076. CVSS 2.0 base score 5.1 (MEDIUM, Vendor/CNA).
Affected technology
MeTube · 2026.09.0, 2026.09.1, 2026.09.2, 2026.09.3, 2026.09.4, 2026.09.5, 2026.09.6, 2026.09.7, 2026.09.8, 2026.09.9, 2026.09.10, 2026.09.11, 2026.09.12, 2026.09.13, 2026.09.14, 2026.09.15, 2026.09.16, 2026.09.17, 2026.09.18, 2026.09.19, 2026.09.20, 2026.09.21, 2026.09.22, 2026.09.23, 2026.09.24, 2026.09.25, 2026.09.26, 2026.09.27, 2026.09.28
alexta69
Description’s affected range: up to 2026.09.28
Component: Feed-metadata Thumbnail Fetch Handler
Function: DownloadQueue.__write_feed_metadata_sync
File: app/ytdl.py
Attack conditions (VulDB, CVSS 4.0): Network (remote) · No privileges required · No user interaction required
What an attacker can do
VulDB’s CVSS 4.0 assessment (base score 2.9/10) rates confidentiality, integrity and availability impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.
- CWE
- CWE-918
- CCR priority
- 20.4 /100 (P4)
- CVSS 2.0
- 5.1 /10 · CVSS:2.0/AV:N/AC:H/Au:N/C:P/I:P/A:P · Vendor/CNA
- KEV
- no
Provenance
- NVD CVE API 2.0 · Source record · observed 2026-10-19 05:28:27.911423+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-112076.html