franklioxygen has 4 CVEs on record. 4 were published in the last 90 days. The median CVSS is 6.9 (medium).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.9
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Worst active — by depth score
CVE-2026-62302High· 8.7MyTube: Unauthenticated Media Access via Static Routes Bypassing Login48CVE-2026-62301High· 7.1MyTube: Visitor Can Access Hidden Video Metadata and Content39CVE-2026-63433Medium· 6.8MyTube: CSRF Protection Bypass via Arbitrary x-api-key Header Value37CVE-2026-63434Medium· 4.3MyTube: Visitor-Role Statistics Event Forgery Allows Analytics Data Poisoning24
franklioxygen vulnerabilities
CVEs affecting franklioxygen, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-63434Medium· 4.3MyTube: Visitor-Role Statistics Event Forgery Allows Analytics Data Poisoning
MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, when statisticsEnabled and statisticsTrackVisitorActivity are enabled, a visitor-role user can submit events to the statistics ingest endpoint han…
CVE-2026-63433Medium· 6.8MyTube: CSRF Protection Bypass via Arbitrary x-api-key Header Value
MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, shouldSkipCsrfProtection() in backend/src/middleware/csrfConfig.ts delegates to isApiKeyRequest(), which grants a CSRF exemption based only on the…
CVE-2026-62302High· 8.7MyTube: Unauthenticated Media Access via Static Routes Bypassing Login
MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, `server.ts` calls `registerStaticRoutes` and `registerCloudRoutes` before `registerApiRoutes`, where `authMiddleware` and `roleBasedAuthMi…
CVE-2026-62301High· 7.1MyTube: Visitor Can Access Hidden Video Metadata and Content
MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, backend video access does not enforce the visitor role's intended public-only restriction when `loginEnabled=true` and a visitor password …