CVE-2026-112076

MediumCVSS 5.6/10Last modified Oct 19, 2026

Description

A security vulnerability has been detected in alexta69 MeTube up to 2026.09.28. This vulnerability affects the function DownloadQueue.__write_feed_metadata_sync of the file app/ytdl.py of the component Feed-metadata Thumbnail Fetch Handler. Such manipulation leads to server-side request forgery. The attack may be launched remotely. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 2026.09.29 is able to resolve this issue. The name of the patch is a3896604540223ecbb8258b41b1d745d62647d16. It is suggested to upgrade the affected component.

Metrics

CVSS 3.1 5.6/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Oct 19, 2026
Last modified: Oct 19, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1120775.6A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. This issue affects the function r_core_cmd_str_pipe in the library libr/core/CVE-2026-1120786.3A flaw has been found in RVC-Project Retrieval-based-Voice-Conversion-WebUI up to 2.3.260718. Impacted is the function change_info_ of the f CVE-2026-1120796.3A vulnerability has been found in hankcs HanLP up to 2.1.0-beta.64. The affected element is the function load_word2vec_as_vocab_tensor of th CVE-2026-112086.5Use after free in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from CVE-2026-1120806.3A vulnerability was found in LlamaChinese Llama-Chinese up to 6fa0fffb0dd82fe3cfaa1449ee54a5806d26ae9b. The impacted element is the function CVE-2026-1120816.3A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/hanlp_common/ha CVE-2026-1120827.5A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the fil CVE-2026-1120835.3A security flaw has been discovered in sgl-project SGLang up to 0.5.19. Affected is the function WeightExporter.send_weights_to_remote_insta CVE-2026-1120858.2webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0,CVE-2026-1120866.3A vulnerability was found in ESPnet up to 202610.post2. This affects the function build_model of the file espnet3/publication/inference_mode CVE-2026-1120876.3A weakness has been identified in itsourcecode Online Cake Ordering System 1.0. This issue affects some unknown processing of the file confi CVE-2026-1120886.3A weakness has been identified in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c