Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.69, an authorization bypass in the `/api/settings/import-database` endpoint allows attackers with low-privilege credentials to upload and replace the application's SQLite database entirely, leading to a full compromise of the application. The bypass is relevant for other POST routes as well. Version 1.8.69 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-33735 MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.69, an authorization bypass in the `/api/settings/import-database` endpo… https://www.cve.org/CVERecord?id=CVE-2026-33735
Post summary
Disclosed an authorization bypass vulnerability in MyTube’s /api/settings/import-database endpoint prior to v1.8.69; no PoC, exploit code, patch, or active exploitation details were provided.
⚡ New CVE Alert: CVE-2026-33735 📊 Severity: 7.4 🚨 Risk Level: High 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-33735 #CVE-2026-33735 #CVE #High #CyberSecurity #InfoSec https://t.co/Yhkx7d59z2
Post summary
The tweet announces CVE-2026-33735, lists its severity as 7.4, and directs readers to the NVD entry, but provides no additional technical details, exploit, or mitigation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | franklioxygen | mytube | - | - | - |