https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-33935.htmlhttps://patchthecve.com/cve/CVE-2026-33935.htmlWed, 17 Jun 2026 10:38:19 +0000HIGH 7.5: MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.72, an unauthenticated attacker can lock out administrator and visitor accounts from password-based authentication by triggering failed login attempts. The application exposes three password verification enhttps://patchthecve.com/cve/CVE-2026-33890.htmlhttps://patchthecve.com/cve/CVE-2026-33890.htmlWed, 17 Jun 2026 10:38:15 +0000CRITICAL 9.8: MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.71, an unauthenticated attacker can register an arbitrary passkey and subsequently authenticate with it to obtain a full admin session. The application exposes passkey registration endpoints without requirihttps://patchthecve.com/cve/CVE-2026-33735.htmlhttps://patchthecve.com/cve/CVE-2026-33735.htmlWed, 17 Jun 2026 10:38:00 +0000HIGH 8.8: MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.69, an authorization bypass in the `/api/settings/import-database` endpoint allows attackers with low-privilege credentials to upload and replace the application's SQLite database entirely, leading to a fulhttps://patchthecve.com/cve/CVE-2026-24140.htmlhttps://patchthecve.com/cve/CVE-2026-24140.htmlWed, 17 Jun 2026 10:22:41 +0000LOW 2.7: MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below have a Mass Assignment vulnerability in the settings management functionality due to insufficient input validation. The application's saveSettings() function accepts arbitrary key-value pairs without https://patchthecve.com/cve/CVE-2026-24139.htmlhttps://patchthecve.com/cve/CVE-2026-24139.htmlWed, 17 Jun 2026 10:22:41 +0000MEDIUM 6.5: MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below do not safeguard against authorization bypass, allowing guest users to download the complete application database. The application fails to properly validate user permissions on the database export en