PatchTheCVE: yooooomihttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2024-28193: your_spotify is an open source, self hosted Spotify tracking dashboardhttps://patchthecve.com/cve/CVE-2024-28193.htmlhttps://patchthecve.com/cve/CVE-2024-28193.htmlWed, 17 Jun 2026 07:21:10 +0000MEDIUM 6.5: your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify version <1.8.0 allows users to create a public token in the settings, which can be used to provide guest-level access to the information of that specific user in YourSpotify. The /me API endpoint discloses Spotify APCVE-2024-28192: your_spotify is an open source, self hosted Spotify tracking dashboardhttps://patchthecve.com/cve/CVE-2024-28192.htmlhttps://patchthecve.com/cve/CVE-2024-28192.htmlWed, 17 Jun 2026 07:21:10 +0000MEDIUM 5.3: your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify version <1.8.0 is vulnerable to NoSQL injection in the public access token processing logic. Attackers can fully bypass the public token authentication mechanism, regardless if a public token has been generated beforCVE-2024-28194: your_spotify is an open source, self hosted Spotify tracking dashboardhttps://patchthecve.com/cve/CVE-2024-28194.htmlhttps://patchthecve.com/cve/CVE-2024-28194.htmlWed, 17 Jun 2026 07:21:10 +0000CRITICAL 9.1: your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify versions < 1.8.0 use a hardcoded JSON Web Token (JWT) secret to sign authentication tokens. Attackers can use this well-known value to forge valid authentication tokens for arbitrary users. This vulnerability allows CVE-2024-28196: your_spotify is an open source, self hosted Spotify tracking dashboardhttps://patchthecve.com/cve/CVE-2024-28196.htmlhttps://patchthecve.com/cve/CVE-2024-28196.htmlWed, 17 Jun 2026 07:21:11 +0000MEDIUM 6.5: your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify version < 1.9.0 does not prevent other pages from displaying it in an iframe and is thus vulnerable to clickjacking. Clickjacking can be used to trick an existing user of YourSpotify to trigger actions, such as allowCVE-2024-28195: your_spotify is an open source, self hosted Spotify tracking dashboardhttps://patchthecve.com/cve/CVE-2024-28195.htmlhttps://patchthecve.com/cve/CVE-2024-28195.htmlWed, 17 Jun 2026 07:21:11 +0000HIGH 8.1: your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify versions < 1.9.0 do not protect the API and login flow against Cross-Site Request Forgery (CSRF). Attackers can use this to execute CSRF attacks on victims, allowing them to retrieve, modify or delete data on the aff