https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-55404.htmlhttps://patchthecve.com/cve/CVE-2026-55404.htmlMon, 13 Jul 2026 17:01:13 +0000HIGH 7.5: yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allohttps://patchthecve.com/cve/CVE-2026-50574.htmlhttps://patchthecve.com/cve/CVE-2026-50574.htmlFri, 26 Jun 2026 20:11:40 +0000HIGH 8.3: yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, if aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream), yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file write. On Windohttps://patchthecve.com/cve/CVE-2026-50023.htmlhttps://patchthecve.com/cve/CVE-2026-50023.htmlFri, 26 Jun 2026 20:12:25 +0000HIGH 8.3: yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, a vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as .desktop, .url, .webloc) to the user's filesystem, bypassing the remediation for CVE-2024-38519. The allowlist explicitlyhttps://patchthecve.com/cve/CVE-2026-50019.htmlhttps://patchthecve.com/cve/CVE-2026-50019.htmlFri, 26 Jun 2026 20:12:44 +0000MEDIUM 6.1: yt-dlp is a command-line audio/video downloader. From 2023.09.24 until 2026.06.09, if curl is used as an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest's. At the file download s