PP
Product
Podlove Podcast Publisher
7
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 2High 2Medium 3Low 0
Watch
Add Podlove Podcast Publisher to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-13001 | 9.8 | Jul 14 | Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter Affected: through 4.5.1 |
| CVE-2025-10147 | 9.8 | Sep 23 | Podlove Podcast Publisher <= 4.2.6 - Unauthenticated Arbitrary File Upload Affected: through 4.2.6 |
| CVE-2026-16099 | 8.8 | Aug 16 | Podlove Podcast Publisher <= 4.5.3 - Authenticated (Contributor+) PHP Object Injection to Arbitrary File Deletion via 'unfurl_data' Parameter Affected: through 4.5.3 |
| CVE-2026-93775 | 7.2 | Oct 10 | Podlove Podcast Publisher <= 4.5.6 - Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook Affected: through 4.5.6 |
| CVE-2026-75966 | 6.4 | Sep 9 | Podlove Podcast Publisher <= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter Affected: through 4.5.5 |
| CVE-2025-1383 | 4.3 | Mar 6 | Podlove Podcast Publisher <= 4.2.2 - Cross-Site Request Forgery via ajax_transcript_delete Function Affected: through 4.2.2 |
| CVE-2025-0554 | 4.0 | Jan 18 | Podlove Podcast Publisher <= 4.1.25 - Authenticated (Admin+) Stored Cross-Site Scripting via Feed Name Affected: through 4.1.25 |
Showing 7