Log in Start free

koel

Products

ProductCVEsExploitedLatest
koel6–Aug 19, 2026

Exploited and recent CVEs

  • CVE-2026-54491 High 7.1 Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths 0.4%
  • CVE-2026-54493 High 7.7 Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations 0.4%
  • CVE-2026-54494 Medium 5.3 Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4 0.4%
  • CVE-2026-54492 Medium 4.3 Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation 0.4%
  • CVE-2026-50552 Medium 6.3 Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail 0.2%
  • CVE-2026-47260 High 7.7 Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs 0.3%