zoriya Kyoo

• CVE-2026-77386 Medium 6.5 Kyoo: OIDC login token can be redirected to an attacker-controlled URL 0.6%
• CVE-2026-77385 Medium 4.3 Kyoo: Transcoder serves uncataloged files from the media directory 0.3%