CVE-2026-104058 is a missing authentication vulnerability in Podgrab's /ws WebSocket endpoint. The vulnerability allows unauthenticated network clients to connect and potentially disrupt legitimate playback, exposing episode IDs, titles, and server-side file paths. This issue arises because the /ws endpoint is registered on the root gin engine instead of a BasicAuth-protected router group. As a result, at [truncated]
CVE-2026-104057 is a high-severity vulnerability in Podgrab, an open-source software, that allows unauthenticated denial-of-service (DoS) attacks via concurrent map access in its WebSocket handler. The vulnerability is caused by unsynchronized access to shared maps, which can be exploited by opening multiple WebSocket connections and sending messages in a loop, triggering a Go runtime data race that crash [truncated]
