blackcandy-org vulnerabilities

Products

• Black Candy 1

Latest blackcandy-org CVEs

Newest publication first

1. CVE-2026-97061 Black Candy through 3.2.1 Information Disclosure via Playlist Search

   Published 2026-09-24

   Medium·CVSS 5.3 EPSS 0.22%

   Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the instance. Attackers can query the SearchController or Search::PlaylistsController endpoints with blank or targeted...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.