CVE-2026-49338: Improper Authorization

gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, the Subsonic API endpoints /rest/deletePlaylist.view and /rest/getPlaylist.view perform no per-resource authorization. Once authenticated as any user admin or not, an attacker can delete...

PT-2026-51013

Name of the Vulnerable Software and Affected Versions Gonic versions prior to 0.21.0 Description A logic error in the ServeCreateOrUpdatePlaylist function allows for arbitrary file write operations within the music streaming server. Recommendations Update to version 0.21.0 or later. As a temporar...

PT-2026-51012

Name of the Vulnerable Software and Affected Versions gonic versions prior to 0.21.0 Description The Subsonic API endpoints '/rest/deletePlaylist.view' and '/rest/getPlaylist.view' lack per-resource authorization. An authenticated user, regardless of privilege level, can delete any playlist or re...

EUVD-2018-17777

Malware in sbrugna...

EUVD-2018-7754

Malware in sbrugna...

EUVD-2018-6584

Malware in sbrugna...

EUVD-2018-6582

Malware in sbrugna...

EUVD-2018-6585

Malware in sbrugna...

EUVD-2017-18348

Malware in sbrugna...

EUVD-2018-20876

Malware in sbrugna...

EUVD-2017-18350

Malware in sbrugna...

EUVD-2017-18349

Malware in sbrugna...

EUVD-2018-6583

Malware in sbrugna...

EUVD-2018-12794

Malware in sbrugna...

EUVD-2008-2386

Malware in sbrugna...

EUVD-2021-8696

Malicious code in bioql PyPI...

EUVD-2023-3317

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2021-21399

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Ampache is a web based audio/video streaming application and file manager. Versions prior to 4.4.1 allow unauthenticated access to Ampache using the subsonic AP...

VulnCheck KEV: CVE-2025-27112

Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify any arbitrary username that does not exist on the system,...

CVE-2023-51442

Navidrome is an open source web-based music collection server and streamer. A security vulnerability has been identified in navidrome's subsonic endpoint, allowing for authentication bypass. This exploit enables unauthorized access to any known account by utilizing a JSON Web Token JWT signed wit...