CVE-2026-49338 Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR)

gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, the Subsonic API endpoints /rest/deletePlaylist.view and /rest/getPlaylist.view perform no per-resource authorization. Once authenticated as any user admin or not, an attacker can delete...

CVE-2026-49339

gonic is a music streaming server / free-software subsonic server API implementation. The maintainer's fix in commit 6dd71e6a3c966867ef8c900d359a7df75789f410 added an ownership check based on playlist.UserID. However, playlist.UserID is derived from the first path segment of the attacker-controll...

PT-2026-51013

Name of the Vulnerable Software and Affected Versions Gonic versions prior to 0.21.0 Description A logic error in the ServeCreateOrUpdatePlaylist function allows for arbitrary file write operations within the music streaming server. Recommendations Update to version 0.21.0 or later. As a temporar...

PT-2026-51012

Name of the Vulnerable Software and Affected Versions gonic versions prior to 0.21.0 Description The Subsonic API endpoints '/rest/deletePlaylist.view' and '/rest/getPlaylist.view' lack per-resource authorization. An authenticated user, regardless of privilege level, can delete any playlist or re...

CVE-2026-49338: Improper Authorization

gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, the Subsonic API endpoints /rest/deletePlaylist.view and /rest/getPlaylist.view perform no per-resource authorization. Once authenticated as any user admin or not, an attacker can delete...

EUVD-2018-6583

Malware in sbrugna...

EUVD-2018-6584

Malware in sbrugna...

EUVD-2018-17777

Malware in sbrugna...

EUVD-2018-6582

Malware in sbrugna...

EUVD-2018-20876

Malware in sbrugna...

EUVD-2018-12794

Malware in sbrugna...

EUVD-2017-18349

Malware in sbrugna...

EUVD-2017-18348

Malware in sbrugna...

EUVD-2017-18350

Malware in sbrugna...

EUVD-2018-7754

Malware in sbrugna...

EUVD-2018-6585

Malware in sbrugna...

EUVD-2008-2386

Malware in sbrugna...

EUVD-2021-8696

Malicious code in bioql PyPI...

EUVD-2023-3317

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2021-21399

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Ampache is a web based audio/video streaming application and file manager. Versions prior to 4.4.1 allow unauthenticated access to Ampache using the subsonic AP...