navidrome vulnerabilities
9 published CVEs name navidrome among the affected products.
- 9Published CVEs9 of them scored
- 2Last 12 monthspublished in the last year
- 2Critical4 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-25578
Navidrome is vulnerable to XSS via comment from song metadata
navidrome · navidrome
Medium6.1 - CVE-2026-25579
Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpoints
navidrome · navidrome
Critical9.2 - CVE-2025-48949
Navidrome allows SQL Injection via role parameter
navidrome · navidrome
High8.9 - CVE-2025-48948
Navidrome Transcoding Permission Bypass Vulnerability Report
navidrome · navidrome
High7.4 - CVE-2025-27112
Navidrome has authentication bypass in Subsonic API with non-existent username
navidrome · navidrome
Medium6.9 - CVE-2024-56362
Navidrome Stores JWT Secret in Plaintext in navidrome.db
navidrome · navidrome
High7.1 - CVE-2024-47062
Multiple SQL Injections and ORM Leak in navidrome
navidrome · navidrome
Critical9.4 - CVE-2024-32963
Parameter Tampering vulnerability in Navidrome
navidrome · navidrome
Medium4.2 - CVE-2023-51442
Authentication bypass vulnerability in navidrome's subsonic endpoint
navidrome · navidrome
High8.6