Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10 results
Apr 21, 2026OwnTone Server versions 28.4 through 29.0 contain a race condition vulnerability in the DAAP login handler that allows unauthenticated attackers to crash the seCVE-2026-41458 · Other software · owntone · reported by VulnCheckHigh 8.2
OwnTone Server versions 28.4 through 29.0 contain a race condition vulnerability in the DAAP login handler that allows unauthenticated attackers to crash the server by exploiting unsynchronized access to the global DAAP session list. Attackers can flood the DAAP /login endpoint with concurrent requests to trigger a remote denial of service condition without requiring authentication.
- Product
- owntone-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026OwnTone Server versions 28.4 through 29.0 contain a SQL injection vulnerability in DAAP query and filter handling that allows attackers to inject arbitrary SQL CVE-2026-41457 · Other software · owntone · reported by VulnCheckMedium 6.9
OwnTone Server versions 28.4 through 29.0 contain a SQL injection vulnerability in DAAP query and filter handling that allows attackers to inject arbitrary SQL expressions by supplying malicious values through the query= and filter= parameters for integer-mapped DAAP fields. Attackers can exploit insufficient sanitization of these parameters to bypass filters and gain unauthorized access to media library data.
- Product
- owntone-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Apr 10, 2026owntone-server 2ca10d9 is vulnerable to Buffer Overflow due to lack of recursive checking.CVE-2025-44560 · Other software · reported by MITRECritical 9.8
owntone-server 2ca10d9 is vulnerable to Buffer Overflow due to lack of recursive checking.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Mar 23, 2026A NULL pointer dereference in the safe_atou64 function (src/misc.c) of owntone-server through commit c4d57aa allows attackers to cause a Denial of Service (DoS)CVE-2026-26829 · Other software · reported by MITREHigh 7.5
A NULL pointer dereference in the safe_atou64 function (src/misc.c) of owntone-server through commit c4d57aa allows attackers to cause a Denial of Service (DoS) via sending a series of crafted HTTP requests to the server.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026A NULL pointer dereference in the daap_reply_playlists function (src/httpd_daap.c) of owntone-server commit 3d1652d allows attackers to cause a Denial of ServicCVE-2026-26828 · Other software · reported by MITREHigh 7.5
A NULL pointer dereference in the daap_reply_playlists function (src/httpd_daap.c) of owntone-server commit 3d1652d allows attackers to cause a Denial of Service (DoS) via sending a crafted DAAP request to the server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026A NULL pointer dereference in the dacp_reply_playqueueedit_move function (src/httpd_dacp.c) of owntone-server commit b7e385f allows attackers to cause a Denial CVE-2025-63648 · Other software · Owntone · reported by MITREHigh 7.5
A NULL pointer dereference in the dacp_reply_playqueueedit_move function (src/httpd_dacp.c) of owntone-server commit b7e385f allows attackers to cause a Denial of Service (DoS) via sending a crafted DACP request to the server.
- Product
- Owntone Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026A NULL pointer dereference in the parse_meta function (src/httpd_daap.c) of owntone-server commit 334beb allows attackers to cause a Denial of Service (DoS) viaCVE-2025-63647 · Other software · Owntone · reported by MITREHigh 7.5
A NULL pointer dereference in the parse_meta function (src/httpd_daap.c) of owntone-server commit 334beb allows attackers to cause a Denial of Service (DoS) via sending a crafted DAAP request to the server.
- Product
- Owntone Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026NULL pointer dereference in the dacp_reply_playqueueedit_clear function in src/httpd_dacp.c in owntone-server through commit 6d604a1 (newer commit after versionCVE-2025-57156 · Other software · Owntone · reported by MITREHigh 7.5
NULL pointer dereference in the dacp_reply_playqueueedit_clear function in src/httpd_dacp.c in owntone-server through commit 6d604a1 (newer commit after version 28.12) allows remote attackers to cause a Denial of Service (crash).
- Product
- Owntone Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026NULL pointer dereference in the daap_reply_groups function in src/httpd_daap.c in owntone-server through commit 5e6f19a (newer commit after version 28.2) allowsCVE-2025-57155 · Other software · Owntone · reported by MITREHigh 7.5
NULL pointer dereference in the daap_reply_groups function in src/httpd_daap.c in owntone-server through commit 5e6f19a (newer commit after version 28.2) allows remote attackers to cause a Denial of Service.
- Product
- Owntone Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2021OwnTone (aka owntone-server) through 28.1 has a use-after-free in net_bind() in misc.c.CVE-2021-38383 · Other software · Owntone · reported by MITRECritical 9.8
OwnTone (aka owntone-server) through 28.1 has a use-after-free in net_bind() in misc.c.
- Product
- Owntone Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.