Log in Start free

navidrome

Products

ProductCVEsExploitedLatest
navidrome9–Feb 4, 2026

Exploited and recent CVEs

  • CVE-2026-25578 Medium 6.1 Navidrome is vulnerable to XSS via comment from song metadata 0.3%
  • CVE-2026-25579 Critical 9.2 Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpoints 0.5%
  • CVE-2025-48949 High 8.9 Navidrome allows SQL Injection via role parameter 0.5%
  • CVE-2025-48948 High 7.4 Navidrome Transcoding Permission Bypass Vulnerability Report 0.5%
  • CVE-2025-27112 Medium 6.9 Navidrome has authentication bypass in Subsonic API with non-existent username 1.0%
  • CVE-2024-56362 High 7.1 Navidrome Stores JWT Secret in Plaintext in navidrome.db 0.2%
  • CVE-2024-47062 Critical 9.4 Multiple SQL Injections and ORM Leak in navidrome 4.5%
  • CVE-2024-32963 Medium 4.2 Parameter Tampering vulnerability in Navidrome 0.4%
  • CVE-2023-51442 High 8.6 Authentication bypass vulnerability in navidrome's subsonic endpoint 0.7%