Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: owntone-server 29.1.0 Clear all filters
TI-2026-30047 CVE-2026-41458 · GHSA-rvqf-8mp6-8qjg

OwnTone Server < 29.1 Race Condition DoS via DAAP Login

Priority LOW 36

OwnTone Server versions 28.4 through 29.0 contain a race condition vulnerability in the DAAP login handler that allows unauthenticated attackers to crash the server by exploiting unsynchronized access to the global DAAP…

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00364 Published 2026-04-22 Fixed in 29.1.0 CWE-362
TI-2026-30046 CVE-2026-41457 · GHSA-6742-w24p-5jgf

OwnTone Server < 29.1 SQL Injection via query and filter Parameters

Priority LOW 36

OwnTone Server versions 28.4 through 29.0 contain a SQL injection vulnerability in DAAP query and filter handling that allows attackers to inject arbitrary SQL expressions by supplying malicious values through the query=…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00274 Published 2026-04-22 Fixed in 29.1.0 CWE-89