Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: MusicPlayerDaemon Clear all filters
TI-2026-36345 CVE-2026-49130 · GHSA-f8fv-fv9m-8539

Music Player Daemon < 0.24.11 CRLF Injection via XspfPlaylistPlugin.cxx

Priority HIGH 70

Music Player Daemon (MPD) before version 0.24.11 contains a CRLF injection vulnerability in the xspf_char_data function within the XSPF playlist plugin that allows attackers to embed literal CR/LF bytes in URI fields by…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0026 Published 2026-05-28 Fixed in 0.24.11 CWE-93
TI-2026-36344 CVE-2026-49129 · GHSA-5c2h-g7wx-c499

Music Player Daemon < 0.24.11 SSRF via CurlInputPlugin

Priority HIGH 70

Music Player Daemon (MPD) before version 0.24.11 contains a server-side request forgery vulnerability in CurlInputPlugin where CURLOPT_FOLLOWLOCATION is set without CURLOPT_REDIR_PROTOCOLS_STR, allowing unauthenticated a…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00281 Published 2026-05-28 Fixed in 0.24.11 CWE-918
TI-2026-36343 CVE-2026-49128 · GHSA-r679-wq5x-vg3g

Music Player Daemon < 0.24.11 Path Traversal via LocalStorage URI Handling

Priority HIGH 77

Music Player Daemon (MPD) before version 0.24.11 contains a path traversal vulnerability in LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 within the local storage plugin, where the on-disk path is constructed by j…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00637 Published 2026-05-28 Fixed in 0.24.11 CWE-22
TI-2026-36342 CVE-2026-49127 · GHSA-p9r5-qpp4-rjg3

Music Player Daemon < 0.24.11 Stack Buffer Overflow via pcm_unpack_24be

Priority HIGH 77

Music Player Daemon (MPD) before version 0.24.11 contains a stack buffer overflow vulnerability in the pcm_unpack_24be function in src/pcm/Pack.cxx that allows unauthenticated attackers to corrupt stack memory by trigger…

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.0051 Published 2026-05-28 Fixed in 0.24.11 CWE-193