CVE-2025-44560

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

owntone-server 2ca10d9 is vulnerable to Buffer Overflow due to lack of recursive checking.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

No affected versions have been published.

Timeline

Published
Apr 10, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-44579.8A vulnerability classified as critical was found in Project Worlds Car Rental Project 1.0. Affected by this vulnerability is an unknown funcCVE-2025-44588.8A vulnerability was found in code-projects Patient Record Management System 1.0. It has been declared as critical. Affected by this vulnerabCVE-2025-44598.8A vulnerability was found in code-projects Patient Record Management System 1.0. It has been rated as critical. Affected by this issue is soCVE-2025-445936.1Halo prior to 2.20.13 allows bypassing file type detection and uploading malicious files such as .exe and .html files. Specifically, .html fCVE-2025-445949.1halo v2.20.17 and before is vulnerable to server-side request forgery (SSRF) in /apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload-CVE-2025-445956.1Halo v2.20.17 and before is vulnerable to Cross Site Scripting (XSS) in /halo_host/archives/{name}.CVE-2025-44604.8A vulnerability classified as problematic has been found in TOTOLINK N150RT 3.4.0-B20190525. This affects an unknown part of the component UCVE-2025-446086.5CloudClassroom-PHP Project v1.0 was discovered to contain a SQL injection vulnerability via the viewid parameter.CVE-2025-44615.4A vulnerability classified as problematic was found in TOTOLINK N150RT 3.4.0-B20190525. This vulnerability affects unknown code of the compoCVE-2025-446125.9Tinxy WiFi Lock Controller v1 RF was discovered to transmit sensitive information in plaintext, including control information and device creCVE-2025-446147.5Tinxy WiFi Lock Controller v1 RF was discovered to store users' sensitive information, including credentials and mobile phone numbers, in plCVE-2025-446199.1Tinxy WiFi Lock Controller v1 RF was discovered to be configured to transmit on an open Wi-Fi network, allowing attackers to join the networ
CVE-2025-44560: Critical severity, CVSS 9.8 | Vulnix