jellyfin vulnerabilities
21 published CVEs name jellyfin among the affected products.
- 21Published CVEs21 of them scored
- 12Last 12 monthspublished in the last year
- 4Critical10 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-119551
Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions
jellyfin · jellyfin
High7.1 - CVE-2026-119550
Jellyfin through 12.4 Information Disclosure via GET /Playlists/{playlistId}
jellyfin · jellyfin
Medium5.1 - CVE-2026-119549
Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images
jellyfin · jellyfin
High7.1 - CVE-2026-49220
Jellyfin: Potential XSS in user management
jellyfin · jellyfin
Medium5.7 - CVE-2026-48793
Jellyfin: Potential FFmpeg argument injection via unescaped subtitle file path
jellyfin · jellyfin
High8.8 - CVE-2026-49246
Jellyfin: Potential MKV attachment filename path traversal to RCE
jellyfin · jellyfin
Low1.7 - CVE-2026-49247
Jellyfin: Potential Authenticated path traversal in /ClientLog/Document
jellyfin · jellyfin
High8.8 - CVE-2026-35034
Jellyfin: Potential Application DoS from excessively large SyncPlay group names
jellyfin · jellyfin
Medium6.5 - CVE-2026-35033
Jellyfin: Potential SSRF + Arbitrary file read via stream argument injection
jellyfin · jellyfin
Critical9.3 - CVE-2026-35032
Jellyfin: Potential SSRF + Arbitrary file read via LiveTV M3U tuner
jellyfin · jellyfin
High8.6