Tautulli vulnerabilities

CVEs per yearBy the year they were published

1. 20254
2. 202614

Newest CVEs

• CVE-2026-45381

  Tautulli: Reflected XSS in `/search` endpoint

  Tautulli · Tautulli

  Medium5.1
• CVE-2026-49995

  Tautulli: Stored Cross-Site Scripting (XSS) in the newsletter

  Tautulli · Tautulli

  Medium4.8
• CVE-2026-54915

  Tautulli: Open redirect via whitespace bypass in /auth/redirect

  Tautulli · Tautulli

  Medium5.4
• CVE-2026-52835

  Tautulli: Path traversal / arbitrary file write via unsanitized upload filename in import_config and import_database

  Tautulli · Tautulli

  High7.0
• CVE-2026-43986

  Tautulli vulnerable to unauthenticated SSRF in /image/<hash> via attacker-seeded image hash replay

  Tautulli · Tautulli

  Critical9.9
• CVE-2026-43985

  Taultulli has CSRF in /configUpdate via missing anti-CSRF and method restriction that allows admin credential takeover

  Tautulli · Tautulli

  High8.8
• CVE-2026-43984

  Tautulli has stored XSS in logFile via guest-controlled log_js_errors input

  Tautulli · Tautulli

  High8.9
• CVE-2026-41065

  Tautulli Vulnerable to Unauthenticated/Authenticated Remote Code Execution via Newsletter Custom Template Directory

  Tautulli · Tautulli

  High8.9
• CVE-2026-40605

  Tautulli Vulnerable to Authenticated Path Traversal in Cache Deletion API

  Tautulli · Tautulli

  Medium5.7
• CVE-2026-32275

  Tautulli: Unsanitized JSONP callback parameter allows cross-origin script injection and API key theft

  Tautulli · Tautulli

  High7.4