jellyfin vulnerabilities

CVEs per yearBy the year they were published

1. 20212
2. 20234
3. 20241
4. 20252
5. 202612

Newest CVEs

• CVE-2026-119551

  Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions

  jellyfin · jellyfin

  High7.1
• CVE-2026-119550

  Jellyfin through 12.4 Information Disclosure via GET /Playlists/{playlistId}

  jellyfin · jellyfin

  Medium5.1
• CVE-2026-119549

  Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images

  jellyfin · jellyfin

  High7.1
• CVE-2026-49220

  Jellyfin: Potential XSS in user management

  jellyfin · jellyfin

  Medium5.7
• CVE-2026-48793

  Jellyfin: Potential FFmpeg argument injection via unescaped subtitle file path

  jellyfin · jellyfin

  High8.8
• CVE-2026-49246

  Jellyfin: Potential MKV attachment filename path traversal to RCE

  jellyfin · jellyfin

  Low1.7
• CVE-2026-49247

  Jellyfin: Potential Authenticated path traversal in /ClientLog/Document

  jellyfin · jellyfin

  High8.8
• CVE-2026-35034

  Jellyfin: Potential Application DoS from excessively large SyncPlay group names

  jellyfin · jellyfin

  Medium6.5
• CVE-2026-35033

  Jellyfin: Potential SSRF + Arbitrary file read via stream argument injection

  jellyfin · jellyfin

  Critical9.3
• CVE-2026-35032

  Jellyfin: Potential SSRF + Arbitrary file read via LiveTV M3U tuner

  jellyfin · jellyfin

  High8.6