Login Request a demo
JE
Vendor
jellyfin
3 products with CVEs on record
28
CVEs
0
On KEV
3
New 30D
Products
JE
jellyfin
jellyfin
9.8
26 CVEs0 on KEV3 new
CO
code-quality.yml
jellyfin
9.8
1 CVEs0 on KEV0 new
JE
jellyfin-web
jellyfin
5.4
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-119551
New
JE
jellyfin
jellyfin
6.5–Oct 30Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions
CVE-2026-119550
New
JE
jellyfin
jellyfin
3.5–Oct 30Jellyfin through 12.4 Information Disclosure via GET /Playlists/{playlistId}
CVE-2026-119549
New
JE
jellyfin
jellyfin
7.1–Oct 30Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images
CVE-2026-49220
JE
jellyfin
jellyfin
5.7
0%
Jun 24Jellyfin: Potential XSS in user management
CVE-2026-48793
JE
jellyfin
jellyfin
8.8
1%
Jun 24Jellyfin: Potential FFmpeg argument injection via unescaped subtitle file path
CVE-2026-49246
JE
jellyfin
jellyfin
1.7
0%
Jun 24Jellyfin: Potential MKV attachment filename path traversal to RCE
CVE-2026-49247
JE
jellyfin
jellyfin
8.8
1%
Jun 24Jellyfin: Potential Authenticated path traversal in /ClientLog/Document
CVE-2026-35034
JE
jellyfin
jellyfin
6.5
0%
Apr 14Jellyfin: Potential Application DoS from excessively large SyncPlay group names
CVE-2026-35033
JE
jellyfin
jellyfin
9.1
0%
Apr 14Jellyfin: Potential SSRF + Arbitrary file read via stream argument injection
CVE-2026-35032
JE
jellyfin
jellyfin
8.1
0%
Apr 14Jellyfin: Potential SSRF + Arbitrary file read via LiveTV M3U tuner
CVE-2026-35031
JE
jellyfin
jellyfin
8.8
1%
Apr 14Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain
CVE-2026-31852
CO
code-quality.yml
jellyfin
9.8
0%
Mar 11Jellyfin Possible Organization/Secret Compromise from dangerous CI implementation
CVE-2025-31499
JE
jellyfin
jellyfin
8.8
1%
Apr 15Jellyfin Vulnerable to Argument Injection in FFmpeg
CVE-2025-32012
JE
jellyfin
jellyfin
7.5
1%
Apr 15Jellyfin Vulnerable to Denial of Service (DoS) via IP Spoofing
CVE-2024-43801
JE
jellyfin
jellyfin
5.4
0%
Sep 2Privilege escalation to admin from a low-privileged user via SVG upload in Jellyfin
CVE-2023-48702
JE
jellyfin
jellyfin
7.2
1%
Dec 13Jellyfin Possible Remote Code Execution via custom FFmpeg binary
CVE-2023-49096
JE
jellyfin
jellyfin
8.8
1%
Dec 6Argument Injection in FFmpeg codec parameters in Jellyfin
CVE-2023-30627
JE
jellyfin-web
jellyfin
5.4
1%
Apr 24jellyfin-web has a stored cross-site scripting vulnerability in devices.js
CVE-2023-30626
JE
jellyfin
jellyfin
8.1
2%
Apr 24Jellyfin vulnerable to directory traversal and file write causing arbitrary code execution
CVE-2023-27161
JE
Jellyfin
Jellyfin
7.5
1%
Mar 10Jellyfin up to v10.7.7 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /Repositories
CVE-2023-23636
JE
Jellyfin
Jellyfin
5.4
1%
Feb 3In Jellyfin 10.8.x through 10.8.3, the name of a playlist is vulnerable to stored XSS
CVE-2023-23635
JE
Jellyfin
Jellyfin
5.4
1%
Feb 3In Jellyfin 10.8.x through 10.8.3, the name of a collection is vulnerable to stored XSS
CVE-2022-35909
JE
Jellyfin
Jellyfin
8.8
2%
Aug 19In Jellyfin before 10.8, the /users endpoint has incorrect access control for admin functionality
CVE-2022-35910
JE
Jellyfin
Jellyfin
5.4
1%
Aug 19In Jellyfin before 10.8, stored XSS allows theft of an admin access token
CVE-2021-29490
JE
jellyfin
jellyfin
5.8
70%
May 5Unauthenticated GET requests through Remote Image endpoints
CVE-2021-21402
JE
jellyfin
jellyfin
6.5
79%
Mar 23Unauthenticated Arbitrary File Access in Jellyfin