CVE-2026-49247 | High | 8.8 | 2026-06-24 | Jellyfin is an open source self hosted media server. From 10.9.0 until 10.11.10, the POST /ClientLog/Document endpoint accepts the Authorization header's Clien… |
CVE-2026-49246 | | | 2026-06-24 | Jellyfin is an open source self hosted media server. Prior to 10.11.10, a specifically crafted MKV file containing forged filename tags can be leveraged to exp… |
CVE-2026-49220 | Medium | 5.7 | 2026-06-24 | Jellyfin is an open source self hosted media server. Prior to 10.11.9, a potential XSS attack exists in Jellyfin which can allow a non-privileged user to execu… |
CVE-2026-48793 | High | 8.8 | 2026-06-24 | Jellyfin is an open source self hosted media server. Prior to 10.11.10, a potential FFmpeg argument injection vulnerability exists in the subtitle conversion c… |
CVE-2026-35034 | Medium | 6.5 | 2026-04-14 | Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a denial of service vulnerability in the SyncPlay group creation endpoin… |
CVE-2026-35033 | Critical | 9.1 | 2026-04-14 | Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain an unauthenticated arbitrary file read vulnerability via ffmpeg argument… |
CVE-2026-35032 | High | 8.1 | 2026-04-14 | Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the LiveTV M3U tuner endpoint (POST /LiveTv/Tun… |
CVE-2026-35031 | Critical | 9.9 | 2026-04-14 | Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the subtitle upload endpoint (POST /Videos/{ite… |
CVE-2026-31852 | Critical | 10.0 | 2026-03-11 | Jellyfin is an open-source media system. The code-quality.yml GitHub Actions workflow in jellyfin/jellyfin-ios is vulnerable to arbitrary code execution via pu… |
CVE-2025-31499 | High | 8.8 | 2025-04-15 | Jellyfin is an open source self hosted media server. Versions before 10.10.7 are vulnerable to argument injection in FFmpeg. This can be leveraged to possibly… |
CVE-2025-32012 | High | 7.5 | 2025-04-15 | Jellyfin is an open source self hosted media server. In versions 10.9.0 to before 10.10.7, the /System/Restart endpoint provides administrators the ability to… |
CVE-2024-43801 | Medium | 4.6 | 2024-09-02 | Jellyfin is an open source self hosted media server. The Jellyfin user profile image upload accepts SVG files, allowing for a stored XSS attack against an admi… |
CVE-2023-48702 | High | 7.2 | 2023-12-13 | Jellyfin is a system for managing and streaming media. Prior to version 10.8.13, the `/System/MediaEncoder/Path` endpoint executes an arbitrary file using `Pro… |
CVE-2023-49096 | High | 7.7 | 2023-12-06 | Jellyfin is a Free Software Media System for managing and streaming media. In affected versions there is an argument injection in the VideosController, specifi… |
CVE-2023-30627 | Critical | 9.0 | 2023-04-24 | jellyfin-web is the web client for Jellyfin, a free-software media system. Starting in version 10.1.0 and prior to version 10.8.10, a stored cross-site scripti… |
CVE-2023-30626 | High | 8.8 | 2023-04-24 | Jellyfin is a free-software media system. Versions starting with 10.8.0 and prior to 10.8.10 and prior have a directory traversal vulnerability inside the `Cli… |
CVE-2023-27161 | High | 7.5 | 2023-03-10 | Jellyfin up to v10.7.7 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /Repositories. This vulnerability allows attackers to a… |
CVE-2023-23636 | Medium | 5.4 | 2023-02-03 | In Jellyfin 10.8.x through 10.8.3, the name of a playlist is vulnerable to stored XSS. This allows an attacker to steal access tokens from the localStorage of… |
CVE-2023-23635 | Medium | 5.4 | 2023-02-03 | In Jellyfin 10.8.x through 10.8.3, the name of a collection is vulnerable to stored XSS. This allows an attacker to steal access tokens from the localStorage o… |
CVE-2022-35910 | Medium | 5.4 | 2022-08-19 | In Jellyfin before 10.8, stored XSS allows theft of an admin access token. |
CVE-2022-35909 | High | 8.8 | 2022-08-19 | In Jellyfin before 10.8, the /users endpoint has incorrect access control for admin functionality. |
CVE-2021-29490 | Medium | 5.8 | 2021-05-06 | Jellyfin is a free software media system that provides media from a dedicated server to end-user devices via multiple apps. Verions prior to 10.7.3 vulnerable… |
CVE-2021-21402 | High | 7.7 | 2021-03-23 | Jellyfin is a Free Software Media System. In Jellyfin before version 10.7.1, with certain endpoints, well crafted requests will allow arbitrary file read from… |