Known vulnerabilities in Jellyfin

Vendor: Jellyfin
Software: Jellyfin
Software CPE: cpe:2.3:a:jellyfin:jellyfin:*:*:*:*:*:*:*:*
Total vulnerabilities: 19
Public exploits: 1
Known exploited (KEV): 0

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Jellyfin Jellyfin is affected by 19 known vulnerabilities: 2 high, 12 medium, 5 low Critical High Medium Low

Vulnerabilities (19)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU151800 - Server-Side Request Forgery (SSRF)
CVE-2026-119549
CWE-918 Medium
No
No
12.0 23.09.2026 SB2026092332
#VU151798 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 High
No
No
12.0 23.09.2026 SB2026092332
#VU151795 - Authorization Bypass Through User-Controlled Key
CWE-639 Medium
No
No
- 23.09.2026 SB2026092330
#VU151688 - Exposure of sensitive information to an unauthorized actor
CVE-2026-119550
CWE-200 Medium
No
No
12.0 23.09.2026 SB2026092332
#VU151687 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 Medium
No
No
12.0 23.09.2026 SB2026092332
#VU151686 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 Low
No
No
12.0 23.09.2026 SB2026092332
#VU126129 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-35031
CWE-22 Medium
Available
No
10.11.7 15.04.2026 SB2026041528
#VU126128 - Improper input validation
CVE-2026-35032
CWE-20 Low
No
No
10.11.7 15.04.2026 SB2026041528
#VU126127 - Resource exhaustion
CVE-2026-35034
CWE-400 Low
No
No
10.11.7 15.04.2026 SB2026041528
#VU126126 - Argument Injection or Modification
CVE-2026-35033
CWE-88 Medium
No
No
10.11.7 15.04.2026 SB2026041528
#VU124690 - Resource exhaustion
CWE-400 Medium
No
No
10.11.0 31.03.2026 SB2026033155
#VU107449 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
CVE-2025-32012
CWE-451 Medium
No
No
10.10.7 15.04.2025 SB2025041518
#VU107448 - Argument Injection or Modification
CVE-2025-31499
CWE-88 Medium
No
No
10.10.7 15.04.2025 SB2025041518
#VU96664 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-43801
CWE-79 Low
No
No
10.9.10 02.09.2024 SB2024090216
#VU83917 - Argument Injection or Modification
CVE-2023-49096
CWE-88 High
No
No
10.8.13 06.12.2023 SB2023120635
#VU83914 - Command injection
CVE-2023-48702
CWE-77 Low
No
No
10.8.13 06.12.2023 SB2023120635
#VU75524 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2023-30626
CWE-22 Medium
No
No
10.8.10 26.04.2023 SB2023042632
#VU126124 - Server-Side Request Forgery (SSRF)
CVE-2021-29490
CWE-918 Medium
No
No
10.7.3 05.05.2021 SB2021050520
#VU126125 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2021-21402
CWE-22 Medium
No
No
10.7.1 22.03.2021 SB2021032237