Known vulnerabilities in Jellyfin

Vendor: Jellyfin
Software: Jellyfin
Software CPE: cpe:2.3:a:jellyfin:jellyfin:*:*:*:*:*:*:*:*
Total vulnerabilities: 13
Public exploits: 1
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.2

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Jellyfin Jellyfin is affected by 13 known vulnerabilities: 1 high, 8 medium, 4 low Critical High Medium Low

Vulnerabilities (13)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU126129 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-35031
CWE-22 Medium
Available
No
10.11.7 15.04.2026 SB2026041528
#VU126128 - Improper input validation
CVE-2026-35032
CWE-20 Low
No
No
10.11.7 15.04.2026 SB2026041528
#VU126127 - Resource exhaustion
CVE-2026-35034
CWE-400 Low
No
No
10.11.7 15.04.2026 SB2026041528
#VU126126 - Argument Injection or Modification
CVE-2026-35033
CWE-88 Medium
No
No
10.11.7 15.04.2026 SB2026041528
#VU124690 - Resource exhaustion
CWE-400 Medium
No
No
10.11.0 31.03.2026 SB2026033155
#VU107449 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
CVE-2025-32012
CWE-451 Medium
No
No
10.10.7 15.04.2025 SB2025041518
#VU107448 - Argument Injection or Modification
CVE-2025-31499
CWE-88 Medium
No
No
10.10.7 15.04.2025 SB2025041518
#VU96664 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-43801
CWE-79 Low
No
No
10.9.10 02.09.2024 SB2024090216
#VU83917 - Argument Injection or Modification
CVE-2023-49096
CWE-88 High
No
No
10.8.13 06.12.2023 SB2023120635
#VU83914 - Command injection
CVE-2023-48702
CWE-77 Low
No
No
10.8.13 06.12.2023 SB2023120635
#VU75524 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2023-30626
CWE-22 Medium
No
No
10.8.10 26.04.2023 SB2023042632
#VU126124 - Server-Side Request Forgery (SSRF)
CVE-2021-29490
CWE-918 Medium
No
No
10.7.3 05.05.2021 SB2021050520
#VU126125 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2021-21402
CWE-22 Medium
No
No
10.7.1 22.03.2021 SB2021032237