jellyfin has 3 CVEs on record. 3 were published in the last 90 days. The busiest recent month was October 2026 with 3. The median CVSS is 6.5 (medium).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2026-119549High· 7.1Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images39CVE-2026-119551Medium· 6.5Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions36CVE-2026-119550Low· 3.5Jellyfin through 12.4 Information Disclosure via GET /Playlists/{playlistId}19
jellyfin vulnerabilities
CVEs affecting jellyfin, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-119549High· 7.1Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images
Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs. Attackers can upload such profile images vi…
CVE-2026-119551Medium· 6.5Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions
Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users to bypass library and parental restrictions by omitting the userId parameter. …
CVE-2026-119550Low· 3.5Jellyfin through 12.4 Information Disclosure via GET /Playlists/{playlistId}
Jellyfin through 12.4 contains an information disclosure vulnerability in PlaylistsController.GetPlaylist that allows authenticated users to read hidden item IDs by requesting public or shared playlists. Restricted or parental-controlled…