agentprime: jellyfinEvery new CVE for jellyfin.https://agentprime.io/CVE-2026-119551: Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestionshttps://agentprime.io/advisories/CVE-2026-119551/https://agentprime.io/advisories/CVE-2026-119551/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 11:31:02 GMTCVECVE-2026-119550: Jellyfin through 12.4 Information Disclosure via GET /Playlists/{playlistId}https://agentprime.io/advisories/CVE-2026-119550/https://agentprime.io/advisories/CVE-2026-119550/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 11:31:02 GMTCVECVE-2026-119549: Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Imageshttps://agentprime.io/advisories/CVE-2026-119549/https://agentprime.io/advisories/CVE-2026-119549/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 11:31:01 GMTCVECVE-2026-49220: Jellyfin: Potential XSS in user managementhttps://agentprime.io/advisories/CVE-2026-49220/https://agentprime.io/advisories/CVE-2026-49220/CVSS 5.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 24 Jun 2026 18:23:04 GMTCVECVE-2026-48793: Jellyfin: Potential FFmpeg argument injection via unescaped subtitle file pathhttps://agentprime.io/advisories/CVE-2026-48793/https://agentprime.io/advisories/CVE-2026-48793/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 24 Jun 2026 18:22:18 GMTCVECVE-2026-49246: Jellyfin: Potential MKV attachment filename path traversal to RCEhttps://agentprime.io/advisories/CVE-2026-49246/https://agentprime.io/advisories/CVE-2026-49246/CVSS 1.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 24 Jun 2026 18:21:25 GMTCVECVE-2026-49247: Jellyfin: Potential Authenticated path traversal in /ClientLog/Documenthttps://agentprime.io/advisories/CVE-2026-49247/https://agentprime.io/advisories/CVE-2026-49247/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 24 Jun 2026 18:18:46 GMTCVECVE-2026-35034: Jellyfin: Potential Application DoS from excessively large SyncPlay group nameshttps://agentprime.io/advisories/CVE-2026-35034/https://agentprime.io/advisories/CVE-2026-35034/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 14 Apr 2026 22:31:44 GMTCVECVE-2026-35033: Jellyfin: Potential SSRF + Arbitrary file read via stream argument injectionhttps://agentprime.io/advisories/CVE-2026-35033/https://agentprime.io/advisories/CVE-2026-35033/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 14 Apr 2026 22:28:47 GMTCVEcriticalCVE-2026-35032: Jellyfin: Potential SSRF + Arbitrary file read via LiveTV M3U tunerhttps://agentprime.io/advisories/CVE-2026-35032/https://agentprime.io/advisories/CVE-2026-35032/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 14 Apr 2026 22:25:35 GMTCVECVE-2026-35031: Jellyfin: Potential RCE via subtitle upload path traversal + .strm chainhttps://agentprime.io/advisories/CVE-2026-35031/https://agentprime.io/advisories/CVE-2026-35031/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 14 Apr 2026 22:18:30 GMTCVEcriticalCVE-2025-31499: Jellyfin Vulnerable to Argument Injection in FFmpeghttps://agentprime.io/advisories/CVE-2025-31499/https://agentprime.io/advisories/CVE-2025-31499/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Apr 2025 20:36:24 GMTCVECVE-2025-32012: Jellyfin Vulnerable to Denial of Service (DoS) via IP Spoofinghttps://agentprime.io/advisories/CVE-2025-32012/https://agentprime.io/advisories/CVE-2025-32012/CVSS 4.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Apr 2025 20:08:52 GMTCVECVE-2024-43801: Privilege escalation to admin from a low-privileged user via SVG upload in Jellyfinhttps://agentprime.io/advisories/CVE-2024-43801/https://agentprime.io/advisories/CVE-2024-43801/CVSS 4.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Sep 2024 16:26:58 GMTCVECVE-2023-48702: Jellyfin Possible Remote Code Execution via custom FFmpeg binaryhttps://agentprime.io/advisories/CVE-2023-48702/https://agentprime.io/advisories/CVE-2023-48702/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 13 Dec 2023 20:53:28 GMTCVECVE-2023-49096: Argument Injection in FFmpeg codec parameters in Jellyfinhttps://agentprime.io/advisories/CVE-2023-49096/https://agentprime.io/advisories/CVE-2023-49096/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 06 Dec 2023 19:14:11 GMTCVECVE-2021-29490: Unauthenticated GET requests through Remote Image endpointshttps://agentprime.io/advisories/CVE-2021-29490/https://agentprime.io/advisories/CVE-2021-29490/CVSS 5.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 05 May 2021 18:25:13 GMTCVECVE-2021-21402: Unauthenticated Arbitrary File Access in Jellyfinhttps://agentprime.io/advisories/CVE-2021-21402/https://agentprime.io/advisories/CVE-2021-21402/CVSS 7.7 (High). Critical: CVSS score 7.7 (7.0 or more) and EPSS 0.79 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.Tue, 23 Mar 2021 19:35:13 GMTCVEcritical