Jellyfin Possible Organization/Secret Compromise from dangerous CI implementation

Jellyfin: Potential SSRF + Arbitrary file read via stream argument injection

Jellyfin: Potential FFmpeg argument injection via unescaped subtitle file path

Jellyfin: Potential Authenticated path traversal in /ClientLog/Document

Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain

Jellyfin Vulnerable to Argument Injection in FFmpeg

Argument Injection in FFmpeg codec parameters in Jellyfin

In Jellyfin before 10.8, the /users endpoint has incorrect access control for admin functionality

Jellyfin: Potential SSRF + Arbitrary file read via LiveTV M3U tuner

Jellyfin vulnerable to directory traversal and file write causing arbitrary code execution

Jellyfin Vulnerable to Denial of Service (DoS) via IP Spoofing

Jellyfin up to v10.7.7 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /Repositories

Jellyfin Possible Remote Code Execution via custom FFmpeg binary

Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images

Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions

Jellyfin: Potential Application DoS from excessively large SyncPlay group names

Unauthenticated Arbitrary File Access in Jellyfin

Unauthenticated GET requests through Remote Image endpoints

Jellyfin: Potential XSS in user management

Privilege escalation to admin from a low-privileged user via SVG upload in Jellyfin

jellyfin-web has a stored cross-site scripting vulnerability in devices.js

In Jellyfin 10.8.x through 10.8.3, the name of a collection is vulnerable to stored XSS

In Jellyfin 10.8.x through 10.8.3, the name of a playlist is vulnerable to stored XSS

In Jellyfin before 10.8, stored XSS allows theft of an admin access token

Jellyfin through 12.4 Information Disclosure via GET /Playlists/{playlistId}

Jellyfin: Potential MKV attachment filename path traversal to RCE