https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-35034.htmlhttps://patchthecve.com/cve/CVE-2026-35034.htmlFri, 24 Jul 2026 21:10:00 +0000MEDIUM 6.5: Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a denial of service vulnerability in the SyncPlay group creation endpoint (POST /SyncPlay/New), where an authenticated user can create groups with names of unlimited size due to insufficient input validation. By shttps://patchthecve.com/cve/CVE-2026-35033.htmlhttps://patchthecve.com/cve/CVE-2026-35033.htmlFri, 24 Jul 2026 21:10:00 +0000CRITICAL 9.1: Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain an unauthenticated arbitrary file read vulnerability via ffmpeg argument injection through the StreamOptions query parameter parsing mechanism. The ParseStreamOptions method in StreamingHelpers.cs adds any lowercahttps://patchthecve.com/cve/CVE-2026-35032.htmlhttps://patchthecve.com/cve/CVE-2026-35032.htmlFri, 24 Jul 2026 21:10:00 +0000HIGH 8.1: Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the LiveTV M3U tuner endpoint (POST /LiveTv/TunerHosts), where the tuner URL is not validated, allowing local file read via non-HTTP paths and Server-Side Request Forgery (SSRF) via HTTP Uhttps://patchthecve.com/cve/CVE-2026-35031.htmlhttps://patchthecve.com/cve/CVE-2026-35031.htmlFri, 24 Jul 2026 21:10:00 +0000CRITICAL 9.9: Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the subtitle upload endpoint (POST /Videos/{itemId}/Subtitles), where the Format field is not validated, allowing path traversal via the file extension and enabling arbitrary file write. T