https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-27793.htmlhttps://patchthecve.com/cve/CVE-2026-27793.htmlWed, 17 Jun 2026 10:27:41 +0000MEDIUM 6.5: Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.1.0, the `GET /api/v1/user/:id` endpoint returns the full settings object for any user, including Pushover, Pushbullet, and Telegram credentials, to any authenticated requester regardless of https://patchthecve.com/cve/CVE-2026-27792.htmlhttps://patchthecve.com/cve/CVE-2026-27792.htmlWed, 17 Jun 2026 10:27:41 +0000MEDIUM 5.4: Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. A missing authorization vulnerability has been identified in the application starting in version 2.7.0 and prior to version 3.1.0. It allows authenticated users to access and modify data belonging to other userhttps://patchthecve.com/cve/CVE-2026-27707.htmlhttps://patchthecve.com/cve/CVE-2026-27707.htmlWed, 17 Jun 2026 10:27:33 +0000HIGH 7.3: Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Starting in version 2.0.0 and prior to version 3.1.0, an authentication guard logic flaw in `POST /api/v1/auth/jellyfin` allows an unauthenticated attacker to register a new Seerr account on any Plex-configured