Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
26 results
Oct 9, 2026Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers.CVE-2026-108264 · Other software · wizarrrr · reported by GitHubCritical 9.1
Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied through the editor or imported bundles was evaluated by app/blueprints/wizard/routes.py in the application's non-sandboxed Jinja2 environment with application globals exposed. An authenticated user able to create steps, or an administrator importing an untrusted bundle through POST /settings/wizard/import, could execute arbitrary Python when GET /wizard/{server}/{idx} rendered the stored step; app/jinja_filters.py and app/services/wizard_widgets.py contained additional evaluation sinks. This could execute operating-system commands as the application user, disclose the Flask SECRET_KEY, access connected service credentials and the database, and produce stored cross-site scripting. This issue is fixed in 2026.9.1.
- Product
- wizarr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby.CVE-2026-73291 · Other software · seerr-team · reported by GitHubHigh 7.1
Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.4.0, Seerr's ImageProxy in server/lib/imageproxy.ts uses the upstream ETag and Content-Type response headers to build a cache filename for the unauthenticated GET /avatarproxy/:jellyfinUserId route, allowing a malicious or compromised Jellyfin or Emby server, or a man-in-the-middle attacker on a plaintext media-server connection, to supply traversal sequences that path.join and fs.writeFile normalize outside the cache directory, overwrite /app/dist/index.js or other files, and execute code as the node user after a container restart. This issue is fixed in version 3.4.0.
- Product
- seerr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby.CVE-2026-27793 · Other software · seerr-team · reported by GitHubMedium 6.5
Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.1.0, the `GET /api/v1/user/:id` endpoint returns the full settings object for any user, including Pushover, Pushbullet, and Telegram credentials, to any authenticated requester regardless of their privilege level. This vulnerability can be exploited alone or combined with the reported unauthenticated account creation vulnerability, CVE-2026-27707. When combined, the two vulnerabilities create a zero-prior-access chain that leaks third-party API credentials for all users, including administrators. Version 3.1.0 contains a fix for both this vulnerability and for CVE-2026-27707.
- Product
- seerr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby.CVE-2026-27792 · Other software · seerr-team · reported by GitHubMedium 5.4
Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. A missing authorization vulnerability has been identified in the application starting in version 2.7.0 and prior to version 3.1.0. It allows authenticated users to access and modify data belonging to other users. This issue is due to the absence of the `isOwnProfileOrAdmin()` middleware on several push subscription API routes. Version 3.1.0 fixes the issue.
- Product
- seerr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby.CVE-2026-27707 · Other software · seerr-team · reported by GitHubHigh 7.3
Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Starting in version 2.0.0 and prior to version 3.1.0, an authentication guard logic flaw in `POST /api/v1/auth/jellyfin` allows an unauthenticated attacker to register a new Seerr account on any Plex-configured instance by authenticating with an attacker-controlled Jellyfin server. The attacker receives an authenticated session and can immediately use the application with default permissions, including the ability to submit media requests to Radarr/Sonarr. Any Seerr deployment where all three of the following are true may be vulnerable: `settings.main.mediaServerType` is set to `PLEX` (the most common deployment).; `settings.jellyfin.ip` is set to `""` (default, meaning Jellyfin was never configured); and `settings.main.newPlexLogin` is set to `true` (default). Jellyfin-configured and Emby-configured deployments are not affected. Version 3.1.0 of Seerr fixes this issue.
- Product
- seerr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025Emby Server is a user-installable home media server.CVE-2025-64113 · Other software · EmbySupport · reported by GitHubCritical 9.3
Emby Server is a user-installable home media server. Versions below 4.9.1.81 allow an attacker to gain full administrative access to an Emby Server (for Emby Server administration, not at the OS level). Other than network access, no specific preconditions need to be fulfilled for a server to be vulnerable. This issue is fixed in version 4.9.1.81.
- Product
- security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2025Emby Server is a personal media server.CVE-2025-64325 · Other software · EmbySupport · reported by GitHubHigh 8.4
Emby Server is a personal media server. Prior to version 4.8.1.0 and prior to Beta version 4.9.0.0-beta, a malicious user can send an authentication request with a manipulated X-Emby-Client value, which gets added to the devices section of the admin dashboard without sanitization. This issue has been patched in version 4.8.1.0 and Beta version 4.9.0.0-beta.
- Product
- Emby.Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025CWE-284: Improper Access ControlCVE-2025-46391 · Other software · Emby · reported by cna@cyber.gov.ilMedium 6.5
CWE-284: Improper Access Control
- Product
- MediaBrowser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025CWE-204: Observable Response DiscrepancyCVE-2025-46390 · Other software · Emby · reported by cna@cyber.gov.ilHigh 7.5
CWE-204: Observable Response Discrepancy
- Product
- MediaBrowser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025CWE-620: Unverified Password ChangeCVE-2025-46389 · Other software · Emby · reported by cna@cyber.gov.ilMedium 6.5
CWE-620: Unverified Password Change
- Product
- MediaBrowser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025CWE-200 Exposure of Sensitive Information to an Unauthorized ActorCVE-2025-46388 · Other software · Emby · reported by cna@cyber.gov.ilMedium 4.3
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
- Product
- MediaBrowser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025CWE-639 Authorization Bypass Through User-Controlled KeyCVE-2025-46387 · Other software · Emby · reported by cna@cyber.gov.ilHigh 8.8
CWE-639 Authorization Bypass Through User-Controlled Key
- Product
- MediaBrowser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025CWE-639 Authorization Bypass Through User-Controlled KeyCVE-2025-46386 · Other software · Emby · reported by cna@cyber.gov.ilHigh 8.8
CWE-639 Authorization Bypass Through User-Controlled Key
- Product
- MediaBrowser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2025CWE-918 Server-Side Request Forgery (SSRF)CVE-2025-46385 · Other software · Emby · reported by cna@cyber.gov.ilHigh 8.6
CWE-918 Server-Side Request Forgery (SSRF)
- Product
- Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2025CWE-434 Unrestricted Upload of File with Dangerous TypeCVE-2025-46384 · Other software · Emby · reported by cna@cyber.gov.ilHigh 8.8
CWE-434 Unrestricted Upload of File with Dangerous Type
- Product
- Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2025CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2025-46383 · Other software · Emby · reported by cna@cyber.gov.ilMedium 6.1
CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
- Product
- Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2024Stored Cross Site Scripting vulnerability in Emby Media Server Emby Media Server 4.8.3.0 allows a remote attacker to escalate privileges via the notifications.hCVE-2024-30931 · Other software · emby · reported by MITREMedium 6.1
Stored Cross Site Scripting vulnerability in Emby Media Server Emby Media Server 4.8.3.0 allows a remote attacker to escalate privileges via the notifications.html component.
- Product
- media_server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhappy-little-accidents.pages.devhappy-little-accidents.pages.dev
Aug 5, 2023A vulnerability was found in Media Browser Emby Server 4.7.13.0 and classified as problematic.CVE-2023-4167 · Other software · Media Browser · reported by VulDBLow 3.5
A vulnerability was found in Media Browser Emby Server 4.7.13.0 and classified as problematic. This issue affects some unknown processing of the file /web/. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-236183.
- Product
- Emby Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2023Emby Server versions < 4.6.0.50 is vulnerable to Cross Site Scripting (XSS) vulnerability via a crafted GET request to /web.CVE-2021-25828 · Other software · Emby · reported by MITREMedium 6.1
Emby Server versions < 4.6.0.50 is vulnerable to Cross Site Scripting (XSS) vulnerability via a crafted GET request to /web.
- Product
- Emby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2023Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-Forwarded-For header to a local IP-address.CVE-2021-25827 · Other software · Emby · reported by MITRECritical 9.8
Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-Forwarded-For header to a local IP-address.
- Product
- Emby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023Emby Server is a user-installable home media server which stores and organizes a user's media files of virtually any format and makes them available for viewingCVE-2023-33193 · Other software · EmbySupport · reported by GitHubCritical 9.1
Emby Server is a user-installable home media server which stores and organizes a user's media files of virtually any format and makes them available for viewing at home and abroad on a broad range of client devices. This vulnerability may allow administrative access to an Emby Server system, depending on certain user account settings. By spoofing certain headers which are intended for interoperation with reverse proxy servers, it may be possible to affect the local/non-local network determination to allow logging in without password or to view a list of user accounts which may have no password configured. Impacted are all Emby Server system which are publicly accessible and where the administrator hasn't tightened the account login configuration for administrative users. This issue has been patched in Emby Server Beta version 4.8.31 and Emby Server version 4.7.12.
- Product
- security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2022In Emby Server 4.6.7.0, the playlist name field is vulnerable to XSS stored where it is possible to steal the administrator access token and flip or steal the mCVE-2022-36223 · Other software · Emby · reported by MITREMedium 6.1
In Emby Server 4.6.7.0, the playlist name field is vulnerable to XSS stored where it is possible to steal the administrator access token and flip or steal the media server administrator account.
- Product
- Emby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2021Emby Server is a personal media server with apps on many devices.CVE-2021-32833 · Other software · MediaBrowser · reported by GitHubHigh 8.6
Emby Server is a personal media server with apps on many devices. In Emby Server on Windows there is a set of arbitrary file read vulnerabilities. This vulnerability is known to exist in version 4.6.4.0 and may not be patched in later versions. Known vulnerable routes are /Videos/Id/hls/PlaylistId/SegmentId.SegmentContainer, /Images/Ratings/theme/name and /Images/MediaInfo/theme/name. For more details including proof of concept code, refer to the referenced GHSL-2021-051. This issue may lead to unauthorized access to the system especially when Emby Server is configured to be accessible from the Internet.
- Product
- Emby.Releases
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritylab.github.comsecuritylab.github.com
Oct 10, 2020Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter.CVE-2020-26948 · Other software · Emby · reported by MITRECritical 9.8
Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter.
- Product
- Emby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2014The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain CVE-2014-1402 · Other software · Pocoo · reported by MITREMedium 4.4
The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with __jinja2_ in /tmp.
- Product
- Jinja2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.mageia.orgjinja.pocoo.org
May 19, 2014FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary CVE-2014-0012 · Other software · Pocoo · reported by Red HatMedium 4.4
FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user's uid. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1402.
- Product
- Jinja2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsecunia.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.