35
47
Jellyfin 12.0 security fixes arrive alongside the removal of legacy client logins
Jellyfin 12.0 ships security fixes for path traversal, first-run setup bypass, unsafe plugin names, and web client XSS, plus removal of legacy login paths.
Jellyfin 12.0 blocks requests built to reach files outside served folders, prevents setup-wizard re-runs on misconfigured servers, rejects unsafe plugin package names, and fixes web client cross-site scripting. The project published no CVE identifiers or severity ratings for the fixes. The release also drops legacy /emby/ and /mediabrowser/ endpoints, targets .NET 10, and breaks 10.11-era third-party plugins.
28
30
60
42
60
55
60
60
55
47
60
Jellyfin 12.0 Released With Security Fixes for Unauthorized File Access and XSS Flaws
Jellyfin 12.0 fixes unauthorized file access and web client XSS flaws, but requires careful upgrades due to breaking database migrations and plugin changes.
The open-source media server release prevents crafted requests from reading files outside designated directories, blocks unauthorized re-runs of the setup wizard, rejects plugin packages with unsafe names, strengthens parental control enforcement, and fixes cross-site scripting vulnerabilities in browser-based administration and media access workflows. Upgrades require a manual backup because the database schema migration is irreversible; supported paths start from version 10.10.7 or 10.11.x, and duplicate case-insensitive usernames will break migration. The release also retires legacy /emby/ and /mediabrowser/ routes, disables deprecated authentication by default, and targets .NET 10, requiring plugin rebuilds.
45
30
60
Broadcom Patches VMware Aria Flaws
60
30
60
60
60
60
55
60
30
60
60
30
60
60
47
42
47
Palo Alto Networks Patches Authentication Bypass Exploit in PAN
60
Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server
cPanel patched critical flaw CVE-2026-65643 letting authenticated hosting customers with addon or parked domain rights execute code as root and fully compromise servers.
cPanel issued patches on August 27, 2026 for CVE-2026-65643, a flaw in domain parking and addon domain functionality in cPanel & WHM that lets an authenticated account holder create arbitrary files and execute code as root, yielding full server control. Fixed builds cover the 11.110, 11.134, 11.136 and 11.138 branches, including WP Squared 11.138.1.7, and auto-update servers receive the fix automatically. No CVSS score, published CVE record, or evidence of exploitation has appeared, and the flaw is absent from CISA's KEV catalog as of August 27. The article also recaps related 2026 cPanel-ecosystem issues, including KEV-listed LiteSpeed plugin flaws and the in-the-wild-exploited Phusion Passenger problem.
68
35
30
60
30
55