Emby

Records18All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical4CVSS 9.0–10.0

CVSS high7CVSS 7.0–8.9

Exploited now

Emby records in CISA KEV

No Emby vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Emby 6 records HIGH Emby.releases 3 records MEDIUM

Records

18 records

TI-2020-16372 CVE-2020-26948 · GHSA-cw27-8cg2-49c9

Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter.

HIGH 84

Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.87154 Published 2020-10-10 No fix listed CWE-918

TI-2021-07880 CVE-2021-25827 · GHSA-m4q9-68f2-5wc6

Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the…

HIGH 82

Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-Forwarded-For header to a local IP-address.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01497 Published 2023-06-28 No fix listed CWE-290

TI-2025-39760 CVE-2025-64325

Emby Server is Vulnerable to Remote Code Execution Through XSS in Admin Dashboard

HIGH 72

Emby Server is a personal media server.

CVSS 4.0HIGH 8.4 Network Low privileges User interaction EPSS 0.00444 Published 2025-11-18 No fix listed CWE-116

TI-2022-16600 CVE-2022-36223 · GHSA-w66w-cmgq-cc2j

In Emby Server 4.6.7.0, the playlist name field is vulnerable to XSS stored where it is…

MEDIUM 60

In Emby Server 4.6.7.0, the playlist name field is vulnerable to XSS stored where it is possible to steal the administrator access token and flip or steal the media server administrator account.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00438 Published 2022-12-16 No fix listed CWE-79

TI-2023-16370 CVE-2023-33193

Emby Server Proxy Header Spoofing Vulnerability

MEDIUM 51

Emby Server is a user-installable home media server which stores and organizes a user's media files of virtually any format and makes them available for viewing at home and abroad on a broad range of client devices.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01699 Published 2023-05-30 Fixed in 4.7.12, 4.8.31 CWE-444

TI-2025-39564 CVE-2025-64113

Emby Server allows attackers to gain administrative server access without preconditions

MEDIUM 49

Emby Server is a user-installable home media server.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00591 Published 2025-12-09 Fixed in 4.9.1.81 CWE-640

TI-2025-29111 CVE-2025-46385 · GHSA-89p2-5qg7-rj57

CWE-918 Server-Side Request Forgery (SSRF)

MEDIUM 43

CWE-918 Server-Side Request Forgery (SSRF)

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00298 Published 2025-07-20 No fix listed CWE-918

TI-2025-29113 CVE-2025-46387 · GHSA-mx8c-7rh4-qfj2

CWE-639 Authorization Bypass Through User-Controlled Key

MEDIUM 40

CWE-639 Authorization Bypass Through User-Controlled Key

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00383 Published 2025-08-06 No fix listed CWE-639

TI-2025-29112 CVE-2025-46386 · GHSA-m5q8-f47r-2wgp

CWE-639 Authorization Bypass Through User-Controlled Key

MEDIUM 40

CWE-639 Authorization Bypass Through User-Controlled Key

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00383 Published 2025-08-06 No fix listed CWE-639

TI-2025-29110 CVE-2025-46384 · GHSA-jc76-cg2q-pp7h

CWE-434 Unrestricted Upload of File with Dangerous Type

MEDIUM 40

CWE-434 Unrestricted Upload of File with Dangerous Type

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00397 Published 2025-07-20 No fix listed CWE-434

TI-2021-12498 CVE-2021-32833 · GHSA-2mfq-w3fm-wxm3

Unauthenticated file read in Emby Server

MEDIUM 40

Emby Server is a personal media server with apps on many devices.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.01273 Published 2021-09-09 No fix listed CWE-552

TI-2025-29116 CVE-2025-46390 · GHSA-v4w4-rm3v-q5g6

CWE-204: Observable Response Discrepancy

LOW 39

CWE-204: Observable Response Discrepancy

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00366 Published 2025-08-06 No fix listed CWE-204

TI-2025-29117 CVE-2025-46391 · GHSA-9f62-w6hf-65ph

CWE-284: Improper Access Control

LOW 28

CWE-284: Improper Access Control

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00267 Published 2025-08-06 No fix listed CWE-284

TI-2025-29115 CVE-2025-46389 · GHSA-5mxg-xjxm-9c6m

CWE-620: Unverified Password Change

LOW 28

CWE-620: Unverified Password Change

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00267 Published 2025-08-06 No fix listed CWE-620

TI-2023-03856 CVE-2023-4167 · GHSA-7j8v-mxgr-f46m

Media Browser Emby Server cross site scripting

LOW 28

A vulnerability was found in Media Browser Emby Server 4.7.13.0 and classified as problematic.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00604 Published 2023-08-05 No fix listed CWE-79

TI-2021-07881 CVE-2021-25828 · GHSA-9pjf-87x2-r68m

Emby Server versions < 4.6.0.50 is vulnerable to Cross Site Scripting (XSS) vulnerability…

LOW 28

Emby Server versions < 4.6.0.50 is vulnerable to Cross Site Scripting (XSS) vulnerability via a crafted GET request to /web.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0053 Published 2023-06-28 No fix listed CWE-79

TI-2025-29109 CVE-2025-46383 · GHSA-cmv4-w733-w8cj

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

LOW 27

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00261 Published 2025-07-20 No fix listed CWE-79

TI-2025-29114 CVE-2025-46388 · GHSA-4vpj-mr5m-xgr8

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

LOW 20

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00269 Published 2025-08-06 No fix listed CWE-200

Open these records in search →

Critical	4
High	7
Medium	7
Low	0
No CVSS	0