plus, most of the mentioned cve’s state “versions before …”. Exposing a service to the internet always has a risk to it, keeping your service up-to-date is mandatory. Running behind a vpn can protect you, sure. But it also has to be practical. I don’t get why Jellyfin especially gets this kind of slaming. You’ll find similar records for any other software.