I don’t want to be an asshole but after checking a couple of those out they all appear to be post-authorization vulnerabilities? Like sure if you’re just passing out credentials to your jellyfin instance someone could use the device log upload to wreck your container, but shouldn’t most people be more worried about vulnerabilities that have surface for unauthorized attackers?