[ Vendor · 6 CVEs ]
Plex
CVEs affecting Plex published in the last 30 days, plus any Plex CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-96651 | 23 Sep 2026 | CVSS 6.5 | Plex Media ServerPlex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via… | |
| CVE-2026-96652 | 23 Sep 2026 | CVSS 4.3 | Server-side request forgery in Plex Media Server timeline endpointPlex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the… | Exploited |
| CVE-2026-96654 | 23 Sep 2026 | CVSS 6.5 | URL handling flaw exposes Plex Media Server plugin functionsPlex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins'… | Exploited |
| CVE-2026-96655 | 23 Sep 2026 | CVSS 4.3 | Server-side request forgery in Plex Media Server transcoderPlex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the… | Exploited |
| CVE-2026-96656 | 23 Sep 2026 | CVSS 7.2 | Plex Media Server admin setting allows code executionPlex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference… | Exploited |
| CVE-2020-5741 | 8 May 2020 | CVSS 7.2 | Plex Media Server Remote Code ExecutionDeserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code. | Exploited |