17
CVEs
1
Critical
10
High
5
KEV
15
PoC
9
Unpatched C/H
35.3%
Patch Rate
7.8%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
10
MEDIUM
6
LOW
0
Monthly CVE Trend
Affected Products (3)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-96656 | Authenticated code execution in Plex Media Server before 1.43.3.10861 is a genuine but privilege-gated code-execution flaw: an attacker who first obtains admin-level access to the server's management interface can leverage the TranscoderH264Options preference, which is appended verbatim to x264's option string on every transcode, or write a malicious .so file that is loaded and executed at startup without signature, execute-bit, or symbol checks. This affects servers running versions prior to 1.43.3.10861; no public exploit was identified at time of analysis, and the supplied CVSS 4.0 score is 8.6 with PR:H, consistent with our independent CVSS 3.1 assessment requiring high privileges (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Because Plex admin is often the single server-owner account, the realistic attack path is credential compromise or exposure of the admin interface to untrusted networks; execution then occurs on the next transcode or after a server restart. | HIGH | 8.6 | 0.3% | 113 |
KEV
PoC
|
| CVE-2026-96654 | Improper neutralization of URL values in Plex Media Server's 'searchOne' parameter allows a remote attacker to invoke other plugins' functions and supply their own arguments, affecting all releases before 1.43.3.10861. The flaw is scored 6.9 (medium) under CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N), and an independent assessment agrees on a network-reachable, low-complexity request-forgery/parameter-injection class issue with only LOW confidentiality and integrity impact and no availability impact: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. No public exploit code was identified at time of analysis (a third-party writeup is referenced in the source list, but that is not confirmation of weaponization), and the vector's PR:N claim should be validated in practice because Plex APIs commonly require a server token and real-world exposure depends on whether the server or its API is reachable beyond localhost. | MEDIUM | 6.9 | 0.2% | 105 |
KEV
PoC
|
| CVE-2026-96652 | Server-side request forgery in Plex Media Server before 1.43.3.10861 allows a low-privileged, token-bearing caller to force the server to POST to an arbitrary destination by putting a full URL in the 'protocol' parameter of the '/player/timeline' endpoint. Because any X-Plex-Token value is accepted, the authentication barrier is effectively trivial, but the assessed impact is limited to a blind outbound request (confidentiality-low, no integrity or availability effect) against hosts reachable by the Plex process. No CISA KEV entry and no confirmed exploitation have been reported, and no public exploit code was identified at time of analysis; the practical risk is a genuine but low-priority SSRF that matters most for internet- or DMZ-exposed servers that can reach sensitive internal services. | MEDIUM | 5.3 | 0.2% | 97 |
KEV
PoC
|
| CVE-2026-96655 | Server-side request forgery in Plex Media Server before 1.43.3.10861 allows any authenticated user - including a low-trust account invited only to a shared library - to coerce the server into issuing HTTP requests to arbitrary internal or external addresses through the path parameter of the '/video/:/transcode/universal' endpoint. The attacker gains no code execution and the assessed impact is confidentiality-only and limited (CVSS 4.3, C:L/I:N/A:N), but the flaw is a useful internal-network reconnaissance and pivot primitive on internet-facing or flat-network deployments. No public exploit identified at time of analysis; exploitation requires a valid authenticated session and a server running a version prior to 1.43.3.10861. | MEDIUM | 5.3 | 0.2% | 97 |
KEV
PoC
|
| CVE-2020-5741 | Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.2 | 72.8% | 71 |
KEV
PoC
No patch
|
| CVE-2018-13415 | In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 31.8% | 69 |
PoC
No patch
|
| CVE-2020-5742 | Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application requests. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 1.4% | 64 |
PoC
No patch
|
| CVE-2014-9304 | Plex Media Server before 0.9.9.3 allows remote attackers to bypass the web server whitelist, conduct SSRF attacks, and execute arbitrary administrative actions via multiple crafted X-Plex-Url headers. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.5 | 3.4% | 61 |
PoC
No patch
|
| CVE-2014-9181 | Multiple directory traversal vulnerabilities in Plex Media Server before 0.9.9.3 allow remote attackers to read arbitrary files via a .. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 15.3%. | MEDIUM | 5.0 | 15.3% | 60 |
PoC
|
| CVE-2020-5740 | Improper Input Validation in Plex Media Server on Windows allows a local, unauthenticated attacker to execute arbitrary Python code with SYSTEM privileges. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.8 | 0.7% | 59 |
PoC
No patch
|
| CVE-2025-69414 | Plex Media Server builds through 1.42.2.10156 can return a permanent account access token to a caller who already holds a valid transient Plex token via the /myplex/account endpoint, turning short-lived access into durable account access. This is a CWE-863 authorization bypass with a network attack vector and low complexity, but it requires the prerequisite transient token, so it is not an unauthenticated from-zero compromise. Publicly available exploit code exists, EPSS is very low at 0.04% (13th percentile), and no confirmed active exploitation is reported in the provided data. | HIGH | 7.1 | 0.0% | 56 |
PoC
No patch
|
| CVE-2025-69415 | In Plex Media Server (PMS) through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether the device is currently associated with an account. [CVSS 7.1 HIGH] | HIGH | 7.1 | 0.0% | 56 |
PoC
No patch
|
| CVE-2021-42835 | An issue was discovered in Plex Media Server through 1.24.4.5081-e362dc1ee. Rated high severity (CVSS 7.0). Public exploit code available and no vendor patch available. | HIGH | 7.0 | 1.2% | 55 |
PoC
No patch
|
| CVE-2019-19141 | The Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote authenticated users to write files anywhere the user account running the Plex Media Server has permissions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available. | HIGH | 8.8 | 4.4% | 44 |
No patch
|
| CVE-2025-69416 | In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve other tokens (intended for unrelated access) via clients.plex.tv/devices.xml. [CVSS 5.0 MEDIUM] | MEDIUM | 4.3 | 0.0% | 42 |
PoC
No patch
|