5
CVEs
0
Critical
2
High
4
KEV
4
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
2
MEDIUM
3
LOW
0
Monthly CVE Trend
Affected Products (3)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-96656 | Authenticated code execution in Plex Media Server before 1.43.3.10861 is a genuine but privilege-gated code-execution flaw: an attacker who first obtains admin-level access to the server's management interface can leverage the TranscoderH264Options preference, which is appended verbatim to x264's option string on every transcode, or write a malicious .so file that is loaded and executed at startup without signature, execute-bit, or symbol checks. This affects servers running versions prior to 1.43.3.10861; no public exploit was identified at time of analysis, and the supplied CVSS 4.0 score is 8.6 with PR:H, consistent with our independent CVSS 3.1 assessment requiring high privileges (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Because Plex admin is often the single server-owner account, the realistic attack path is credential compromise or exposure of the admin interface to untrusted networks; execution then occurs on the next transcode or after a server restart. | HIGH | 8.6 | 0.3% | 113 |
KEV
PoC
|
| CVE-2026-96654 | Improper neutralization of URL values in Plex Media Server's 'searchOne' parameter allows a remote attacker to invoke other plugins' functions and supply their own arguments, affecting all releases before 1.43.3.10861. The flaw is scored 6.9 (medium) under CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N), and an independent assessment agrees on a network-reachable, low-complexity request-forgery/parameter-injection class issue with only LOW confidentiality and integrity impact and no availability impact: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. No public exploit code was identified at time of analysis (a third-party writeup is referenced in the source list, but that is not confirmation of weaponization), and the vector's PR:N claim should be validated in practice because Plex APIs commonly require a server token and real-world exposure depends on whether the server or its API is reachable beyond localhost. | MEDIUM | 6.9 | 0.2% | 105 |
KEV
PoC
|
| CVE-2026-96652 | Server-side request forgery in Plex Media Server before 1.43.3.10861 allows a low-privileged, token-bearing caller to force the server to POST to an arbitrary destination by putting a full URL in the 'protocol' parameter of the '/player/timeline' endpoint. Because any X-Plex-Token value is accepted, the authentication barrier is effectively trivial, but the assessed impact is limited to a blind outbound request (confidentiality-low, no integrity or availability effect) against hosts reachable by the Plex process. No CISA KEV entry and no confirmed exploitation have been reported, and no public exploit code was identified at time of analysis; the practical risk is a genuine but low-priority SSRF that matters most for internet- or DMZ-exposed servers that can reach sensitive internal services. | MEDIUM | 5.3 | 0.2% | 97 |
KEV
PoC
|
| CVE-2026-96655 | Server-side request forgery in Plex Media Server before 1.43.3.10861 allows any authenticated user - including a low-trust account invited only to a shared library - to coerce the server into issuing HTTP requests to arbitrary internal or external addresses through the path parameter of the '/video/:/transcode/universal' endpoint. The attacker gains no code execution and the assessed impact is confidentiality-only and limited (CVSS 4.3, C:L/I:N/A:N), but the flaw is a useful internal-network reconnaissance and pivot primitive on internet-facing or flat-network deployments. No public exploit identified at time of analysis; exploitation requires a valid authenticated session and a server running a version prior to 1.43.3.10861. | MEDIUM | 5.3 | 0.2% | 97 |
KEV
PoC
|
| CVE-2026-96651 | Path traversal in Plex Media Server before 1.43.3.10861 lets an attacker who can reach the /system/agents/media/get endpoint read files accessible to the targeted Plex user by supplying ../ sequences in the url parameter. The primary exploitation path requires a valid Plex session token (the assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, i.e. authenticated), while a secondary, lower-barrier path lets a LAN-adjacent attacker supply a crafted X-Forwarded-For header that the server trusts as evidence of local context. Read access is nominally bounded by the victim account's permissions, but because the reachable files include the PlexOnlineToken store, successful exploitation escalates from file disclosure to full Plex account and server takeover; no CISA KEV entry or public exploit code appears in the supplied intelligence, and a vendor fix is available in version 1.43.3.10861. | HIGH | 7.1 | 0.4% | 36 |
|