Plex
Vulnerability activity for Plex: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 4
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 4
- With exploit code
- 0
Last 90 days
- CVEs
- 4
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 4
- With exploit code
- 0
Last 365 days
- CVEs
- 4
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 4
- With exploit code
- 0
Exploited now
CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.
- 4.3MediumOct 20, 2026Plex Media Server SSRFCVE-2026-96652Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Added to KEV Oct 20, 2026ExploitedDetection
- 6.5MediumOct 20, 2026Plex Media ServerCVE-2026-96654Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.Added to KEV Oct 20, 2026ExploitedDetection
- 4.3MediumOct 20, 2026Plex Media Server SSRFCVE-2026-96655Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.Added to KEV Oct 20, 2026ExploitedDetection
- 7.2HighOct 20, 2026Plex Media Server Path traversal / file handlingCVE-2026-96656Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.Added to KEV Oct 20, 2026Exploited
- 7.2HighMay 8, 2020Plex Media Server DeserializationCVE-2020-5741Plex Media Server contains a remote code execution vulnerability that allows an attacker with access to the server administrator's Plex account to upload a malicious file via the Camera Upload feature and have the media server execute it.Added to KEV Mar 10, 2023 · 1,035 days after publicationExploited73% likelyExploit codeMetasploit
Recent
- 7.2HighOct 20, 2026Plex Media Server Path traversal / file handlingCVE-2026-96656Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.Exploited
- 4.3MediumOct 20, 2026Plex Media Server SSRFCVE-2026-96655Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.ExploitedDetection
- 6.5MediumOct 20, 2026Plex Media ServerCVE-2026-96654Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.ExploitedDetection
- 4.3MediumOct 20, 2026Plex Media Server SSRFCVE-2026-96652Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. ExploitedDetection
- 7.2HighMay 8, 2020Plex Media Server DeserializationCVE-2020-5741Plex Media Server contains a remote code execution vulnerability that allows an attacker with access to the server administrator's Plex account to upload a malicious file via the Camera Upload feature and have the media server execute it.Exploited73% likelyExploit codeMetasploit
Top products
- Media Server4 CVEs in the last year, 4 exploited
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.