CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Plex Media Server Arbitrary File Write and Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-96656)
[Affected Scope] Plex Media Server versions prior to 1.43.3.10861.
[Impact] An authenticated admin can exploit the TranscoderH264Options preference to write arbitrary files, leading to full system compromise via malicious library (.so) execution.
[Mitigation] Immediately update to version 1.43.3.10861 or later and enforce Multi-Factor Authentication (MFA) for all admin accounts.
Plex Media Server SSRF Vulnerability Advisory (CVE-2026-96655)
[Affected Scope] All Plex Media Server installations prior to version 1.43.3.10861
[Impact] Authenticated attackers can bypass network restrictions to access internal resources or perform unauthorized external requests.
[Mitigation] Immediately update Plex Media Server to version 1.43.3.10861 or later.
Plex Media Server 'searchOne' Plugin Function Injection Vulnerability Advisory (CVE-2026-96654)
[Affected Scope] All Plex Media Server installations prior to version 1.43.3.10861
[Impact] Attackers can manipulate 'searchOne' parameters to invoke internal plugin functions and inject arbitrary parameters, potentially leading to server compromise or unauthorized data access
[Mitigation] Immediately update Plex Media Server to version 1.43.3.10861 or later
Plex Media Server SSRF Vulnerability Advisory (CVE-2026-96652) - Internal Network Pivoting and Request Forgery
[Affected Scope] All Plex Media Server installations prior to version 1.43.3.10861.
[Impact] Authenticated attackers with a valid X-Plex-Token can force the server to perform unauthorized HTTP POST requests to arbitrary internal or external destinations.
[Mitigation] Immediately update Plex Media Server to version 1.43.3.10861 or later.