4 CVEs publicados el 2026-10-20 · 4 con explotación activa confirmada por CISA KEV · 2 con prueba de concepto pública · CVSS máximo 7.2/10.
Productos afectados (catálogo NVD)
plex/media_server
CVEs de este lote
| CVE | Severidad | CVSS | EPSS | Estado | Descripción |
|---|---|---|---|---|---|
| CVE-2026-96656 | CRITICAL | 7.2 | 0.8% | KEV PoC | Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. |
| CVE-2026-96654 | CRITICAL | 6.5 | 0.4% | KEV | Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters. |
| CVE-2026-96652 | CRITICAL | 4.3 | 0.4% | KEV PoC | Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST… |
| CVE-2026-96655 | CRITICAL | 4.3 | 0.4% | KEV | Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. |