VulnSea

Plex has 5 CVEs on record. 5 were published in the last 90 days. The busiest recent month was September 2026 with 5. The median CVSS is 6.5 (medium). None have a confirmed exploitation report.

CVEs per month

Last 12 months, by publish date

101112010203040506070809
Exploited share
0% vs 1% corpus
Median CVSS
6.5
Publish → KEV
Last 90 days
5 prev 0

Products

  • Media Server 5
5
Total CVEs
0
Critical
0
CISA KEV
0
Exploited

Plex vulnerabilities

CVEs affecting Plex, newest first. Open any entry for full detail, references, and exploit status.

5 CVEsRSS

CVE-2026-96651Medium· 6.5
today

Plex Media Server path traversal

Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/system/agents/media/get'. A remote attacker with a valid session token could read any fi…

SunlitPlex · Media Servervia CVEORG
CVE-2026-96656High· 7.2
today

Plex Media Server arbitrary file write

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so f…

TwilightPlex · Media Servervia CVEORG
CVE-2026-96654Medium· 6.5
today

Plex Media Server URL injection

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

SunlitPlex · Media Servervia CVEORG
CVE-2026-96652Medium· 4.3
today

Plex Media Server SSRF

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.

SunlitPlex · Media Servervia CVEORG
CVE-2026-96655Medium· 4.3
today

Plex Media Server arbitrary-host SSRF

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.

SunlitPlex · Media Servervia CVEORG
Plex vulnerabilities (CVEs) · VulnSea