MS
Product
Media Server
On CISA KEVExploited in the wild
19
CVEs
5
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 9Medium 7Low 0
Watch
Add Media Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-96656 In wildKEV | 7.2 | Sep 23 | Plex Media Server arbitrary file write Affected: before 1.43.3.10861 |
| CVE-2020-5741 In wildKEV | 7.2 | May 8 | Plex Media Server Remote Code Execution Vulnerability Affected: before 1.19.3 |
| CVE-2026-96654 In wildKEV | 6.5 | Sep 23 | Plex Media Server URL injection Affected: before 1.43.3.10861 |
| CVE-2026-96655 In wildKEV | 4.3 | Sep 23 | Plex Media Server arbitrary-host SSRF Affected: before 1.43.3.10861 |
| CVE-2026-96652 In wildKEV | 4.3 | Sep 23 | Plex Media Server SSRF Affected: before 1.43.3.10861 |
| CVE-2018-13415 | 9.8 | Aug 13 | In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack Affected: 1.13.2.5154 |
| CVE-2020-5742 | 8.8 | Jun 15 | Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application requests Affected: before 2020-06-15 |
| CVE-2019-19141 | 8.8 | Dec 19 | The Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote authenticated users to write files anywhere the user account running the Plex Media Server… Affected: through 1.18.2.2029 |
| CVE-2020-5740 | 7.8 | Apr 22 | Improper Input Validation in Plex Media Server on Windows allows a local, unauthenticated attacker to execute arbitrary Python code with SYSTEM privileges Affected: before 1.19.1.2701 |
| CVE-2021-33959 | 7.5 | Jan 18 | Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service Affected: through 1.21 |
| CVE-2025-69415 | 7.1 | Jan 2 | In Plex Media Server (PMS) through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether the device is currently associated with… Affected: through 1.42.2.10156 |
| CVE-2025-69414 | 7.1 | Jan 2 | Plex Media Server (PMS) through 1.42.2.10156 allows retrieval of a permanent access token via a /myplex/account call with a transient access token Affected: through 1.42.2.10156 |
| CVE-2021-42835 | 7.0 | Dec 8 | An issue was discovered in Plex Media Server through 1.24.4.5081-e362dc1ee Affected: before 1.25.0.5282 |
| CVE-2026-96651 | 6.5 | Sep 23 | Plex Media Server path traversal Affected: before 1.43.3.10861 |
| CVE-2018-21031 | 6.5 | Nov 18 | Tautulli versions 2.1.38 and below allows remote attackers to bypass intended access control in Plex Media Server because the X-Plex-Token is mishandled and can be retrieved from… Affected: 1.18.2.2029-36236cc4c |
| CVE-2025-69417 | 4.3 | Jan 2 | In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve share tokens (intended for unrelated access) via a shared_servers… Affected: through 1.43.0.10389 |
| CVE-2025-69416 | 4.3 | Jan 2 | In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve other tokens (intended for unrelated access) via… Affected: through 1.43.0.10389 |
| CVE-2014-9304 | – | Dec 7 | Plex Media Server before 0.9.9.3 allows remote attackers to bypass the web server whitelist, conduct SSRF attacks, and execute arbitrary administrative actions via multiple… Affected: through 0.9.9.2 |
| CVE-2014-9181 | – | Dec 2 | Multiple directory traversal vulnerabilities in Plex Media Server before 0.9.9.3 allow remote attackers to read arbitrary files via a Affected: through 0.9.9.2 |
Showing 19