MS
Product
Media Server
On CISA KEVExploited in the wild
19
CVEs
5
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 9Medium 7Low 0
Watch
Add Media Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-96656 In wildKEV | 7.2 | Sep 23 | Plex Media Server arbitrary file write Affected: before 1.43.3.10861 |
| CVE-2020-5741 In wildKEV | 7.2 | May 8 | Plex Media Server Remote Code Execution Vulnerability Affected: before 1.19.3 |
| CVE-2020-5742 | 8.8 | Jun 15 | Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application requests Affected: before 2020-06-15 |
| CVE-2019-19141 | 8.8 | Dec 19 | The Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote authenticated users to write files anywhere the user account running the Plex Media Server… Affected: through 1.18.2.2029 |
| CVE-2020-5740 | 7.8 | Apr 22 | Improper Input Validation in Plex Media Server on Windows allows a local, unauthenticated attacker to execute arbitrary Python code with SYSTEM privileges Affected: before 1.19.1.2701 |
| CVE-2021-33959 | 7.5 | Jan 18 | Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service Affected: through 1.21 |
| CVE-2025-69415 | 7.1 | Jan 2 | In Plex Media Server (PMS) through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether the device is currently associated with… Affected: through 1.42.2.10156 |
| CVE-2025-69414 | 7.1 | Jan 2 | Plex Media Server (PMS) through 1.42.2.10156 allows retrieval of a permanent access token via a /myplex/account call with a transient access token Affected: through 1.42.2.10156 |
| CVE-2021-42835 | 7.0 | Dec 8 | An issue was discovered in Plex Media Server through 1.24.4.5081-e362dc1ee Affected: before 1.25.0.5282 |
Showing 9