MS
Product
Media Server
On CISA KEVExploited in the wild
19
CVEs
5
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 9Medium 7Low 0
Watch
Add Media Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-96654 In wildKEV | 6.5 | Sep 23 | Plex Media Server URL injection Affected: before 1.43.3.10861 |
| CVE-2026-96655 In wildKEV | 4.3 | Sep 23 | Plex Media Server arbitrary-host SSRF Affected: before 1.43.3.10861 |
| CVE-2026-96652 In wildKEV | 4.3 | Sep 23 | Plex Media Server SSRF Affected: before 1.43.3.10861 |
| CVE-2026-96651 | 6.5 | Sep 23 | Plex Media Server path traversal Affected: before 1.43.3.10861 |
| CVE-2018-21031 | 6.5 | Nov 18 | Tautulli versions 2.1.38 and below allows remote attackers to bypass intended access control in Plex Media Server because the X-Plex-Token is mishandled and can be retrieved from… Affected: 1.18.2.2029-36236cc4c |
| CVE-2025-69417 | 4.3 | Jan 2 | In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve share tokens (intended for unrelated access) via a shared_servers… Affected: through 1.43.0.10389 |
| CVE-2025-69416 | 4.3 | Jan 2 | In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve other tokens (intended for unrelated access) via… Affected: through 1.43.0.10389 |
Showing 7