PL
Vendor
Plex
19
CVEs
5
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-96656 In wildKEV | MS Media Server Plex | 7.2 | Sep 23 | Plex Media Server arbitrary file write |
| CVE-2026-96655 In wildKEV | MS Media Server Plex | 4.3 | Sep 23 | Plex Media Server arbitrary-host SSRF |
| CVE-2026-96654 In wildKEV | MS Media Server Plex | 6.5 | Sep 23 | Plex Media Server URL injection |
| CVE-2026-96652 In wildKEV | MS Media Server Plex | 4.3 | Sep 23 | Plex Media Server SSRF |
| CVE-2026-96651 | MS Media Server Plex | 6.5 | Sep 23 | Plex Media Server path traversal |
| CVE-2025-69417 | MS Media Server Plex | 4.3 | Jan 2 | In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve share tokens (intended for unrelated access) via a shared_servers… |
| CVE-2025-69416 | MS Media Server Plex | 4.3 | Jan 2 | In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve other tokens (intended for unrelated access) via… |
| CVE-2025-69415 | MS Media Server Plex | 7.1 | Jan 2 | In Plex Media Server (PMS) through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether the device is currently associated with… |
| CVE-2025-69414 | MS Media Server Plex | 7.1 | Jan 2 | Plex Media Server (PMS) through 1.42.2.10156 allows retrieval of a permanent access token via a /myplex/account call with a transient access token |
| CVE-2021-33959 | MS Media Server Plex | 7.5 | Jan 18 | Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service |
| CVE-2021-42835 | MS Media Server Plex | 7.0 | Dec 8 | An issue was discovered in Plex Media Server through 1.24.4.5081-e362dc1ee |
| CVE-2020-5742 | MS Media Server Plex | 8.8 | Jun 15 | Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application requests |
| CVE-2020-5741 In wildKEV | MS Media Server Plex | 7.2 | May 8 | Plex Media Server Remote Code Execution Vulnerability |
| CVE-2020-5740 | MS Media Server Plex | 7.8 | Apr 22 | Improper Input Validation in Plex Media Server on Windows allows a local, unauthenticated attacker to execute arbitrary Python code with SYSTEM privileges |
| CVE-2019-19141 | MS Media Server Plex | 8.8 | Dec 19 | The Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote authenticated users to write files anywhere the user account running the Plex Media Server… |
| CVE-2018-21031 | MS Media Server Plex | 6.5 | Nov 18 | Tautulli versions 2.1.38 and below allows remote attackers to bypass intended access control in Plex Media Server because the X-Plex-Token is mishandled and can be retrieved from… |
| CVE-2018-13415 | MS Media Server Plex | 9.8 | Aug 13 | In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack |
| CVE-2014-9304 | MS Media Server Plex | – | Dec 7 | Plex Media Server before 0.9.9.3 allows remote attackers to bypass the web server whitelist, conduct SSRF attacks, and execute arbitrary administrative actions via multiple… |
| CVE-2014-9181 | MS Media Server Plex | – | Dec 2 | Multiple directory traversal vulnerabilities in Plex Media Server before 0.9.9.3 allow remote attackers to read arbitrary files via a |