{
  "schemaVersion": 1,
  "site": "https://cveboard.org",
  "generatedAt": "2026-10-23T19:16:01.075Z",
  "lastRun": "2026-10-23T19:01:02.861Z",
  "liveDays": 14,
  "filters": {
    "kind": null,
    "exploited": false,
    "severity": null,
    "ecosystems": [],
    "tag": "plex"
  },
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "incidents": [
    {
      "id": "cve-2026-96656",
      "url": "https://cveboard.org/i/cve-2026-96656",
      "urlPt": "https://cveboard.org/pt/i/cve-2026-96656",
      "json": "https://cveboard.org/i/cve-2026-96656.json",
      "kind": "vuln",
      "live": true,
      "knownExploited": true,
      "severity": "high",
      "title": "Plex Media Server External Control of File Name or Path Vulnerability",
      "summary": "Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.",
      "titlePt": "Plex Media Server Vulnerabilidade de Controle Externo de Nome ou Caminho de Arquivo",
      "summaryPt": "Plex Media Server contém uma vulnerabilidade de controle externo de nome ou caminho de arquivo que pode permitir que um usuário administrador escreva arquivos arbitrários que podem ser executados ao serem carregados. Esta vulnerabilidade pode ser encadeada com CVE-2026-96652, CVE-2026-96654 e CVE-2026-96655.",
      "affected": [
        {
          "vendor": "Plex",
          "product": "Media Server",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "0",
              "status": "affected",
              "lessThan": "1.43.3.10861",
              "lessThanOrEqual": null
            },
            {
              "version": "1.43.3.10861",
              "status": "unaffected",
              "lessThan": null,
              "lessThanOrEqual": null
            }
          ],
          "omitted": 0,
          "fixed": [
            "1.43.3.10861"
          ]
        }
      ],
      "omitted": 0,
      "references": [],
      "cwes": [
        {
          "id": "CWE-73",
          "name": "External Control of File Name or Path"
        }
      ],
      "ssvc": {
        "exploitation": "active",
        "automatable": "no",
        "impact": "total",
        "at": "2026-10-19T00:00:00.000Z"
      },
      "fix": "listed",
      "tags": [
        "plex"
      ],
      "cves": [
        "CVE-2026-96656"
      ],
      "ghsa": null,
      "cvss": {
        "score": 8.6,
        "version": "4.0",
        "by": "cisa-cg"
      },
      "epss": {
        "percentage": 0.00816,
        "percentile": 0.56677,
        "asOf": "2026-10-23",
        "by": "FIRST"
      },
      "packages": [],
      "vendor": "Plex",
      "product": "Media Server",
      "kev": {
        "dateAdded": "2026-10-20",
        "dueDate": "2026-10-23",
        "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.",
        "ransomware": false
      },
      "breach": null,
      "retracted": false,
      "sources": [
        {
          "label": "CISA KEV",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-96656"
        }
      ],
      "publishedAt": "2026-10-20T00:00:00.000Z",
      "updatedAt": "2026-10-20T00:00:00.000Z"
    },
    {
      "id": "cve-2026-96655",
      "url": "https://cveboard.org/i/cve-2026-96655",
      "urlPt": "https://cveboard.org/pt/i/cve-2026-96655",
      "json": "https://cveboard.org/i/cve-2026-96655.json",
      "kind": "vuln",
      "live": true,
      "knownExploited": true,
      "severity": "moderate",
      "title": "Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability",
      "summary": "Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.",
      "titlePt": "Vulnerabilidade de falsificação de solicitação do lado do servidor (SSRF) do Plex Media Server",
      "summaryPt": "O Plex Media Server contém uma vulnerabilidade de falsificação de solicitação do lado do servidor (SSRF) que pode permitir que um usuário autenticado solicite endereços internos ou externos arbitrários via o parâmetro de caminho '/video/:/transcode/universal'. Esta vulnerabilidade pode ser encadeada com CVE-2026-96652, CVE-2026-96654 e CVE-2026-96656.",
      "affected": [
        {
          "vendor": "Plex",
          "product": "Media Server",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "0",
              "status": "affected",
              "lessThan": "1.43.3.10861",
              "lessThanOrEqual": null
            },
            {
              "version": "1.43.3.10861",
              "status": "unaffected",
              "lessThan": null,
              "lessThanOrEqual": null
            }
          ],
          "omitted": 0,
          "fixed": [
            "1.43.3.10861"
          ]
        }
      ],
      "omitted": 0,
      "references": [],
      "cwes": [
        {
          "id": "CWE-918",
          "name": "Server-Side Request Forgery (SSRF)"
        }
      ],
      "ssvc": {
        "exploitation": "active",
        "automatable": "no",
        "impact": "partial",
        "at": "2026-10-20T00:00:00.000Z"
      },
      "fix": "listed",
      "tags": [
        "plex"
      ],
      "cves": [
        "CVE-2026-96655"
      ],
      "ghsa": null,
      "cvss": {
        "score": 5.3,
        "version": "4.0",
        "by": "cisa-cg"
      },
      "epss": {
        "percentage": 0.00455,
        "percentile": 0.3856,
        "asOf": "2026-10-23",
        "by": "FIRST"
      },
      "packages": [],
      "vendor": "Plex",
      "product": "Media Server",
      "kev": {
        "dateAdded": "2026-10-20",
        "dueDate": "2026-11-03",
        "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.",
        "ransomware": false
      },
      "breach": null,
      "retracted": false,
      "sources": [
        {
          "label": "CISA KEV",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-96655"
        }
      ],
      "publishedAt": "2026-10-20T00:00:00.000Z",
      "updatedAt": "2026-10-20T00:00:00.000Z"
    },
    {
      "id": "cve-2026-96654",
      "url": "https://cveboard.org/i/cve-2026-96654",
      "urlPt": "https://cveboard.org/pt/i/cve-2026-96654",
      "json": "https://cveboard.org/i/cve-2026-96654.json",
      "kind": "vuln",
      "live": true,
      "knownExploited": true,
      "severity": "moderate",
      "title": "Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability",
      "summary": "Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.",
      "titlePt": "Vulnerabilidade de neutralização inadequada de esquemas de URI codificados em uma página web no Plex Media Server",
      "summaryPt": "Plex Media Server contém uma vulnerabilidade de neutralização inadequada de esquemas de URI codificados em uma página web que poderia permitir que um atacante chame funções de outros plugins e forneça seus próprios parâmetros. Essa vulnerabilidade pode ser encadeada com CVE-2026-96652, CVE-2026-96655 e CVE-2026-96656.",
      "affected": [
        {
          "vendor": "Plex",
          "product": "Media Server",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "0",
              "status": "affected",
              "lessThan": "1.43.3.10861",
              "lessThanOrEqual": null
            },
            {
              "version": "1.43.3.10861",
              "status": "unaffected",
              "lessThan": null,
              "lessThanOrEqual": null
            }
          ],
          "omitted": 0,
          "fixed": [
            "1.43.3.10861"
          ]
        }
      ],
      "omitted": 0,
      "references": [],
      "cwes": [
        {
          "id": "CWE-84",
          "name": "Improper Neutralization of Encoded URI Schemes in a Web Page"
        }
      ],
      "ssvc": {
        "exploitation": "active",
        "automatable": "yes",
        "impact": "partial",
        "at": "2026-10-20T00:00:00.000Z"
      },
      "fix": "listed",
      "tags": [
        "plex"
      ],
      "cves": [
        "CVE-2026-96654"
      ],
      "ghsa": null,
      "cvss": {
        "score": 6.9,
        "version": "4.0",
        "by": "cisa-cg"
      },
      "epss": {
        "percentage": 0.00465,
        "percentile": 0.39325,
        "asOf": "2026-10-23",
        "by": "FIRST"
      },
      "packages": [],
      "vendor": "Plex",
      "product": "Media Server",
      "kev": {
        "dateAdded": "2026-10-20",
        "dueDate": "2026-10-23",
        "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.",
        "ransomware": false
      },
      "breach": null,
      "retracted": false,
      "sources": [
        {
          "label": "CISA KEV",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-96654"
        }
      ],
      "publishedAt": "2026-10-20T00:00:00.000Z",
      "updatedAt": "2026-10-20T00:00:00.000Z"
    },
    {
      "id": "cve-2026-96652",
      "url": "https://cveboard.org/i/cve-2026-96652",
      "urlPt": "https://cveboard.org/pt/i/cve-2026-96652",
      "json": "https://cveboard.org/i/cve-2026-96652.json",
      "kind": "vuln",
      "live": true,
      "knownExploited": true,
      "severity": "moderate",
      "title": "Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability",
      "summary": "Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.",
      "titlePt": "Vulnerabilidade de falsificação de solicitação do lado do servidor (SSRF) no Plex Media Server",
      "summaryPt": "O Plex Media Server contém uma vulnerabilidade de falsificação de solicitação do lado do servidor (SSRF) que poderia permitir que um atacante, utilizando qualquer valor de X-Plex-Token, inclua uma URL completa no parâmetro 'protocol' e force o servidor Plex a enviar uma requisição POST para o destino escolhido pelo atacante. Esta vulnerabilidade pode ser encadeada com CVE-2026-96654, CVE-2026-96655 e CVE-2026-96656.",
      "affected": [
        {
          "vendor": "Plex",
          "product": "Media Server",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "0",
              "status": "affected",
              "lessThan": "1.43.3.10861",
              "lessThanOrEqual": null
            },
            {
              "version": "1.43.3.10861",
              "status": "unaffected",
              "lessThan": null,
              "lessThanOrEqual": null
            }
          ],
          "omitted": 0,
          "fixed": [
            "1.43.3.10861"
          ]
        }
      ],
      "omitted": 0,
      "references": [],
      "cwes": [
        {
          "id": "CWE-918",
          "name": "Server-Side Request Forgery (SSRF)"
        }
      ],
      "ssvc": {
        "exploitation": "active",
        "automatable": "no",
        "impact": "partial",
        "at": "2026-10-20T00:00:00.000Z"
      },
      "fix": "listed",
      "tags": [
        "plex"
      ],
      "cves": [
        "CVE-2026-96652"
      ],
      "ghsa": null,
      "cvss": {
        "score": 5.3,
        "version": "4.0",
        "by": "cisa-cg"
      },
      "epss": {
        "percentage": 0.00455,
        "percentile": 0.38559,
        "asOf": "2026-10-23",
        "by": "FIRST"
      },
      "packages": [],
      "vendor": "Plex",
      "product": "Media Server",
      "kev": {
        "dateAdded": "2026-10-20",
        "dueDate": "2026-11-03",
        "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.",
        "ransomware": false
      },
      "breach": null,
      "retracted": false,
      "sources": [
        {
          "label": "CISA KEV",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-96652"
        }
      ],
      "publishedAt": "2026-10-20T00:00:00.000Z",
      "updatedAt": "2026-10-20T00:00:00.000Z"
    }
  ],
  "tag": {
    "tag": "plex",
    "name": "Plex",
    "kev": {
      "name": "Plex",
      "total": 5,
      "last": "2026-10-20"
    }
  }
}