CVE-2026-96654

MEDIUM6.5

CISA KEV

Published 2026-09-23 · Updated 2026-10-21 · Source 9119a7d8-5eab-497f-8521-727c672e3725

Summary

CVE-2026-96654 is a medium-severity (CVSS 6.5) vulnerability in Plex Media Server. CISA added it to the Known Exploited Vulnerabilities catalog on October 20, 2026, which means exploitation in the wild has been confirmed; US federal agencies must remediate it by October 23, 2026. CISA does not currently list it as used in ransomware campaigns.

All 1 known-exploited Plex vulnerabilities →

Description

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-84

CISA Known-Exploited Vulnerability

Product: Plex — Media Server

Name: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability

Date added: 2026-10-20 · Due: 2026-10-23

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

References

View on NVD

More exploited Plex vulnerabilities

Most recently added to CISA KEV

CVE-2026-96656
Media Server — Plex Media Server External Control of File Name or Path Vulnerability
added 2026-10-20
CVE-2026-96655
Media Server — Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
added 2026-10-20
CVE-2026-96652
Media Server — Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
added 2026-10-20
CVE-2020-5741
Media Server — Plex Media Server Remote Code Execution Vulnerability
added 2023-03-10

View all →

Related CVEs

Same severity, most recent

CVE-2026-113743
A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function load_hf_state_dict_filtered of the file models/tt_transformers/tt/load_checkpoints.py. This manipulation of the argument weight_map causes path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.81.0-dev20261016 is sufficient to fix this issue. Patch name: 4851ccf347f6903c3d819eed60705600386e52c3. It is suggested to upgrade the affected component.
2026-10-21 · score 6.3
CVE-2026-114118
Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtraction without first checking that code_offset is below the blueprint's code size, so a huge offset wraps to a small positive value. An attacker controlling code_offset can make a factory deploy contracts with no runtime code, potentially trapping ETH and tokens.
2026-10-21 · score 4.8
CVE-2026-114117
Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas (the default) or -O codesize. Affected contracts use the wrong value in storage writes, arithmetic, indexes, return values, or events without warning or revert, which can record deposits incorrectly and lock funds.
2026-10-21 · score 5.9
CVE-2026-114116
Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants.
2026-10-21 · score 5.3
CVE-2026-114114
Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric literals. An attacker contributing source with non-ASCII identifiers that NFKC-normalize to ASCII, or an invisible byte-order mark, can silently substitute addresses, integers or other constants in compiled code.
2026-10-21 · score 5.3