CVE-2026-96655

MEDIUM4.3

CISA KEV

Published 2026-09-23 · Updated 2026-10-21 · Source 9119a7d8-5eab-497f-8521-727c672e3725

Summary

CVE-2026-96655 is a medium-severity (CVSS 4.3) vulnerability in Plex Media Server. CISA added it to the Known Exploited Vulnerabilities catalog on October 20, 2026, which means exploitation in the wild has been confirmed; US federal agencies must remediate it by November 3, 2026. CISA does not currently list it as used in ransomware campaigns.

All 1 known-exploited Plex vulnerabilities →

Description

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE-918

CISA Known-Exploited Vulnerability

Product: Plex — Media Server

Name: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

Date added: 2026-10-20 · Due: 2026-11-03

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

References

View on NVD

More exploited Plex vulnerabilities

Most recently added to CISA KEV

CVE-2026-96656
Media Server — Plex Media Server External Control of File Name or Path Vulnerability
added 2026-10-20
CVE-2026-96654
Media Server — Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
added 2026-10-20
CVE-2026-96652
Media Server — Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
added 2026-10-20
CVE-2020-5741
Media Server — Plex Media Server Remote Code Execution Vulnerability
added 2023-03-10

View all →

Related CVEs

Same severity, most recent

CVE-2026-92824
A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an out-of-bounds read during YAML serialization, typically causing a crash and resulting in a denial of service.
2026-10-21 · score 6.2
CVE-2026-92823
A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service.
2026-10-21 · score 6.2
CVE-2026-92822
A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption, resulting in a denial of service.
2026-10-21 · score 6.2
CVE-2026-114039
A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is the function mysqli_query of the file report_search.php. Executing a manipulation of the argument dateto/datefrom can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
2026-10-21 · score 6.3
CVE-2026-113743
A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function load_hf_state_dict_filtered of the file models/tt_transformers/tt/load_checkpoints.py. This manipulation of the argument weight_map causes path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.81.0-dev20261016 is sufficient to fix this issue. Patch name: 4851ccf347f6903c3d819eed60705600386e52c3. It is suggested to upgrade the affected component.
2026-10-21 · score 6.3