Vendor

Plex

10 known vulnerabilities.

Products

Media Server 8 plex.tv backend 2

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

Medium 4.3

CVE-2026-96652 Exploited Public exploit EPSS 12%

Plex Media Server SSRF

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.

Plex Media Server

Sep 23, 2026
KEV Oct 20, 2026