Plex - vulnerabilities (CVEs)

21 CVEs in 4 products, 0 in the last 30 days, newest from 2026-09-23.

Products

Newest CVEs of Plex

CVE-2026-96656 - CVSS 8.6 (high), 2026-09-23: Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is…
CVE-2026-96655 - CVSS 5.3 (medium), 2026-09-23: Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal'…
CVE-2026-96654 - CVSS 6.9 (medium), 2026-09-23: Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions…
CVE-2026-96652 - CVSS 5.3 (medium), 2026-09-23: Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol'…
CVE-2026-96651 - CVSS 7.1 (high), 2026-09-23: Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via…
CVE-2025-69417 - CVSS 5 (medium), 2026-01-02: In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve share tokens (intended for unrelated access) via…
CVE-2025-69416 - CVSS 5 (medium), 2026-01-02: In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve other tokens (intended for unrelated access) via…
CVE-2025-69415 - CVSS 7.1 (high), 2026-01-02: In Plex Media Server (PMS) through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether the device is…
CVE-2025-69414 - CVSS 8.5 (high), 2026-01-02: Plex Media Server (PMS) through 1.42.2.10156 allows retrieval of a permanent access token via a /myplex/account call with a transient access token.
CVE-2025-34158 - CVSS 8.5 (high), 2025-08-21: Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides…
CVE-2025-34101 - CVSS 9.3 (critical), 2025-07-10: An unauthenticated command injection vulnerability exists in Serviio Media Server versions 1.4 through 1.8 on Windows, in the /rest/action API endpoint…
CVE-2021-33959 - CVSS 7.5 (high), 2023-01-18: Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service.
CVE-2021-42835 - CVSS 7 (high), 2021-12-08: An issue was discovered in Plex Media Server through 1.24.4.5081-e362dc1ee. An attacker (with a foothold in a endpoint via a low-privileged user account) can…
CVE-2020-5742 - CVSS 8.8 (high), 2020-06-15: Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application requests.
CVE-2020-5741 - CVSS 7.2 (high), 2020-05-08: Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code.
CVE-2020-5740 - CVSS 7.8 (high), 2020-04-22: Improper Input Validation in Plex Media Server on Windows allows a local, unauthenticated attacker to execute arbitrary Python code with SYSTEM privileges.
CVE-2019-19141 - CVSS 8.8 (high), 2019-12-19: The Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote authenticated users to write files anywhere the user account running…
CVE-2018-21031 - CVSS 6.5 (medium), 2019-11-18: Tautulli versions 2.1.38 and below allows remote attackers to bypass intended access control in Plex Media Server because the X-Plex-Token is mishandled and…
CVE-2018-13415 - CVSS 9.8 (critical), 2018-08-13: In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote,…
CVE-2014-9304 - CVSS 7.5 (high), 2014-12-07: Plex Media Server before 0.9.9.3 allows remote attackers to bypass the web server whitelist, conduct SSRF attacks, and execute arbitrary administrative…
CVE-2014-9181 - CVSS 5 (medium), 2014-12-02: Multiple directory traversal vulnerabilities in Plex Media Server before 0.9.9.3 allow remote attackers to read arbitrary files via a .. (dot dot) in the URI…