Plex vulnerabilities
10 CVEs and advisories name Plex as an affected vendor, 4 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-96656Plex Media Server arbitrary file write
- CVE-2026-96655Plex Media Server arbitrary-host SSRF
- CVE-2026-96654Plex Media Server URL injection
- CVE-2026-96652Plex Media Server SSRF
- CVE-2026-96651Plex Media Server path traversal
- CVE-2025-69417In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve share tokens (intended for unr
- CVE-2025-69416In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve other tokens (intended for unr
- CVE-2025-69415In Plex Media Server (PMS) through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether
- CVE-2025-69414Plex Media Server (PMS) through 1.42.2.10156 allows retrieval of a permanent access token via a /myplex/account call with a transient access
- CVE-2025-34158Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/a