# cve.now: Plex

The newest entries naming Plex as an affected vendor (up to 200), of 10 in all, 4 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-96656](https://cve.now/CVE-2026-96656.md): Plex Media Server arbitrary file write (CVSS 8.6, KEV)
- [CVE-2026-96655](https://cve.now/CVE-2026-96655.md): Plex Media Server arbitrary-host SSRF (CVSS 4.3, KEV)
- [CVE-2026-96654](https://cve.now/CVE-2026-96654.md): Plex Media Server URL injection (CVSS 6.9, KEV)
- [CVE-2026-96652](https://cve.now/CVE-2026-96652.md): Plex Media Server SSRF (CVSS 4.3, KEV)
- [CVE-2026-96651](https://cve.now/CVE-2026-96651.md): Plex Media Server path traversal (CVSS 6.5)
- [CVE-2025-69417](https://cve.now/CVE-2025-69417.md): In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve share tokens (intended for unr (CVSS 5.0)
- [CVE-2025-69416](https://cve.now/CVE-2025-69416.md): In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve other tokens (intended for unr (CVSS 5.0)
- [CVE-2025-69415](https://cve.now/CVE-2025-69415.md): In Plex Media Server (PMS) through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether (CVSS 7.1)
- [CVE-2025-69414](https://cve.now/CVE-2025-69414.md): Plex Media Server (PMS) through 1.42.2.10156 allows retrieval of a permanent access token via a /myplex/account call with a transient access (CVSS 8.5)
- [CVE-2025-34158](https://cve.now/CVE-2025-34158.md): Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/a (CVSS 8.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/plex
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.