Plex Media Server

Name: Plex Media Server
Brand: Plex

productRU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

critical

by severity

0critical3high0medium0low

updated 2026-10-28

vulnerabilities (9)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2020-5741US	high7.2OT critical	72.8% (99th)	KEV	no fix	2020-05-08	≤ 1.19.3
CVE-2026-96652US	—OT critical	1.82% (79th)	KEV	1.43.3.10861	2026-09-23	2 versions
CVE-2026-96656US	—OT critical	1.79% (78th)	KEV	1.43.3.10861	2026-09-23	2 versions
CVE-2026-96654US	—OT critical	1.95% (80th)	KEV	1.43.3.10861	2026-09-23	2 versions
CVE-2026-96655US	—OT critical	1.64% (76th)	KEV	1.43.3.10861	2026-09-23	2 versions
CVE-2025-34158US	—	0.59% (48th)	Exploit	1.42.1	2025-08-21	1.41.7.x → 1.42.1
CVE-2026-96651US	—	0.83% (57th)	—	1.43.3.10861	2026-09-23	2 versions
CVE-2025-69415US	high7.1	0.28% (21st)	—	no fix	2026-01-02	≤ 0 ≤1.42.2.10156
CVE-2025-69414US	high7.1OT elevated	0.25% (16th)	—	no fix	2026-01-02	≤ 0 ≤1.42.2.10156

The flaw types (CWEs) most of these CVEs share.

CWE-918Server-Side Request Forgery (SSRF)2 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1 CVEs
CWE-502Deserialization of Untrusted Data1 CVEs
CWE-669Incorrect Resource Transfer Between Spheres1 CVEs
CWE-672Operation on a Resource after Expiration or Release1 CVEs
CWE-73External Control of File Name or Path1 CVEs
CWE-84Improper Neutralization of Encoded URI Schemes in a Web Page1 CVEs
CWE-863Incorrect Authorization1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.