Known Vulnerabilities for products from Plex
Listed below are 19 of the newest known vulnerabilities associated with the vendor "Plex".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-108264 json | Not Provided | 2026-10-09 | 2026-10-13 | |
| CVE-2026-96656 json | Not Provided | 2026-09-23 | 2026-09-23 | |
| CVE-2026-96655 json | Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via th... | Not Provided | 2026-09-23 | 2026-09-29 |
| CVE-2026-96654 json | Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker ... | Not Provided | 2026-09-23 | 2026-09-29 |
| CVE-2026-96652 json | Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can includ... | Not Provided | 2026-09-23 | 2026-09-29 |
| CVE-2026-96651 json | Not Provided | 2026-09-23 | 2026-09-23 | |
| CVE-2026-73291 json | Not Provided | 2026-08-12 | 2026-08-13 | |
| CVE-2026-54915 json | Not Provided | 2026-09-21 | 2026-09-24 | |
| CVE-2026-52835 json | Not Provided | 2026-09-21 | 2026-09-21 | |
| CVE-2026-49995 json | Not Provided | 2026-09-21 | 2026-09-22 | |
| CVE-2025-69417 json | In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve share tokens (i... | Not Provided | 2026-01-02 | 2026-10-07 |
| CVE-2025-69416 json | In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve other tokens (i... | Not Provided | 2026-01-02 | 2026-10-07 |
| CVE-2025-69415 json | In Plex Media Server (PMS) through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligne... | Not Provided | 2026-01-02 | 2026-10-07 |
| CVE-2025-69414 json | Plex Media Server (PMS) through 1.42.2.10156 allows retrieval of a permanent access token via a /myplex/account call with a t... | Not Provided | 2026-01-02 | 2026-10-07 |
| CVE-2021-42835 json | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new secur... | 7 - HIGH | 2021-12-08 | 2021-12-13 |
| CVE-2021-33959 json | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new secur... | 7.5 - HIGH | 2023-01-18 | 2023-08-08 |
| CVE-2020-5742 json | Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application req... | 8.8 - HIGH | 2020-06-15 | 2021-07-21 |
| CVE-2020-5741 json | Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrar... | 7.2 - HIGH | 2020-05-08 | 2021-12-14 |
| CVE-2020-5740 json | Improper Input Validation in Plex Media Server on Windows allows a local, unauthenticated attacker to execute arbitrary Pytho... | 7.8 - HIGH | 2020-04-22 | 2021-12-10 |
| CVE-2019-19141 json | The Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote authenticated users to write files any... | 8.8 - HIGH | 2019-12-19 | 2021-07-21 |
Known software with vulnerabilities from Plex
| Type | Vendor | Product | Version |
|---|---|---|---|
| Application | Plex | Media Server | - |
| Application | Plex | Plex Media Server | 0.9.9.2 |