{"total":4,"items":[{"id":1741,"title":"CVE-2026-96652: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","original_title":"CVE-2026-96652: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","source_rating":null,"summary":"Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-20","ai":false,"actions":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96652","type":"kev","language":"en","published_at":"2026-10-20T00:00:00+00:00","severity":"middel","priority":40,"vendors":["Plex"],"cves":[{"id":"CVE-2026-96652","cvss":5.3,"epss":0.00222,"epss_percentile":0.11974,"in_kev":true,"kev_ransomware":false}],"cve_count":1,"in_kev":true,"exploited_by":["CISA KEV","ENISA EUVD"],"kev_ransomware":false,"cvss_max":5.3,"epss_max":0.00222,"source_count":1,"ncsc":null,"source":{"slug":"cisa-kev","name":"CISA Known Exploited Vulnerabilities","category":"vulnerability","country":"US","license":"Publiek domein (US-overheid)","reuse":"open"},"bundle":null},{"id":1739,"title":"CVE-2026-96655: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","original_title":"CVE-2026-96655: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","source_rating":null,"summary":"Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.\n\nVere","ai":false,"actions":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96655","type":"kev","language":"en","published_at":"2026-10-20T00:00:00+00:00","severity":"middel","priority":40,"vendors":["Plex"],"cves":[{"id":"CVE-2026-96655","cvss":5.3,"epss":0.00222,"epss_percentile":0.11974,"in_kev":true,"kev_ransomware":false}],"cve_count":1,"in_kev":true,"exploited_by":["CISA KEV","ENISA EUVD"],"kev_ransomware":false,"cvss_max":5.3,"epss_max":0.00222,"source_count":1,"ncsc":null,"source":{"slug":"cisa-kev","name":"CISA Known Exploited Vulnerabilities","category":"vulnerability","country":"US","license":"Publiek domein (US-overheid)","reuse":"open"},"bundle":null},{"id":1740,"title":"CVE-2026-96654: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability","original_title":"CVE-2026-96654: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability","source_rating":null,"summary":"Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.\n\nVereiste actie: Apply mitiga","ai":false,"actions":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96654","type":"kev","language":"en","published_at":"2026-10-20T00:00:00+00:00","severity":"middel","priority":40,"vendors":["Plex"],"cves":[{"id":"CVE-2026-96654","cvss":6.9,"epss":0.00227,"epss_percentile":0.12576,"in_kev":true,"kev_ransomware":false}],"cve_count":1,"in_kev":true,"exploited_by":["CISA KEV","ENISA EUVD"],"kev_ransomware":false,"cvss_max":6.9,"epss_max":0.00227,"source_count":1,"ncsc":null,"source":{"slug":"cisa-kev","name":"CISA Known Exploited Vulnerabilities","category":"vulnerability","country":"US","license":"Publiek domein (US-overheid)","reuse":"open"},"bundle":null},{"id":1738,"title":"CVE-2026-96656: Plex Media Server External Control of File Name or Path Vulnerability","original_title":"CVE-2026-96656: Plex Media Server External Control of File Name or Path Vulnerability","source_rating":null,"summary":"Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.\n\nVereiste actie: Apply mitigations in accordance with vendor i","ai":false,"actions":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96656","type":"kev","language":"en","published_at":"2026-10-20T00:00:00+00:00","severity":"hoog","priority":48,"vendors":["Plex"],"cves":[{"id":"CVE-2026-96656","cvss":8.6,"epss":0.00396,"epss_percentile":0.32349,"in_kev":true,"kev_ransomware":false}],"cve_count":1,"in_kev":true,"exploited_by":["CISA KEV","ENISA EUVD"],"kev_ransomware":false,"cvss_max":8.6,"epss_max":0.00396,"source_count":1,"ncsc":null,"source":{"slug":"cisa-kev","name":"CISA Known Exploited Vulnerabilities","category":"vulnerability","country":"US","license":"Publiek domein (US-overheid)","reuse":"open"},"bundle":null}]}