Security1 hOctober 25, 2026, 18:04

Plex Media Server CVE-2026-96654: searchOne URL injection

Plex Media Server before 1.43.3.10861 fails to neutralize URL values in searchOne, letting an unauthenticated attacker invoke other plugins' functions with attacker-supplied parameters. CVSS is 6.5; the fix is the 1.43.3.10861 update.

DEV Community

Open source

CVSS v3.1 score 6.5, v4.0 6.9; remote, no auth or user interaction
Affects Plex Media Server builds below 1.43.3.10861
Impact depends on which plugins are installed
ZoomEye returned 507,974 Plex Media Server matches

#Plex

CVE-2026-96656 in Plex Media Server lets an admin write and execute arbitrary code

Security

Plex Media Server SSRF flaw CVE-2026-96652 lets attackers force outbound requests

Security

NetScaler policy bypass via URL expressions in CVE-2026-88774

Security

Plex Media Server CVE-2026-96654: searchOne URL injection

CVE-2026-96656 in Plex Media Server lets an admin write and execute arbitrary code

Plex Media Server SSRF flaw CVE-2026-96652 lets attackers force outbound requests

NetScaler policy bypass via URL expressions in CVE-2026-88774

NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 spawn superusers and hide in CSS URLs