ZeusQA
Start free

Known exploited vulnerabilities

Plex vulnerabilities attackers have used

Every Plex vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.

The short answer

CISA lists 5 Plex vulnerabilities as exploited in the wild, 4 of them added in the last 12 months. The most recent is CVE-2026-96656, added Oct 20, 2026. Media Server has the most entries (5).

In KEV, all time
5
Added, last 12 months
4
Used in ransomware
0
New CVEs this week
0

Every Plex entry in CISA KEV

  1. CVE-2026-96656

    Added · due

    Plex Media Server External Control of File Name or Path Vulnerability

    Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654…

  2. CVE-2026-96655

    Added · due

    Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

    Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This…

  3. CVE-2026-96654

    Added · due

    Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability

    Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with…

  4. CVE-2026-96652

    Added · due

    Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

    Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's…

  5. CVE-2020-5741

    Added · due

    Plex Media Server Remote Code Execution Vulnerability

    Plex Media Server contains a remote code execution vulnerability that allows an attacker with access to the server administrator's Plex account to upload a malicious file via the Camera Upload feature and have the media server execute it.

Related

Know the day a CVE lands in your code

Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.

Start freeSee how a run works