Medium severity6.5NVD Advisory· Published Sep 23, 2026· Updated Sep 23, 2026

CVE-2026-96654

Description

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Plexcor/Plex Media Serverllm-create
Range: <1.43.3.10861

Patches

Vulnerability mechanics

References

forums.plex.tv/t/plex-media-server/30447/711nvd
raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.jsonnvd
www.cve.org/CVERecordnvd
zmain.info/blog/plex2shellnvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000