CVE-2026-96654

Vendor

Plex

Product

Media Server

CVSS

6.5

EPSS

0.019 (p80)

CISA KEV

added 20 Oct 2026, due 23 Oct 2026 (9d overdue)

Weakness

CWE-84

Exposure class

Collaboration

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 65
   KEV NVD 23 Sep 2026

   Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability

   Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be…

   KEV · due 23 Oct 2026 (overdue) CVSS 6.5 Fix available CVE-2026-96654 Plex
2. 52
   CISA alert CISA 11d ago

   CISA Adds Six Known Exploited Vulnerabilities to Catalog

   CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability…

   Exploited CVE-2026-96652CVE-2026-96654CVE-2026-96655+3 more