CVE-2026-96655

Vendor

Plex

Product

Media Server

CVSS

4.3

EPSS

0.016 (p76)

CISA KEV

added 20 Oct 2026, due 3 Nov 2026 (2d)

Weakness

CWE-918

Exposure class

Collaboration

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 65
   KEV NVD 23 Sep 2026

   Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

   Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This…

   KEV · due 3 Nov 2026 CVSS 4.3 Fix available CVE-2026-96655 Plex
2. 52
   CISA alert CISA 11d ago

   CISA Adds Six Known Exploited Vulnerabilities to Catalog

   CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability…

   Exploited CVE-2026-96652CVE-2026-96654CVE-2026-96655+3 more