GhostLayer Insights

Subscribe

Plex

  • CVE-2026-96656

    Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options…

  • CVE-2026-96655

    Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the ‘/video/:/transcode/universal’ path parameter.

  • CVE-2026-96654

    Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in ‘searchOne,’ allowing an attacker to call other plugins’ functions…

  • CVE-2026-96652

    Plex Media Server before 1.43.3.10861 allows SSRF via ‘/player/timeline’. An attacker using any X-Plex-Token value can include a full URL in the…