VulnCheck KEV: CVE-2026-96655

Plex Media Server contains a server-side request forgery SSRF vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and...

CVE-2026-96655 Plex Media Server arbitrary-host SSRF

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter...

CVE-2026-96655

Plex Media Server versions prior to 1.43.3.10861 are vulnerable to a Server-Side Request Forgery (SSRF) flaw (CWE-918). An authenticated user can leverage the /video/:/transcode/universal path parameter to force the server to request arbitrary internal or external addresses. This vulnerability is...

EUVD-2026-85369

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter...

CVE-2026-96655 Plex Media Server arbitrary-host SSRF

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter...

PT-2026-97405

Name of the Vulnerable Software and Affected Versions Plex Media Server versions prior to 1.43.3.10861 Description An authenticated user can perform a Server-Side Request Forgery SSRF, which occurs when a server is tricked into making requests to an unintended location. This is possible by...

Plex Media Server server-side request forgeing vulnerability

Versions of Plex Media Server prior to 1.43.3.10861 have a vulnerability related to server-side request forgery. This vulnerability stems from improper handling of the '/video/:/transcode/universal' path parameter. It may allow authenticated users to request arbitrary internal or external...