Plex Media Server 安全漏洞

Plex Media Server is a suite of media player and media server software from the Swiss company Plex. A security vulnerability exists in Plex Media Server version 2025-12-31 and earlier, which stems from a non-server device token in the plex.tv backend that can retrieve shared tokens via the...

Plex media server 安全漏洞

Plex media server is a media player from Plex. A security vulnerability exists in Plex Media Server version 2025-12-31 and earlier, which stems from a non-server device token in the plex.tv backend that can retrieve other tokens via clients.plex.tv/devices.xml, which could lead to token disclosur...

PT-2026-1110

Name of the Vulnerable Software and Affected Versions Plex Media Server versions through 2025-12-31 Description A non-server device token can retrieve other tokens intended for unrelated access via the clients.plex.tv/devices.xml endpoint. This impacts the Plex Media Server backend. Recommendatio...

PT-2026-1106

Name of the Vulnerable Software and Affected Versions Plex Media Server versions through 1.42.2.10156 Description Plex Media Server PMS allows retrieval of a permanent access token via a /myplex/account call when using a transient access token. The API endpoint /myplex/account is involved in this...

Plex media server 安全漏洞

Plex media server is a media player from Plex. A security vulnerability exists in Plex media server version 1.42.2.10156 and earlier, which stems from the ability to access /myplex/account using a device token that is not properly aligned with whether or not the device currently has an account...

PT-2026-1111

Name of the Vulnerable Software and Affected Versions Plex Media Server versions prior to 2025-12-31 Description A non-server device token can retrieve share tokens via the shared servers endpoint. These share tokens are intended for unrelated access. Recommendations Update Plex Media Server to a...

EUVD-2019-8773

Malware in sbrugna...

EUVD-2019-0167

Malware in sbrugna...

EUVD-2014-9129

Malware in sbrugna...

EUVD-2018-13552

Malware in sbrugna...

EUVD-2020-26899

Malware in sbrugna...

EUVD-2020-26901

Malware in sbrugna...

EUVD-2025-27473

Malicious code in bioql PyPI...

EUVD-2024-43833

Malicious code in bioql PyPI...

EUVD-2025-25425

Malicious code in bioql PyPI...

GLSA-202509-05 : Plex Media Server: Incorrect resource transfer

The remote host is affected by the vulnerability described in GLSA-202509-05 Plex Media Server: Incorrect resource transfer A vulnerability has been discovered in glibc. Please review the CVE identifier referenced below for details. Tenable has extracted the preceding description block directly...

Plex Media Server: Incorrect resource transfer

Background Plex media server is a media library that is intended for use with a plex client. Description A vulnerability has been discovered in glibc. Please review the CVE identifier referenced below for details. Impact Please review the referenced CVE identifier for details. Workaround There is...

Plex users: Reset your password!

Media streaming platform Plex has warned customers about a data breach, advising them to reset their password. Plex said an attacker broke into one of its databases, allowing them to access a "limited subset" of customer data. This included email addresses, usernames, hashed passwords, and...

CVE-2025-58763 Tautulli vulnerable to Authenticated Remote Code Execution via Command Injection

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. A command injection vulnerability in Tautulli v2.15.3 and prior allows attackers with administrative privileges to obtain remote code execution on the application server. This vulnerability requires the application to...

CVE-2025-58761 Tautulli vulnerable to Unauthenticated Path Traversal in `real_pms_image_proxy`

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The realpmsimageproxy endpoint in Tautulli v2.15.3 and prior is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. The realpmsimageproxy i...