EUVD-2020-26899

Malware in sbrugna...

EUVD-2020-26901

Malware in sbrugna...

EUVD-2014-9129

Malware in sbrugna...

EUVD-2025-27473

Malicious code in bioql PyPI...

EUVD-2024-43833

Malicious code in bioql PyPI...

EUVD-2025-25425

Malicious code in bioql PyPI...

GLSA-202509-05 : Plex Media Server: Incorrect resource transfer

The remote host is affected by the vulnerability described in GLSA-202509-05 Plex Media Server: Incorrect resource transfer A vulnerability has been discovered in glibc. Please review the CVE identifier referenced below for details. Tenable has extracted the preceding description block directly...

Plex Media Server: Incorrect resource transfer

Background Plex media server is a media library that is intended for use with a plex client. Description A vulnerability has been discovered in glibc. Please review the CVE identifier referenced below for details. Impact Please review the referenced CVE identifier for details. Workaround There is...

Plex users: Reset your password!

Media streaming platform Plex has warned customers about a data breach, advising them to reset their password. Plex said an attacker broke into one of its databases, allowing them to access a "limited subset" of customer data. This included email addresses, usernames, hashed passwords, and...

CVE-2025-58763 Tautulli vulnerable to Authenticated Remote Code Execution via Command Injection

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. A command injection vulnerability in Tautulli v2.15.3 and prior allows attackers with administrative privileges to obtain remote code execution on the application server. This vulnerability requires the application to...

CVE-2025-58761 Tautulli vulnerable to Unauthenticated Path Traversal in `real_pms_image_proxy`

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The realpmsimageproxy endpoint in Tautulli v2.15.3 and prior is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. The realpmsimageproxy i...

CVE-2025-58760 Tautulli vulnerable to Unauthenticated Path Traversal in `/image` endpoint

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The /image API endpoint in Tautulli v2.15.3 and earlier is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. In Tautulli, the /image API...

CVE-2025-34158

Plex Media Server PMS 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides the credentials of the server owner and a /api/resources call reveals other servers accessible by that server owner...

Plex Media Server 1.41.7.x - 1.42.0.x Resource Transfer Vulnerability

Plex Media Server is prone to an incorrect resource transfer vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2025-34158

Plex Media Server PMS 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides the credentials of the server owner and a /api/resources call reveals other servers accessible by that server owner...

CVE-2025-34158

Plex Media Server PMS 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides the credentials of the server owner and a /api/resources call reveals other servers accessible by that server owner...

CVE-2025-34158

Plex Media Server PMS 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides the credentials of the server owner and a /api/resources call reveals other servers accessible by that server owner...

CVE-2025-34158

Summary: Plex Media Server (PMS) versions 1.41.7.x–1.42.0.x (before 1.42.1) are affected by token/credential disclosure through account and API surfaces, per CVE-2025-34158. Connected documents extend the impact to multiple PMS versions, noting PMS

PT-2025-34216

Name of the Vulnerable Software and Affected Versions Plex Media Server versions 1.41.7.x through 1.42.0.x Description Plex Media Server PMS versions 1.41.7.x through 1.42.0.x are affected by an unspecified security vulnerability reported through Plex’s bug bounty program. Over 300,000 instances...

CVE-2025-34158: Incorrect Resource Transfer Between Spheres

Plex Media Server PMS 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides the credentials of the server owner and a /api/resources call reveals other servers accessible by that server owner...