EUVD-2026-85368

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters...

CVE-2026-96654

Plex Media Server versions prior to 1.43.3.10861 are vulnerable to a URL injection flaw. The software fails to correctly neutralize URL values within the 'searchOne' parameter, which enables an attacker to call functions from other plugins and provide their own parameters. While the documents do ...