EUVD-2026-85369

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter...

CVE-2026-96655

Plex Media Server versions before 1.43.3.10861 are vulnerable to a Server-Side Request Forgery (SSRF) . An authenticated user can exploit the '/video/:/transcode/universal' path parameter to force the server to make requests to arbitrary internal or external addresses . The provided documents do ...