Browse CVEs

HIGH 7.1 CVE-2025-69414 Plex Media Server (PMS) through 1.42.2.10156 allows retrieval of a permanent access token via a /myplex/account call with a transient access token. Media Server after 1.42.2.10156 Fix from $1,9502026-01-02 HIGH 7.1 CVE-2025-69415 In Plex Media Server (PMS) through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether the devic… Media Server after 1.42.2.10156 Fix from $1,9502026-01-02 HIGH 7.5 CVE-2021-33959EPSS 15% Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service. Media Server after 1.21 Fix from $1,9502023-01-18 HIGH 7.0 CVE-2021-42835 An issue was discovered in Plex Media Server through 1.24.4.5081-e362dc1ee. An attacker (with a foothold in a endpoint via a low-privileged user acco… Media Server 1.25.0.5282+ Fix from $1,9502021-12-08 HIGH 8.8 CVE-2020-5742 Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application requests. Media Server 2020-06-15+ Fix from $1,9502020-06-15 HIGH 7.2 CVE-2020-5741 KEVEPSS 73% Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code. Media Server 1.19.3+ Fix from $1,9502020-05-08 HIGH 7.8 CVE-2020-5740 Improper Input Validation in Plex Media Server on Windows allows a local, unauthenticated attacker to execute arbitrary Python code with SYSTEM privi… Media Server 1.19.1.2701+ Fix from $1,9502020-04-22 HIGH 8.8 CVE-2019-19141 The Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote authenticated users to write files anywhere the user account r… Media Server after 1.18.2.2029 Fix from $1,9502019-12-19 MEDIUM 6.5 CVE-2018-21031 Tautulli versions 2.1.38 and below allows remote attackers to bypass intended access control in Plex Media Server because the X-Plex-Token is mishand… Media Server No fix yet Fix from $1,6002019-11-18 CRITICAL 9.8 CVE-2018-13415EPSS 32% In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack.… Media Server No fix yet Fix from $2,3002018-08-13 HIGH 7.5 CVE-2014-9304EPSS 8% Plex Media Server before 0.9.9.3 allows remote attackers to bypass the web server whitelist, conduct SSRF attacks, and execute arbitrary administrati… Media Server after 0.9.9.2 Fix from $1,9502014-12-07 MEDIUM 5.0 CVE-2014-9181EPSS 9% Multiple directory traversal vulnerabilities in Plex Media Server before 0.9.9.3 allow remote attackers to read arbitrary files via a .. (dot dot) in… Media Server after 0.9.9.2 Fix from $1,6002014-12-02