What’s Vulnerable › Products

Plex Media Server vulnerabilities

20 known vulnerabilities, 5 confirmed exploited in the wild (CISA KEV), 10 published in the last 12 months.

Check whether your Plex Media Server version is affected

Exploited Plex Media Server vulnerabilities

• CVE-2026-96656 — Plex Media Server External Control of File Name or Path Vulnerability
• CVE-2026-96655 — Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
• CVE-2026-96654 — Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
• CVE-2026-96652 — Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
• CVE-2020-5741 — Plex Media Server Remote Code Execution Vulnerability

Latest Plex Media Server vulnerabilities

• CVE-2026-96656 — Plex Media Server External Control of File Name or Path Vulnerability (CVSS 7.2) — exploited
• CVE-2026-96655 — Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability (CVSS 4.3) — exploited
• CVE-2026-96654 — Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability (CVSS 6.5) — exploited
• CVE-2026-96652 — Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability (CVSS 4.3) — exploited
• CVE-2026-96651 — Plex Media Server path traversal (CVSS 6.5)
• CVE-2025-69417 — (CVSS 4.3)
• CVE-2025-69416 — (CVSS 4.3)
• CVE-2025-69415 — (CVSS 7.1)
• CVE-2025-69414 — (CVSS 7.1)
• CVE-2025-34158 — (CVSS 8.5)
• CVE-2021-33959 — (CVSS 7.5)
• CVE-2021-42835 — (CVSS 7.0)
• CVE-2020-5742 — (CVSS 8.8)
• CVE-2020-5741 — Plex Media Server Remote Code Execution Vulnerability (CVSS 7.2) — exploited
• CVE-2020-5740 — (CVSS 7.8)
• CVE-2019-19141 — (CVSS 8.8)
• CVE-2018-21031 — (CVSS 6.5)
• CVE-2018-13415 — (CVSS 9.8)
• CVE-2014-9304 — (CVSS 7.5)
• CVE-2014-9181 — (CVSS 5.0)