# CVE-2026-96654

> **Plex Media Server** vulnerability · **listed in CISA Known Exploited Vulnerabilities catalog** · severity: **MEDIUM** (CVSS 6.5).

## Description

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

## Key facts

- **CVE ID:** CVE-2026-96654
- **Vendor:** Plex
- **Product:** Media Server
- **Published:** 2026-09-23
- **CVSS severity:** MEDIUM
- **CVSS base score:** 6.5
- **CISA remediation due date:** 2026-10-23
- **CWE codes:** CWE-84

## Affected products

- `plex:media_server`

## Primary sources

- NIST NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96654
- CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

## Citation

> MORVS. CVE-2026-96654. Retrieved 2026-10-27 from https://api.morvs.ai/cve/CVE-2026-96654. Derived from NIST NVD + CISA KEV. Licensed CC0.

---

*[Dataset catalog](https://api.morvs.ai/datasets/) · [MORVS](https://morvs.ai/) · CC0 1.0*