{"id":"CVE-2026-96654","url":"https://compromised.live/t/CVE-2026-96654","kind":"exploited_vuln","tier":2,"severity":"high","title":"Plex Media Server: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability","summary":"An attacker can exploit a web page flaw in Plex Media Server to call other plugin functions and supply their own inputs, and this is being actively exploited in the wild. Plex Media Server. Apply the vendor's update now and check for signs of compromise.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-10-20","due_date":"2026-10-23","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z","status":"active","details":"Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.","aliases":["CVE-2026-96654"],"sources":[{"name":"kev","id":"CVE-2026-96654","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96654"}]}