{"id":"CVE-2026-96655","url":"https://compromised.live/t/CVE-2026-96655","kind":"exploited_vuln","tier":2,"severity":"high","title":"Plex Media Server: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","summary":"An authenticated user can make the server send requests to internal or external addresses of their choosing, which is being actively exploited in attacks and can be chained with other flaws. Plex Media Server. Apply the vendor's update now and check for signs of compromise.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-10-20","due_date":"2026-11-03","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z","status":"active","details":"Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.","aliases":["CVE-2026-96655"],"sources":[{"name":"kev","id":"CVE-2026-96655","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96655"}]}