Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
21 results
Sep 21, 2026Tautulli is a Python based monitoring and tracking tool for Plex Media Server.CVE-2026-54915 · Other software · Tautulli · reported by GitHubMedium 5.4
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the unauthenticated /auth/redirect endpoint in plexpy/webauth.py removes forward slashes from the user-controlled redirect_uri parameter but leaves tab, line-feed, and carriage-return characters intact. With the default root HTTP_ROOT configuration, CherryPy HTTPRedirect passes the resulting value to urllib.parse.urljoin, which can resolve the whitespace-bearing path to an attacker-controlled external origin. A user who follows a crafted link can therefore be redirected outside Tautulli for phishing or post-login redirect-flow abuse, while custom non-root HTTP_ROOT configurations are not affected by this bypass. This issue is fixed in version 2.17.2.
- Product
- Tautulli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026Tautulli is a Python based monitoring and tracking tool for Plex Media Server.CVE-2026-52835 · Other software · Tautulli · reported by GitHubHigh 7
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the import_config handler and the database_file branch of import_database in plexpy/webserve.py join the attacker-controlled config_file.filename or database_file.filename directly to CACHE_DIR without basename reduction or a containment check. An administrator or caller with the instance API key can submit a multipart filename containing parent-directory segments, causing the upload to be created or overwritten outside CACHE_DIR before file-content validation runs. The write is limited to paths permitted to the Tautulli process, but it can enable configuration tampering, service disruption, or code execution. This issue is fixed in version 2.17.2.
- Product
- Tautulli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026Tautulli is a Python based monitoring and tracking tool for Plex Media Server.CVE-2026-49995 · Other software · Tautulli · reported by GitHubMedium 4.8
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the newsletter cron field stored in the newsletters table is inserted by data/interfaces/default/newsletter_config.html into a JavaScript string without safe JSON encoding. An administrator or caller with the Tautulli API key can store a crafted cron value, and an administrator who later opens the newsletter configuration modal passively triggers script execution in the Tautulli web context. The stored value persists in the database and can continue to execute after credential rotation until it is removed. This issue is fixed in version 2.17.2.
- Product
- Tautulli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026Tautulli is a Python based monitoring and tracking tool for Plex Media Server.CVE-2026-45381 · Other software · Tautulli · reported by GitHubMedium 5.1
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the /search endpoint inserts its user-controlled query parameter into a JavaScript string in data/interfaces/default/search.html using manual escaping that handles quotes and slashes but not backslashes. A backslash-quote sequence can terminate the string, so an unauthenticated attacker can send a crafted link that executes script in the Tautulli web context when an authenticated user follows it. This issue is fixed in version 2.17.2.
- Product
- Tautulli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2026Tautulli is a Python based monitoring and tracking tool for Plex Media Server.CVE-2026-43986 · Other software · Tautulli · reported by GitHubCritical 9.9
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose a public `/image/<hash>` route that resolves attacker-controlled entries from `image_hash_lookup` and replays them through the same server-side image fetch logic used by authenticated image proxying. A low-privilege guest user can seed a malicious external image URL into this lookup table and then trigger server-side fetches through a fully unauthenticated endpoint. This turns an authenticated SSRF primitive into a persistent unauthenticated SSRF gadget. Once the malicious hash entry exists, any external user can request `/image/<hash>.png` and cause the PMS or Tautulli host to fetch an arbitrary attacker-chosen URL. Version 2.17.1 patches the issue.
- Product
- Tautulli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2026Tautulli is a Python based monitoring and tracking tool for Plex Media Server.CVE-2026-43985 · Other software · Tautulli · reported by GitHubHigh 8.8
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose `configUpdate` as a state-changing administrator endpoint, but the route does not enforce `POST` and does not use any anti-CSRF token. In the default form and JWT-based authentication mode, the administrator session cookie is issued with `SameSite=Lax`, which still permits top-level cross-site navigation requests. An attacker can exploit this by luring a logged-in administrator to a malicious page that submits a cross-site request to `/configUpdate` and overwrites the local administrator username and password. The attacker can then sign in directly with the chosen credentials and take over the Tautulli administrative interface. Version 2.17.1 patches the issue.
- Product
- Tautulli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2026Tautulli is a Python based monitoring and tracking tool for Plex Media Server.CVE-2026-43984 · Other software · Tautulli · reported by GitHubHigh 8.9
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose `log_js_errors` to any authenticated user, including guest users when guest access is enabled. The endpoint writes attacker-controlled strings directly into the main application log. The administrator-only `logFile` view then reads that log file and embeds it into an HTML response without escaping. This creates a stored cross-site scripting condition where a low-privilege guest can inject HTML or JavaScript into the log file and have it execute in an administrator's browser when the log viewer is opened. Version 2.17.1 patches the issue.
- Product
- Tautulli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2026Tautulli is a Python based monitoring and tracking tool for Plex Media Server.CVE-2026-41065 · Other software · Tautulli · reported by GitHubHigh 8.9
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 are vulnerable to remote code execution via the newsletter custom template directory feature. On a fresh install before the setup wizard is completed, all management endpoints are completely unauthenticated. An attacker can create a newsletter agent, point the custom template directory to an attacker-controlled SMB share serving a malicious Mako template, and trigger execution via the newsletter render endpoint, all with zero credentials and no local access to the target system. On a completed install with credentials configured, the same chain is exploitable by any admin. Version 2.17.1 fixes the issue.
- Product
- Tautulli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2026Tautulli is a Python based monitoring and tracking tool for Plex Media Server.CVE-2026-40605 · Other software · Tautulli · reported by GitHubMedium 5.7
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.1, a path traversal vulnerability in the cache deletion endpoint allows authenticated API access to delete directories outside the configured cache path. This can cause arbitrary data loss and service disruption. Version 2.17.1 fixes the issue.
- Product
- Tautulli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Tautulli is a Python based monitoring and tracking tool for Plex Media Server.CVE-2026-32275 · Other software · Tautulli · reported by GitHubHigh 7.4
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. From version 1.3.10 to before version 2.17.0, an unsanitized JSONP callback parameter allows cross-origin script injection and API key theft. This issue has been patched in version 2.17.0.
- Product
- Tautulli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Tautulli is a Python based monitoring and tracking tool for Plex Media Server.CVE-2026-31831 · Other software · Tautulli · reported by GitHubHigh 8.7
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images API endpoint is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. This issue has been patched in version 2.17.0.
- Product
- Tautulli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Tautulli is a Python based monitoring and tracking tool for Plex Media Server.CVE-2026-31804 · Other software · Tautulli · reported by GitHubMedium 4
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /pms_image_proxy endpoint accepts a user-supplied img parameter and forwards it to Plex Media Server's /photo/:/ transcode transcoder without authentication and without restricting the scheme or host. The endpoint is intentionally excluded from all authentication checks in webstart.py, any value of img beginning with http is passed directly to Plex, this causes the Plex Media Server process, which typically runs on the same host or internal network as Tautulli, with access to RFC-1918 address space, to issue an outbound HTTP request to any attacker-specified URL. This issue has been patched in version 2.17.0.
- Product
- Tautulli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Tautulli is a Python based monitoring and tracking tool for Plex Media Server.CVE-2026-31799 · Other software · Tautulli · reported by GitHubMedium 4.9
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. From version 2.14.2 to before version 2.17.0 for parameters "before" and "after" and from version 2.1.0-beta to before version 2.17.0 for parameters "section_id" and "user_id", the /api/v2?cmd=get_home_stats endpoint passes the section_id, user_id, before, and after query parameters directly into SQL via Python %-string formatting without parameterization. An attacker who holds the Tautulli admin API key can inject arbitrary SQL and exfiltrate any value from the Tautulli SQLite database via boolean-blind inference. This issue has been patched in version 2.17.0.
- Product
- Tautulli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Tautulli is a Python based monitoring and tracking tool for Plex Media Server.CVE-2026-28505 · Other software · Tautulli · reported by GitHubHigh 7.5
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the str_eval() function in notification_handler.py implements a sandboxed eval() for notification text templates. The sandbox attempts to restrict callable names by inspecting code.co_names of the compiled code object. However, co_names only contains names from the outer code object. When a lambda expression is used, it creates a nested code object whose attribute accesses are stored in code.co_consts, NOT in code.co_names. The sandbox never inspects nested code objects. This issue has been patched in version 2.17.0.
- Product
- Tautulli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Tautulli is a Python based monitoring and tracking tool for Plex Media Server.CVE-2025-58763 · Other software · Tautulli · reported by GitHubHigh 8
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. A command injection vulnerability in Tautulli v2.15.3 and prior allows attackers with administrative privileges to obtain remote code execution on the application server. This vulnerability requires the application to have been cloned from GitHub and installed manually. When Tautulli is cloned directly from GitHub and installed manually, the application manages updates and versioning through calls to the `git` command. In the code, this is performed through the `runGit` function in `versioncheck.py`. Since `shell=True` is passed to `subproces.Popen`, this call is vulnerable to subject to command injection, as shell characters within arguments will be passed to the underlying shell. A concrete location where this can be triggered is in the `checkout_git_branch` endpoint. This endpoint stores a user-supplied remote and branch name into the `GIT_REMOTE` and `GIT_BRANCH` configuration keys without sanitization. Downstream, these keys are then fetched and passed directly into `runGit` using a format string. Hence, code execution can be obtained by using `$()` interpolation in a command. Version 2.16.0 contain
- Product
- Tautulli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Tautulli is a Python based monitoring and tracking tool for Plex Media Server.CVE-2025-58762 · Other software · Tautulli · reported by GitHubCritical 9.1
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. In Tautulli v2.15.3 and earlier, an attacker with administrative access can use the `pms_image_proxy` endpoint to write arbitrary python scripts into the application filesystem. This leads to remote code execution when combined with the `Script` notification agent. If an attacker with administrative access changes the URL of the PMS to a server they control, they can then abuse the `pms_image_proxy` to obtain a file write into the application filesystem. This can be done by making a `pms_image_proxy` request with a URL in the `img` parameter and the desired file name in the `img_format` parameter. Tautulli then uses a hash of the desired metadata together with the `img_format` in order to construct a file path. Since the attacker controls `img_format` which occupies the end of the file path, and `img_format` is not sanitised, the attacker can then use path traversal characters to specify filename of their choosing. If the specified file does not exist, Tautaulli will then attempt to fetch the image from the configured PMS. Since the attacker controls the PMS, they can return arbitrary content in response
- Product
- Tautulli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Tautulli is a Python based monitoring and tracking tool for Plex Media Server.CVE-2025-58761 · Other software · Tautulli · reported by GitHubHigh 8.6
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The `real_pms_image_proxy` endpoint in Tautulli v2.15.3 and prior is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. The `real_pms_image_proxy` is used to fetch an image directly from the backing Plex Media Server. The image to be fetched is specified through an `img` URL parameter, which can either be a URL or a file path. There is some validation ensuring that `img` begins with the prefix `interfaces/default/images` in order to be served from the local filesystem. However this can be bypassed by passing an `img` parameter which begins with a valid prefix, and then adjoining path traversal characters in order to reach files outside of intended directories. An attacker can exfiltrate files on the application file system, including the `tautulli.db` SQLite database containing active JWT tokens, as well as the `config.ini` file which contains the hashed admin password, the JWT token secret, and the Plex Media Server token and connection details. If the password is cracked, or if a valid JWT token is present in the database,
- Product
- Tautulli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Tautulli is a Python based monitoring and tracking tool for Plex Media Server.CVE-2025-58760 · Other software · Tautulli · reported by GitHubHigh 8.6
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The `/image` API endpoint in Tautulli v2.15.3 and earlier is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. In Tautulli, the `/image` API endpoint is used to serve static images from the application's data directory to users. This endpoint can be accessed without authentication, and its intended purpose is for server background images and icons within the user interface. Attackers can exfiltrate files from the application file system, including the `tautulli.db` SQLite database containing active JWT tokens, as well as the `config.ini` file which contains the hashed admin password, the JWT token secret, and the Plex Media Server token and connection details. If the password is cracked, or if a valid JWT token is present in the database, an unauthenticated attacker can escalate their privileges to obtain administrative control over the application. Version 2.16.0 contains a fix for the issue.
- Product
- Tautulli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2019In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server.CVE-2019-19833 · Other software · Tautulli · reported by MITREMedium 6.5
In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server. (Also, anonymous access can be achieved in applications that do not have a user login area).
- Product
- Tautulli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Nov 18, 2019Tautulli versions 2.1.38 and below allows remote attackers to bypass intended access control in Plex Media Server because the X-Plex-Token is mishandled and canCVE-2018-21031 · Other software · Plex · reported by MITREMedium 6.5
Tautulli versions 2.1.38 and below allows remote attackers to bypass intended access control in Plex Media Server because the X-Plex-Token is mishandled and can be retrieved from Tautulli. NOTE: Initially, this id was associated with Plex Media Server 1.18.2.2029-36236cc4c as the affected product and version. Further research indicated that Tautulli is the correct affected product.
- Product
- Media Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.plex.tvtwitter.com
Feb 19, 2019data/interfaces/default/history.html in Tautulli 2.1.26 has XSS via a crafted Plex username that is mishandled when constructing the History page.CVE-2019-8939 · Other software · Tautulli · reported by MITREMedium 6.1
data/interfaces/default/history.html in Tautulli 2.1.26 has XSS via a crafted Plex username that is mishandled when constructing the History page.
- Product
- Tautulli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.