{"revision":"dc6929f3b4764d3aa346c0ef44b4f20c","evidence":{"cve":"CVE-2026-96652","kev":{"cve":"CVE-2026-96652","product":"Media Server","name":"Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","dateAdded":"2026-10-20","dueDate":"2026-11-03","knownRansomwareUse":false,"shortDescription":"Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.","vendor":"Plex","isMicrosoft":false,"products":[],"advisoryUrl":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","publicExploit":null,"msrcUrl":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96652","cisaUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-96652"},"epss":null,"observedAt":"2026-10-23T16:01:26.7735792+00:00","kevRetained":false,"reviewIdentity":"1c8a3253efc94bb876e1e4c4"}}