{"revision":"4384e64fad2b4959a68bf92ec94901e2","evidence":{"cve":"CVE-2026-96654","kev":{"cve":"CVE-2026-96654","product":"Media Server","name":"Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability","dateAdded":"2026-10-20","dueDate":"2026-10-23","knownRansomwareUse":false,"shortDescription":"Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.","vendor":"Plex","isMicrosoft":false,"products":[],"advisoryUrl":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","publicExploit":null,"msrcUrl":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96654","cisaUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-96654"},"epss":null,"observedAt":"2026-10-23T16:01:26.7735792+00:00","kevRetained":false,"reviewIdentity":"961328b13e1d22727339aaed"}}