{"revision":"05c3137457c04db0af100f616def9568","evidence":{"cve":"CVE-2026-96655","kev":{"cve":"CVE-2026-96655","product":"Media Server","name":"Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","dateAdded":"2026-10-20","dueDate":"2026-11-03","knownRansomwareUse":false,"shortDescription":"Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.","vendor":"Plex","isMicrosoft":false,"products":[],"advisoryUrl":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","publicExploit":null,"msrcUrl":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96655","cisaUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-96655"},"epss":null,"observedAt":"2026-10-23T16:01:26.7735792+00:00","kevRetained":false,"reviewIdentity":"e94dd9b4f346d4fc1923ad9d"}}