CVE-2026-96652

CWE-918

Final Priority

High

Raised from Low (raw RPS) by the KEV floor: in CISA KEV

43.1

Raw RPS

Description

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.

Source: NVD

CVSS: 4.3; Medium · v3.1
EPSS: 0.45%; Probability of exploitation in the next 30 days (FIRST) · Percentile: 38.5%
CISA KEV: In CISA KEV since Oct 2026; Confirmed exploitation in the wild (CISA KEV)
Upstream fix commit: No verified fix commit in DevSecure data; Sources: MoreFixes, FreshFixes
SSVC inputs (CISA): Exploitation: Active · Automatable: No · Technical impact: Partial; CISA's assessed SSVC inputs, not a decision. A decision also needs your mission and public well-being context. Context only; not part of the RPS score.
Weakness: CWE-918
Published: 23 Sept 2026; Last modified 21 Oct 2026

How to read these signals: RPS · EPSS · CISA KEV · Data sources

What would change this priority?

•Stays at least High while it is in CISA KEV (KEV floor).

Explains the published RPS formula and priority rules; it doesn't change the score. How priority works

Get this score from the API

curl -H "Authorization: Bearer dsec_live_xxxxxxxx" \
  https://api.intelligence.devsecure.io/api/v1/rps/CVE-2026-96652

Replace the placeholder with your key. Get a free API key or rank your own CVEs.

Data as of 23 Oct 2026, 05:17 UK time

This product uses the NVD API but is not endorsed or certified by the NVD. Data sources and licences

CVE-2026-96652

Description

Signals

What would change this priority?

Get this score from the API