{"apiVersion":"1","notice":"Security Threat Pulse API v1. Free, no key. Facts with sources; verdicts follow the published rules at https://securitythreatpulse.com/methodology. Not advice. Some source data is withheld here until its terms allow re-serving.","generatedAt":"2026-11-11T08:30:28.237Z","products":["plex"],"actNowTotal":1,"results":[{"query":"plex","matched":1,"actNow":1,"events":[{"id":"kev-2026-10-20-plex-media-server","url":"https://securitythreatpulse.com/events/kev-2026-10-20-plex-media-server","title":"Plex Media Server: 4 flaws used in attacks; attackers can reach systems behind it","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 48 days old, so many systems are likely still unpatched. Ready-made attack tools are public.","tier":"now","rankScore":4,"rankWhy":["Exploitation is confirmed by an authoritative source.","Ready-made attack tools are public."],"rulesVersion":"v3","ladder":{"talk":"confirmed","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-96652","CVE-2026-96654","CVE-2026-96655","CVE-2026-96656"],"vendor":"Plex","product":"Media Server","affectedProducts":[{"kind":"direct","slug":"plex/mediaserver","vendor":"Plex","product":"Media Server","evidence":["kev","cpe"],"vendorKey":"plex","productKey":"mediaserver"}],"category":{"id":"other","label":"Other software","why":"Software we have not put in a category yet. Your IT team or provider will know whether you run it.","doThis":"Find out if you use it. If you do, apply the vendor's fix."},"summary":"Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.","cvss":8.6,"epss":0.11886,"exploitMaturity":"weaponized","kevListed":true,"kevDateAdded":"2026-10-20","kevDueDate":"2026-10-23","firstSeenAt":"2026-10-20T00:00:00.000Z","updatedAt":"2026-11-11T00:00:06.173Z","newestEvidenceAt":"2026-11-10T20:15:27.185Z"}]}]}